Update description for deny_null_bind on ldap auth backend config (#1043)

Current description of deny_null_bind parameter on the LDAP auth engine
looks like we have an option to allow anonymous authentication. This
change adds additional context on the purpose and impact of this
parameter in the description.

The change is across all versions of Vault available in our
documentation

Author: kevin-loehfelm

content/vault/v1.10.x/content/api-docs/auth/ldap.mdx

@@ -60,8 +60,12 @@ This endpoint configures the LDAP auth method.
   username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `discoverdn` `(bool: false)` – Use anonymous bind to discover the bind DN of a
   user.
-- `deny_null_bind` `(bool: true)` – This option prevents users from bypassing
-  authentication when providing an empty password.
+- `deny_null_bind` `(bool: true)` – By default, Vault prevents LDAP authentication 
+  attempts when the user provides an empty password (null binds). Setting
+  `deny_null_bind` to `false` tells Vault to defer the handling of empty-password
+  authentication attempts to the LDAP server. You may want to allow LDAP
+  anonymous bind operations for directory configurations using anonymous search
+  or discovery.
 - `upndomain` `(string: "")` – The userPrincipalDomain used to construct the UPN
   string for the authenticating user. The constructed UPN will appear as
   `[username]@UPNDomain`. Example: `example.com`, which will cause vault to bind

content/vault/v1.10.x/content/docs/auth/ldap.mdx

@@ -126,7 +126,7 @@ There are two alternate methods of resolving the user object used to authenticat
 - `userdn` (string, optional) - Base DN under which to perform user search. Example: `ou=Users,dc=example,dc=com`
 - `userattr` (string, optional) - Attribute on user attribute object matching the username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `userfilter` (string, optional) - Go template used to construct a ldap user search filter. The template can access the following context variables: \[`UserAttr`, `Username`\]. The default userfilter is `({{.UserAttr}}={{.Username}})` or `(userPrincipalName={{.Username}}@UPNDomain)` if the `upndomain` parameter is set. The user search filter can be used to restrict what user can attempt to log in. For example, to limit login to users that are not contractors, you could write `(&(objectClass=user)({{.UserAttr}}={{.Username}})(!(employeeType=Contractor)))`.
-- `deny_null_bind` (bool, optional) - This option prevents users from bypassing authentication when providing an empty password. The default is `true`.
+- `deny_null_bind` (bool, optional) - By default, Vault prevents LDAP authentication attempts when the user provides an empty password (null binds). Setting `deny_null_bind` to `false` tells Vault to defer the handling of empty-password authentication attempts to the LDAP server. You may want to allow LDAP anonymous bind operations for directory configurations using anonymous search or discovery. The default is `true`.
 - `anonymous_group_search` (bool, optional) - Use anonymous binds when performing LDAP group searches. Defaults to `false`.
 
 @include 'ldap-auth-userfilter-warning.mdx'

content/vault/v1.11.x/content/api-docs/auth/ldap.mdx

@@ -65,8 +65,12 @@ This endpoint configures the LDAP auth method.
   username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `discoverdn` `(bool: false)` – Use anonymous bind to discover the bind DN of a
   user.
-- `deny_null_bind` `(bool: true)` – This option prevents users from bypassing
-  authentication when providing an empty password.
+- `deny_null_bind` `(bool: true)` – By default, Vault prevents LDAP authentication 
+  attempts when the user provides an empty password (null binds). Setting
+  `deny_null_bind` to `false` tells Vault to defer the handling of empty-password
+  authentication attempts to the LDAP server. You may want to allow LDAP
+  anonymous bind operations for directory configurations using anonymous search
+  or discovery.
 - `upndomain` `(string: "")` – The userPrincipalDomain used to construct the UPN
   string for the authenticating user. The constructed UPN will appear as
   `[username]@UPNDomain`. Example: `example.com`, which will cause vault to bind

