The native LDAP PLAIN SASL mechanism currently parses the authorization identity as the identity to use for the SASL session. We should use the authentication session instead, which is not an optional field. Some SASL stacks seem to leave the authorization field blank.