Don't provide a password for sasl authentication. When a sasl parameter is given (and used) the password parameter is not used by Net::LDAP. If indeed a password is required it has to be passed in the Authen::SASL object, not as parameter to bind. So drop the password parameter which stops trying (and failing) to use password authentication sometimes if in Net/LDAP.pm the iteration over %ptype hits its 'password' member before the 'sasl' member.

--- a/shelldap	Sat Aug 31 21:47:20 2019 -0700
+++ b/shelldap	Sun Oct 13 10:19:40 2019 -0700
@@ -770,7 +770,6 @@
 	#
 	if ( $sasl_conn ) {
 		$rv = $ldap->bind( $conf->{'binddn'},
-			password => $conf->{'bindpass'},
 			sasl     => $sasl_conn
 		);
 	}