### Question:
QueryLdapClient implements LdapClient { @Override public String authenticate(final Auth auth) { try{ final LdapConfig config = new LdapConfig(url, adminDn, adminPassword); final DirContext context = new InitialDirContext(config); List<String> usersDns = findAllUsersThatMatchQuery(context, auth); for(String userDn : usersDns) if(tryAuthenticate(context, userDn, auth.getPassword())) return auth.getUserName(); }catch(NamingException e){ throw new RuntimeException(e); } throw new NotAuthorizedException(); } QueryLdapClient(String query, String queryDn, String url, String bindDn, char[] password); @Override String authenticate(final Auth auth);  }### Answer:
@Test public void when_query_returns_one_result_and_this_result_is_bounded_to_context_then_authenticate() throws LdapException{ addUser(USER_NAME, USER_PASSWORD, ""); client = client(QUERY, "dc=example,dc=com"); client.authenticate(new Auth(USER_NAME, USER_PASSWORD.toCharArray())); }
@Test(expected = WebApplicationException.class) public void when_query_returns_result_but_password_is_wrong_then_throw_WAE() throws LdapException{ addUser(USER_NAME, USER_PASSWORD, ""); client = client(QUERY, "ou=system"); client.authenticate(new Auth(USER_NAME, "wrongPassword".toCharArray())); }
@Test public void when_there_exist_multiple_results_for_query_and_password_is_correct_only_for_the_last_result_then_still_authenticate() throws LdapException{ String user2Password = "user2Password"; String email = "test@test.com"; addUser(USER_NAME, USER_PASSWORD, email); addUser("testUser2", user2Password, email); client = client(QUERY, "dc=example,dc=com"); client.authenticate(new Auth("test@test.com", user2Password.toCharArray())); }