Don't provide a password for sasl authentication. When a sasl parameter is given (and used) the password parameter is not used by Net::LDAP. If indeed a password is required it has to be passed in the Authen::SASL object, not as parameter to bind. So drop the password parameter which stops trying (and failing) to use password authentication sometimes if in Net/LDAP.pm the iteration over %ptype hits its 'password' member before the 'sasl' member.