I am having exact same problem today, without a "ou=", AuthLDAPURL will return a 500 error.
Finally found a url: http://clabs.org/blog/RawStuff
It mentioned: "
If you need to authenticate against different OUs, then there are two options. Ideally, simply changing the ldap url to work from the root should work:
However, against Active Directory this doesn't seem to work, because in addition to the search results, it will also return referrals to other directory partitions, and Apache can't grok these or somesuch. A bug has been filed for this, and the report includes a patch.
But, if your Active Directory has a Global Directory configured, typically on port 3268, then you might be able to get the query you need to work:
I checked our AD server and it's listening on port 3268, so I changed it, it did fix the problem.