If you use the "new" LDAP authenticator
(com.xpn.xwiki.user.impl.LDAP.XWikiLDAPAuthServiceImpl since 1.3M2,
see
http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Authentication),
"userPassword" is olny used when you set
xwiki.authentication.ldap.validate_password to 1. Otherwise it tries a
simple bind to validate the found LDAP user in case
xwiki.authentication.ldap.bind_DN and
xwiki.authentication.ldap.bind_pass are not configured to directly use
provided user/pass to connect to LDAP server.