There is no way to disable LDAP

[bschonec]

In the following code:
# construct the command
$ldap_flags = $ldap ? {
true => "${ldap_flg} ${ldapauth_flg} ${ldaptls_flg} ${ldapbasedn_val} ${ldaploadcacert_val} ${ldapserver_val}",
default => '',
}

The "turn off" arguments ( --disableldap and --disableldapauth) never get set because unless you have $ldap_flags = true, the --disableldap flag will never get added to $ldap_flags. I think the logic should be taken out completely and just set:

$ldap_flags = "${ldap_flg} ${ldapauth_flg} ${ldaptls_flg} ${ldapbasedn_val} ${ldaploadcacert_val} ${ldapserver_val}"