diff --git a/java/com/google/gerrit/server/auth/ldap/Helper.java b/java/com/google/gerrit/server/auth/ldap/Helper.java
index bafee04648..c560915d29 100644
--- a/java/com/google/gerrit/server/auth/ldap/Helper.java
+++ b/java/com/google/gerrit/server/auth/ldap/Helper.java
@@ -167,13 +167,15 @@ class Helper {
 
   DirContext open() throws IOException, NamingException, LoginException {
     final Properties env = createContextProperties();
-    env.put(Context.SECURITY_AUTHENTICATION, authentication);
+    env.put(Context.SECURITY_AUTHENTICATION, "none");
     env.put(Context.REFERRAL, referral);
     if ("GSSAPI".equals(authentication)) {
+      env.put(Context.SECURITY_AUTHENTICATION, authentication);
       return kerberosOpen(env);
     }
 
     if (!supportAnonymous && username != null) {
+      env.put(Context.SECURITY_AUTHENTICATION, authentication);
       env.put(Context.SECURITY_PRINCIPAL, username);
       env.put(Context.SECURITY_CREDENTIALS, password);
     }
@@ -181,6 +183,7 @@ class Helper {
     LdapContext ctx = createContext(env);
 
     if (supportAnonymous && username != null) {
+      ctx.addToEnvironment(Context.SECURITY_AUTHENTICATION, authentication);
       ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, username);
       ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, password);
       ctx.reconnect(null);