content/vault/v1.11.x/content/docs/auth/ldap.mdx

@@ -128,7 +128,7 @@ There are two alternate methods of resolving the user object used to authenticat
 - `userdn` (string, optional) - Base DN under which to perform user search. Example: `ou=Users,dc=example,dc=com`
 - `userattr` (string, optional) - Attribute on user attribute object matching the username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `userfilter` (string, optional) - Go template used to construct a ldap user search filter. The template can access the following context variables: \[`UserAttr`, `Username`\]. The default userfilter is `({{.UserAttr}}={{.Username}})` or `(userPrincipalName={{.Username}}@UPNDomain)` if the `upndomain` parameter is set. The user search filter can be used to restrict what user can attempt to log in. For example, to limit login to users that are not contractors, you could write `(&(objectClass=user)({{.UserAttr}}={{.Username}})(!(employeeType=Contractor)))`.
-- `deny_null_bind` (bool, optional) - This option prevents users from bypassing authentication when providing an empty password. The default is `true`.
+- `deny_null_bind` (bool, optional) - By default, Vault prevents LDAP authentication attempts when the user provides an empty password (null binds). Setting `deny_null_bind` to `false` tells Vault to defer the handling of empty-password authentication attempts to the LDAP server. You may want to allow LDAP anonymous bind operations for directory configurations using anonymous search or discovery. The default is `true`.
 - `anonymous_group_search` (bool, optional) - Use anonymous binds when performing LDAP group searches. Defaults to `false`.
 
 @include 'ldap-auth-userfilter-warning.mdx'

content/vault/v1.12.x/content/api-docs/auth/ldap.mdx

@@ -65,8 +65,12 @@ This endpoint configures the LDAP auth method.
   username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `discoverdn` `(bool: false)` – Use anonymous bind to discover the bind DN of a
   user.
-- `deny_null_bind` `(bool: true)` – This option prevents users from bypassing
-  authentication when providing an empty password.
+- `deny_null_bind` `(bool: true)` – By default, Vault prevents LDAP authentication 
+  attempts when the user provides an empty password (null binds). Setting
+  `deny_null_bind` to `false` tells Vault to defer the handling of empty-password
+  authentication attempts to the LDAP server. You may want to allow LDAP
+  anonymous bind operations for directory configurations using anonymous search
+  or discovery.
 - `upndomain` `(string: "")` – The userPrincipalDomain used to construct the UPN
   string for the authenticating user. The constructed UPN will appear as
   `[username]@UPNDomain`. Example: `example.com`, which will cause vault to bind

content/vault/v1.12.x/content/docs/auth/ldap.mdx

@@ -128,7 +128,7 @@ There are two alternate methods of resolving the user object used to authenticat
 - `userdn` (string, optional) - Base DN under which to perform user search. Example: `ou=Users,dc=example,dc=com`
 - `userattr` (string, optional) - Attribute on user attribute object matching the username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `userfilter` (string, optional) - Go template used to construct a ldap user search filter. The template can access the following context variables: \[`UserAttr`, `Username`\]. The default userfilter is `({{.UserAttr}}={{.Username}})` or `(userPrincipalName={{.Username}}@UPNDomain)` if the `upndomain` parameter is set. The user search filter can be used to restrict what user can attempt to log in. For example, to limit login to users that are not contractors, you could write `(&(objectClass=user)({{.UserAttr}}={{.Username}})(!(employeeType=Contractor)))`.
-- `deny_null_bind` (bool, optional) - This option prevents users from bypassing authentication when providing an empty password. The default is `true`.
+- `deny_null_bind` (bool, optional) - By default, Vault prevents LDAP authentication attempts when the user provides an empty password (null binds). Setting `deny_null_bind` to `false` tells Vault to defer the handling of empty-password authentication attempts to the LDAP server. You may want to allow LDAP anonymous bind operations for directory configurations using anonymous search or discovery. The default is `true`.
 - `anonymous_group_search` (bool, optional) - Use anonymous binds when performing LDAP group searches. Defaults to `false`.
 
 @include 'ldap-auth-userfilter-warning.mdx'

content/vault/v1.13.x/content/api-docs/auth/ldap.mdx

@@ -65,8 +65,12 @@ This endpoint configures the LDAP auth method.
   username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `discoverdn` `(bool: false)` – Use anonymous bind to discover the bind DN of a
   user.
-- `deny_null_bind` `(bool: true)` – This option prevents users from bypassing
-  authentication when providing an empty password.
+- `deny_null_bind` `(bool: true)` – By default, Vault prevents LDAP authentication 
+  attempts when the user provides an empty password (null binds). Setting
+  `deny_null_bind` to `false` tells Vault to defer the handling of empty-password
+  authentication attempts to the LDAP server. You may want to allow LDAP
+  anonymous bind operations for directory configurations using anonymous search
+  or discovery.
 - `upndomain` `(string: "")` – The userPrincipalDomain used to construct the UPN
   string for the authenticating user. The constructed UPN will appear as
   `[username]@UPNDomain`. Example: `example.com`, which will cause vault to bind

