diff --git a/src/ldap.c b/src/ldap.c
index c318489cb..4c269d6d1 100644
--- a/src/ldap.c
+++ b/src/ldap.c
@@ -371,13 +371,9 @@ void ceo_ldap_init() {
     if (ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION, &proto) != LDAP_OPT_SUCCESS)
         ldap_fatal("ldap_set_option");
 
-    ceo_krb5_auth(admin_bind_userid);
-
     if (ldap_sasl_interactive_bind_s(ld, NULL, sasl_mech, NULL, NULL,
                 LDAP_SASL_QUIET, &ldap_sasl_interact, NULL) != LDAP_SUCCESS)
         ldap_fatal("Bind failed");
-
-    ceo_krb5_deauth();
 }
 
 void ceo_ldap_cleanup() {
diff --git a/src/op-adduser.c b/src/op-adduser.c
index 0d545083d..c75f8bb0f 100644
--- a/src/op-adduser.c
+++ b/src/op-adduser.c
@@ -270,6 +270,7 @@ int main(int argc, char *argv[]) {
         fatalpe("setenv");
 
     ceo_krb5_init();
+    ceo_krb5_auth(admin_bind_userid);
     ceo_ldap_init();
     ceo_kadm_init();
 
@@ -277,6 +278,7 @@ int main(int argc, char *argv[]) {
 
     ceo_kadm_cleanup();
     ceo_ldap_cleanup();
+    ceo_krb5_deauth();
     ceo_krb5_cleanup();
 
     free_config();