LDAP users should not be subject to password guess limits or email verification (#3245)

api/authentication.go

@@ -56,9 +56,12 @@ func checkLdapUserPasswordAndAllCriteria(ldapId *string, password string, mfaTok
 		user = ldapUser
 	}
 
-	if err := checkUserAdditionalAuthenticationCriteria(user, mfaToken); err != nil {
+	if err := checkUserMfa(user, mfaToken); err != nil {
-		err.StatusCode = http.StatusUnauthorized
+		return nil, err
-		return user, err
+	}
+
+	if err := checkUserNotDisabled(user); err != nil {
+		return nil, err
 	}
 
 	// user successfully authenticated