Authentication

Is TLS_REQCERT always a valid setting? On my system the manpage says TLS_REQCERT can be never, allow, try, or demand (or hard). I always set this to allow because the certificate that AD uses won't be signed by public CA.

LDAP with StartTLS is not the same as LDAPS. They both add security but as I understand it LDAPS is deprecated in favour of StartTLS. One key difference is that LDAPS uses port 636, whereas StartTLS uses the standard LDAP port.

Moodle uses PHP's LDAP extension, and this uses the server's OpenLDAP installation. So using ldapsearch is a good test of whether OpenLDAP is able to connect. The next thing I normally do is write a small PHP script to see if that can connect to the LDAP server. ldap_test.php is such a script, you can use the settings from Moodle by adding these to the define()s in lines 44 to 49, for example:

define('HOST_URL', 'szgdc3.biz.dom'); 
define('BIND_DN', 'user@szgdc3.biz.dom'); 
define('BIND_PW', 'password'); 
define('CONTEXTS', 'cn=Users,dc=szgdc3,dc=biz,dc=dom'); 
define('FILTERS', '(objectClass=user)'); 
define('ATTRIBUTES', 'sAMAccountName, givenName, sn, mail');

You may just get the same error but maybe it may help determine why Moodle is failing to connect. If the PHP script won't connect then Moodle won't be able to either.