Security/LdapAuthenticationTrait.php
protected function getBindUsername(UserInterface $user, $queryAttribute)
    {
        if ($user instanceof LdapObject && $user->has('dn')) {
            return $user->get('dn');
        }
        if ($queryAttribute === null) {
            return $user->getUsername();
        }

        return $this->ldapUserProvider
            ->getLdapUser($queryAttribute, $user->getUsername())
            ->get('dn');
    }
protected function getBindUsername(UserInterface $user, $queryAttribute)
    {
        if ($user instanceof LdapObject && $user->has('dn')) {
            return $user->get('dn');
        }
        if ($queryAttribute === null) {
            return $user->getUsername();
        }

        return $this->ldapUserProvider
            ->getLdapUser($queryAttribute, $user->getUsername())
            ->get('dn');
    }
The logic for determining the username/DN to bind with is as follows:

1. Always prefer a DN from a default user from the LDAP user provider, or LdapObject instance from LdapTools
2. If it wasn't a LdapObject and no attribute was explicitly set to query LDAP for, use the UserInterface username
3. Query LDAP using a specific attribute for a user with the specified username, return the DN.

@param UserInterface $user
@param string|null $queryAttribute
@return string