Account specifically for LDAP binds?

Guest

First of all, I'm a Unix admin and know little of AD and how it is set
up. That said ... :-)

We are attempting to do LDAP authentication via OpenLDAP. We're not
authenticating based on a successful bind or not, but instead assuming
the bind succeeds and the user we bind with is then able to search for
the given user's sAMAccountName and decide whether or not to grant
access to them.

Pretty standard Apache mod_ldap fare.

The problem arises in that we obviously have to have a domain account
that we can bind to AD with and do searches. We created a special
account "Anon Bind" just for this purpose. However, unless this
account is granted permission to login to the domain controllers, it
doesn't appear to accept an LDAP bind. As soon as we "lock" these
accounts down the binds all fail. But we'd prefer that this account
not be given permission to log into any machine at all, only to LDAP
bind and search for sAMAccountName and a few other fields.

Is what I'm asking for possible? How would you go about creating an
AD account specifically for the purpose of allowing what we are doing?

TIA!
Ray