anchor.diff:  check_auth_bucket(Req, Auth, BucketTuple, ReadOnlyOk) ->
       RV = case ReadOnlyOk of
                true ->
  -                 check_read_only_auth(Req, Auth);
  +                 check_read_only_auth_no_ldap(Req, Auth);
                false ->
  -                 check_admin_auth(Req, Auth)
  +                 check_admin_auth_no_ldap(Req, Auth)
            end,
       case RV of
           {true, _NewReq} ->
               RV;
           false ->
  -            F = bucket_auth_fun(Auth, ReadOnlyOk),
  +            F = bucket_auth_fun(Auth),
               case F(BucketTuple) of
                   true ->
                       {true, store_bucket_auth(Req, Auth)};
                   false ->
  -                    false
  +                    AllowedRoles = case ReadOnlyOk of
  +                                       true ->
  +                                           [ro_admin, admin];
  +                                       false ->
  +                                           [admin]
  +                                   end,
  +                    check_ldap(Req, Auth, AllowedRoles)
               end
       end.
   
  -check_auth(Auth) ->
  -    case check_admin_auth_int(Auth) of
  -        {true, _User, _Source, _Token} ->
  -            true;
  -        false ->
  -            false
  -    end.
  -
   check_admin_auth(Req, Auth) ->
  +    case check_admin_auth_no_ldap(Req, Auth) of
  +        false ->
  +            check_ldap(Req, Auth, [admin]);
  +        RV ->
  +            RV
  +    end.
  +
  +check_admin_auth_no_ldap(Req, Auth) ->
       case check_admin_auth_int(Auth) of
           {true, User, Source, Token} ->
               {true, store_user_info(Req, User, admin, Source, Token)};
  
positive.code:         "ro_admin" ->
              BucketsAll;
          _ ->
              F = bucket_auth_fun(UserPassword, true),
              [Bucket || Bucket <- BucketsAll, F(Bucket)]
      end.
  
  
negative.code: %%
  %% NOTE: that no-auth buckets are always accessible even without
  %% password at all
  bucket_auth_fun(Auth) ->
      fun ({BucketName, BucketProps}) ->
              case {proplists:get_value(auth_type, BucketProps),
                    proplists:get_value(sasl_password, BucketProps),
                    Auth} of
                  {none, _, undefined} ->
                      true;
                  {none, _, {BucketName, ""}} ->
                      true;
                  {sasl, "", undefined} ->
                      true;
                  {sasl, BucketPassword, {BucketName, BucketPassword}} ->
                      true;
                  _ ->
                      false
              end
      end.
  
  is_under_role(Req, Role) when is_atom(Role) ->
      get_role(Req) =:= atom_to_list(Role).
  
  check_ldap(Req, Auth, AllowedRoles) ->
      case check_ldap_int(Auth, AllowedRoles) of
          {true, User, Role} ->
              {true, store_user_info(Req, User, Role, saslauthd, undefined)};
          false ->
              false
      end.
  
  check_ldap_int({token, _Token}, _) ->
      false;
  check_ldap_int({User, Password}, AllowedRoles) ->
      Role = saslauthd_auth:check(User, Password),
      case lists:member(Role, AllowedRoles) of
          true ->
              {true, User, Role};
          false ->
              false
      end;
  check_ldap_int(undefined, _) ->
      false.
  
  verify_login_creds(User, Password) ->
      case ns_config_auth:authenticate(admin, User, Password) of
  