content/vault/v1.13.x/content/docs/auth/ldap.mdx

@@ -128,7 +128,7 @@ There are two alternate methods of resolving the user object used to authenticat
 - `userdn` (string, optional) - Base DN under which to perform user search. Example: `ou=Users,dc=example,dc=com`
 - `userattr` (string, optional) - Attribute on user attribute object matching the username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `userfilter` (string, optional) - Go template used to construct a ldap user search filter. The template can access the following context variables: \[`UserAttr`, `Username`\]. The default userfilter is `({{.UserAttr}}={{.Username}})` or `(userPrincipalName={{.Username}}@UPNDomain)` if the `upndomain` parameter is set. The user search filter can be used to restrict what user can attempt to log in. For example, to limit login to users that are not contractors, you could write `(&(objectClass=user)({{.UserAttr}}={{.Username}})(!(employeeType=Contractor)))`.
-- `deny_null_bind` (bool, optional) - This option prevents users from bypassing authentication when providing an empty password. The default is `true`.
+- `deny_null_bind` (bool, optional) - By default, Vault prevents LDAP authentication attempts when the user provides an empty password (null binds). Setting `deny_null_bind` to `false` tells Vault to defer the handling of empty-password authentication attempts to the LDAP server. You may want to allow LDAP anonymous bind operations for directory configurations using anonymous search or discovery. The default is `true`.
 - `anonymous_group_search` (bool, optional) - Use anonymous binds when performing LDAP group searches. Defaults to `false`.
 
 @include 'ldap-auth-userfilter-warning.mdx'

content/vault/v1.14.x/content/api-docs/auth/ldap.mdx

@@ -65,8 +65,12 @@ This endpoint configures the LDAP auth method.
   username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `discoverdn` `(bool: false)` – Use anonymous bind to discover the bind DN of a
   user.
-- `deny_null_bind` `(bool: true)` – This option prevents users from bypassing
-  authentication when providing an empty password.
+- `deny_null_bind` `(bool: true)` – By default, Vault prevents LDAP authentication 
+  attempts when the user provides an empty password (null binds). Setting
+  `deny_null_bind` to `false` tells Vault to defer the handling of empty-password
+  authentication attempts to the LDAP server. You may want to allow LDAP
+  anonymous bind operations for directory configurations using anonymous search
+  or discovery.
 - `upndomain` `(string: "")` – The userPrincipalDomain used to construct the UPN
   string for the authenticating user. The constructed UPN will appear as
   `[username]@UPNDomain`. Example: `example.com`, which will cause vault to bind

content/vault/v1.14.x/content/docs/auth/ldap.mdx

@@ -128,7 +128,7 @@ There are two alternate methods of resolving the user object used to authenticat
 - `userdn` (string, optional) - Base DN under which to perform user search. Example: `ou=Users,dc=example,dc=com`
 - `userattr` (string, optional) - Attribute on user attribute object matching the username passed when authenticating. Examples: `sAMAccountName`, `cn`, `uid`
 - `userfilter` (string, optional) - Go template used to construct a ldap user search filter. The template can access the following context variables: \[`UserAttr`, `Username`\]. The default userfilter is `({{.UserAttr}}={{.Username}})` or `(userPrincipalName={{.Username}}@UPNDomain)` if the `upndomain` parameter is set. The user search filter can be used to restrict what user can attempt to log in. For example, to limit login to users that are not contractors, you could write `(&(objectClass=user)({{.UserAttr}}={{.Username}})(!(employeeType=Contractor)))`.
-- `deny_null_bind` (bool, optional) - This option prevents users from bypassing authentication when providing an empty password. The default is `true`.
+- `deny_null_bind` (bool, optional) - By default, Vault prevents LDAP authentication attempts when the user provides an empty password (null binds). Setting `deny_null_bind` to `false` tells Vault to defer the handling of empty-password authentication attempts to the LDAP server. You may want to allow LDAP anonymous bind operations for directory configurations using anonymous search or discovery. The default is `true`.
 - `anonymous_group_search` (bool, optional) - Use anonymous binds when performing LDAP group searches. Defaults to `false`.
 
 @include 'ldap-auth-userfilter-warning.mdx'