to be a bit more specific, what i am not seeing is another bind request
to AD that looks like this:

-----------
Lightweight Directory Access Protocol
LDAP Message, Bind Request
Message Id: 1
Message Type: Bind Request (0x00)
Version: 3
DN: CN=Lastname\,
Firstname,OU=Users-BLAH-BLAH,OU=BLAH2,DC=XYZ,DC=ABC,DC=com
Auth Type: Simple (0x00)
Password: user's password that i provided in the browser
-----------

....followed by a successful response from AD.

it seems that the initial response to a search query that it got back
from AD is unsatisfactory, so it does not even try to bind with the
newly found name. any ideas why this is happening?

i even tried some other products (not apache) where AD auth works, and
their network capture looks just like apache's, except they also do the
second bind.

any pointers/suggestions are appreciated.

thank you.