What part of the password recovery flow errors out? What groups is your ldap bind user in?