Cisco :: WLC 4400 - Web Authentication Using LDAP

I have some problems integrating WLC 4400 with AD using ldap. The the WLC LDAP Server and W LAN for Web Authentication are configured according to [URL].
 
when I connect to SSID the laptop is given the ip address, then I can see the web-page with lo gin and password - it seems to be OK, but when I enter lo gin and pass it tells me, that it's incorrect.  
 
The attributes of the LDAP server:
 
Server Address                              *.*.*.*
Port Number                                 389        
User Base DN                                ou=ORG,dc=domain,dc=local
User Attribute                              userPrincipalName         
User Object Type                            Person
 
the test user is located in AD folder ORG, but this folder also contains a lot of sub trees
 
There are some questions:

1) Is it obligatory to use value "Authenticated" in the Simple Bind option or it can be Anonymous?
2) Is the Controller capable for searching the users located in User Base DN sub trees?
  
Here is some debug from the controller:
 
667: LDAP_CLIENT: UID Search (base=.....
669: LDAP_CLIENT: ldap_search_ext_s returns 0 85
669: LDAP_CLIENT: Returned 1 msgs including 0 references
[Code]....