diff --git a/builtin/credential/ldap/cli.go b/builtin/credential/ldap/cli.go
index <HASH>..<HASH> 100644
--- a/builtin/credential/ldap/cli.go
+++ b/builtin/credential/ldap/cli.go
@@ -79,10 +79,10 @@ which MFA backend is in use, read "auth/[mount]/mfa_config".
 }
 
 func usernameFromEnv() string {
-	if logname, ok := os.LookupEnv("LOGNAME"); ok {
+	if logname := os.Getenv("LOGNAME"); logname != "" {
 		return logname
 	}
-	if user, ok := os.LookupEnv("USER"); ok {
+	if user := os.Getenv("USER"); user != "" {
 		return user
 	}
 	return ""
Use Getenv instead of LookupEnv

This prevents returning empty username if LOGNAME is set but empty and USER is set but not empty.