diff --git a/CHANGELOG b/CHANGELOG
index f989c92cd4..17838defaa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,5 @@
+* Always check if a password is not empty to avoid unauthenticated bind.
+
 Version 2.2.0 - 2011-10-24
 * Bug fixes (see mercurial logs for details)
 
diff --git a/res.py b/res.py
index d34e93e44f..65b07f260b 100644
--- a/res.py
+++ b/res.py
@@ -124,7 +124,7 @@ class User(ModelSQL, ModelView):
                 con.simple_bind_s(connection.bind_dn, connection.bind_pass)
             [(dn, attrs)] = self.ldap_search_user(login, con, connection,
                     attrs=[str(connection.auth_uid)])
-            if con.simple_bind_s(dn, password):
+            if password and con.simple_bind_s(dn, password):
                 user_id, _, _ = self._get_login(login)
                 if user_id:
                     return user_id