LDAP_BIND_pwd=
search_user_password

If both of the following conditions apply, PowerExchange uses the default value, which is an empty string, as the search user password:
You do not define the LDAP_BIND_PWD statement or the LDAP_BIND_EPWD statement.
You do not both define the LDAP_TLS statement to require client certification and define the LDAP_SASL_MECH=EXTERNAL statement.
An empty string is acceptable if the LDAP server has been configured to allow anonymous access.
If you define the LDAP_TLS statement to require client certification and define the LDAP_SASL_MECH=EXTERNAL statement, the value of LDAP_BIND_PWD is ignored. The credentials of the search user are determined from the client certificate and the certificate mapping of the LDAP server.