Michael, the JIRA ticket is:
http://support.liferay.com/browse/LEP-2003
For those of you interested in a temporal solution (forcing the bind):
com/liferay/portal/security/auth/LDAPAuth.java
CHANGE THE IF-ELSE BLOCK, EITHER COMMENTING OUT THE FIRS PART [if (userPassword != null) { ....}] OR FORCING TO BIND (forcing the "else" with a "if (false)" ... AND I know... not too elegant 
) 1
2252 private static boolean _authenticate(
3 253 LdapContext ctx, Properties env, Binding binding, String baseDN,
4 254 Attribute userPassword, String password, String companyId,
5 255 String userId, String emailAddress)
6 256 throws Exception {
7 257
8 258 // Check passwords by either doing a comparison between the passwords or
9 259 // by binding to the LDAP server
10 260
11 261
12 262 // if (userPassword != null) {
13 263 System.out.println ("I won't let liferay to compare passwords, just force the bind"); 264 if (false) {
14 265 String ldapPassword = new String((byte[])userPassword.get());
15 266
16 267 String encryptedPassword = password;
17 268
18 269 String algorithm = PrefsPropsUtil.getString(
19 270 companyId,
20 271 PropsUtil.AUTH_IMPL_LDAP_PASSWORD_ENCRYPTION_ALGORITHM);
21 272
22 273 if (Validator.isNotNull(algorithm)) {
23 274 encryptedPassword =
24 275 "{" + algorithm + "}" +
25 276 Encryptor.digest(algorithm, password);
26 277 }
27 278
28 279 if (!ldapPassword.equals(encryptedPassword)) {
29 280 _log.error(
30 281 "LDAP password " + ldapPassword +
31 282 " does not match with given password " +
32 283 encryptedPassword + " for user id " + userId);
33 284
34 285 return false;
35 286 }
36 287 }
37 288 else {
38 289 try {
39 290 String userDN = binding.getName() + StringPool.COMMA + baseDN;
40 291
41 292 env.put(Context.SECURITY_PRINCIPAL, userDN);
42 293 env.put(Context.SECURITY_CREDENTIALS, password);
43 294
44 295 ctx = new InitialLdapContext(env, null);
45 296 }
46 297 catch (Exception e) {
47 298 _log.error(
48 299 "Failed to bind to the LDAP server with " + userId +
49 300 " " + password, e);
50 301
51 302 return false;
52 303 }
53 304 }
54 305
55 306 return true;
56 307 }
