LDN - Luminis Developer Network

authentication from custom code has a few steps

1.  You bind as the directory manager.
2.  The directory manager takes the typed in username and queries the ldap for the user's DN.
3.  You perform another ldap query, this time, binding as the user DN and the user typed password.
4.  You catch any errors, or otherwise determine if the bind attempt was successful.  
5.  You set a cookie, session variable, or some means of knowing that the user is logged in.

This is some CFML with a login form, that posts to itself, and sets a session variable if the user logs in successfully.

 edit:  I noticed that this was my script for an application that was to allow only employees to login, so if you want to use it to authenticate all roles, change the filter section.

filter = "(&(objectclass=*)(pdsRole=*employee*)(pdsLoginId=#pdsLoginId#))";