If your LDAP server doesn't support anonymous binding (IOW, if your LDAP server doesn't even allow a query without authentication), then Hudson would have to first authenticate itself against the LDAP server, and Hudson does that by sending "manager" DN and password.

A DN typically looks like `CN=MyUser,CN=Users,DC=mydomain,DC=com` although the exact sequence of tokens depends on the LDAP server configuration. It can be any valid DN as long as LDAP allows this user to query data.

This configuration is also useful when you are connecting to Active Directory from a Unix machine, as AD doesn't allow anonymous bind by default. But if you can't figure this out, you can also change AD setting to allow anonymous bind. See this document for how to.