diff --git a/apache/files/_auth.conf b/apache/files/_auth.conf
index d6c1e83..d64de96 100644
--- a/apache/files/_auth.conf
+++ b/apache/files/_auth.conf
@@ -29,7 +29,7 @@
 
 {%- if site.auth.ldap is defined %}
 
-{%- if site.auth.ldap.get("mech", "GSSAPI") %}
+{%- if site.auth.ldap.get("mech", "basic") == "GSSAPI" %}
   # Not supported without patching, see:
   # https://bz.apache.org/bugzilla/show_bug.cgi?id=55178
   AuthLDAPBindSASLMech {{ site.auth.ldap.get("mech", "GSSAPI") }}