diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000000000000000000000000000000000000..1f15b6351e6e3bf795f6f32395fa05e6d486def7
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,3 @@
+# v0.3.3
+
+* config: ldap.encryption gained an option "plain" for disabling encryption
diff --git a/src/DependencyInjection/Configuration.php b/src/DependencyInjection/Configuration.php
index b5f98889776176161e1518a11dc3fcd232477bca..24e185fa541c244b517c67bacb5743a47312c21a 100644
--- a/src/DependencyInjection/Configuration.php
+++ b/src/DependencyInjection/Configuration.php
@@ -25,8 +25,8 @@ class Configuration implements ConfigurationInterface
             ->scalarNode('username')->end()
             ->scalarNode('password')->end()
             ->enumNode('encryption')
-                ->info('simple_tls uses port 636 and is sometimes referred to as "SSL", start_tls uses port 389 and is sometimes referred to as "TLS"')
-                ->values(['start_tls', 'simple_tls'])
+                ->info('simple_tls uses port 636 and is sometimes referred to as "SSL", start_tls uses port 389 and is sometimes referred to as "TLS", plain means none')
+                ->values(['start_tls', 'simple_tls', 'plain'])
                 ->defaultValue('start_tls')
             ->end()
             ->end();
diff --git a/src/Service/LDAPApi.php b/src/Service/LDAPApi.php
index e6faeb83d3538e15426a7bd1c36cf9dbf91f7487..b7dcef52ce7ee22769eb6d9ffa9c3289949f1067 100644
--- a/src/Service/LDAPApi.php
+++ b/src/Service/LDAPApi.php
@@ -96,10 +96,10 @@ class LDAPApi implements LoggerAwareInterface, ServiceSubscriberInterface
         ];
 
         $encryption = $config['ldap']['encryption'];
-        assert(in_array($encryption, ['start_tls', 'simple_tls'], true));
+        assert(in_array($encryption, ['start_tls', 'simple_tls', 'plain'], true));
         $this->providerConfig['use_tls'] = ($encryption === 'start_tls');
         $this->providerConfig['use_ssl'] = ($encryption === 'simple_tls');
-        $this->providerConfig['port'] = ($encryption === 'start_tls') ? 389 : 636;
+        $this->providerConfig['port'] = ($encryption === 'start_tls' || $encryption === 'plain') ? 389 : 636;
     }
 
     public function checkConnection()