diff --git a/pkg/cli/server/root.go b/pkg/cli/server/root.go
index e61a8962cf..2ce6fa69c1 100644
--- a/pkg/cli/server/root.go
+++ b/pkg/cli/server/root.go
@@ -863,7 +863,7 @@ func readLDAPCredentials(ldapConfigPath string) (config.LDAPCredentials, error)
 	var ldapCredentials config.LDAPCredentials
 
 	metaData := &mapstructure.Metadata{}
-	if err := viperInstance.UnmarshalExact(&ldapCredentials, metadataConfig(metaData)); err != nil {
+	if err := viperInstance.Unmarshal(&ldapCredentials, metadataConfig(metaData)); err != nil {
 		log.Error().Err(err).Msg("failed to unmarshal ldap credentials config")
 
 		return config.LDAPCredentials{}, errors.Join(zerr.ErrBadConfig, err)
diff --git a/pkg/cli/server/root_test.go b/pkg/cli/server/root_test.go
index 49e62c3f18..38c08c3c41 100644
--- a/pkg/cli/server/root_test.go
+++ b/pkg/cli/server/root_test.go
@@ -1159,7 +1159,7 @@ storage:
 		content := []byte(`{"distSpecVersion":"1.1.0","storage":{"rootDirectory":"/tmp/zot"},
 							"http":{"address":"127.0.0.1","port":"8080","realm":"zot",
 							"auth":{"openid":{"providers":{"oidc":{"issuer":"http://127.0.0.1:5556/dex",
-						    "clientid":"client_id","scopes":["openid"]}}}}},
+							"clientid":"client_id","scopes":["openid"]}}}}},
 							"log":{"level":"debug"}}`)
 		_, err = tmpfile.Write(content)
 		So(err, ShouldBeNil)
@@ -1247,8 +1247,8 @@ storage:
 		defer os.Remove(tmpCredsFile.Name())
 
 		content := []byte(`{
-    		"bindDN":"cn=ldap-searcher,ou=Users,dc=example,dc=org",
-    		"bindPassword":"ldap-searcher-password"
+			"bindDN":"cn=ldap-searcher,ou=Users,dc=example,dc=org",
+			"bindPassword":"ldap-searcher-password"
 		}`)
 
 		_, err = tmpCredsFile.Write(content)
@@ -1286,7 +1286,7 @@ storage:
 
 		// `bindDN` key is missing
 		content := []byte(`{
-    		"bindPassword":"ldap-searcher-password"
+			"bindPassword":"ldap-searcher-password"
 		}`)
 
 		_, err = tmpCredsFile.Write(content)
@@ -1323,10 +1323,9 @@ storage:
 		So(err, ShouldBeNil)
 		defer os.Remove(tmpCredsFile.Name())
 
-		// `bindDN` key is missing
 		content := []byte(`{
-    		"bindDN":"cn=ldap-searcher,ou=Users,dc=example,dc=org",
-    		"bindPassword":"ldap-searcher-password",
+			"bindDN":"cn=ldap-searcher,ou=Users,dc=example,dc=org",
+			"bindPassword":"ldap-searcher-password",
 			"extraKey": "extraValue"
 		}`)
 
@@ -1355,7 +1354,7 @@ storage:
 		So(err.Error(), ShouldContainSubstring, "invalid server config")
 	})
 
-	Convey("Test verify bad ldap config: no keys set", t, func(c C) {
+	Convey("Test verify bad ldap config: empty credentials file", t, func(c C) {
 		tmpFile, err := os.CreateTemp("", "zot-test*.json")
 		So(err, ShouldBeNil)
 		defer os.Remove(tmpFile.Name())
@@ -1391,6 +1390,43 @@ storage:
 		So(err, ShouldNotBeNil)
 		So(err.Error(), ShouldContainSubstring, "invalid server config")
 	})
+
+	Convey("Test verify bad ldap config: no keys set in credentials file", t, func(c C) {
+		tmpFile, err := os.CreateTemp("", "zot-test*.json")
+		So(err, ShouldBeNil)
+		defer os.Remove(tmpFile.Name())
+
+		tmpCredsFile, err := os.CreateTemp("", "zot-cred*.json")
+		So(err, ShouldBeNil)
+		defer os.Remove(tmpCredsFile.Name())
+
+		// empty json
+		content := []byte(`{}`)
+
+		_, err = tmpCredsFile.Write(content)
+		So(err, ShouldBeNil)
+		err = tmpCredsFile.Close()
+		So(err, ShouldBeNil)
+
+		content = []byte(fmt.Sprintf(`{ "distSpecVersion": "1.1.0-dev", 
+			"storage": { "rootDirectory": "/tmp/zot" }, "http": { "address": "127.0.0.1", "port": "8080", 
+			"auth": { "ldap": { "credentialsFile": "%v", "address": "ldap.example.org", "port": 389, 
+			"startTLS": false, "baseDN": "ou=Users,dc=example,dc=org", 
+			"userAttribute": "uid", "userGroupAttribute": "memberOf", "skipVerify": true, "subtreeSearch": true }, 
+			"failDelay": 5 } }, "log": { "level": "debug" } }`,
+			tmpCredsFile.Name()),
+		)
+
+		_, err = tmpFile.Write(content)
+		So(err, ShouldBeNil)
+		err = tmpFile.Close()
+		So(err, ShouldBeNil)
+
+		os.Args = []string{"cli_test", "verify", tmpFile.Name()}
+		err = cli.NewServerRootCmd().Execute()
+		So(err, ShouldNotBeNil)
+		So(err.Error(), ShouldContainSubstring, "invalid server config")
+	})
 }
 
 func TestApiKeyConfig(t *testing.T) {
@@ -1403,7 +1439,7 @@ func TestApiKeyConfig(t *testing.T) {
 		content := []byte(`{"distSpecVersion":"1.1.0","storage":{"rootDirectory":"/tmp/zot"},
 							"http":{"address":"127.0.0.1","port":"8080","realm":"zot",
 							"auth":{"openid":{"providers":{"oidc":{"issuer":"http://127.0.0.1:5556/dex",
-						    "clientid":"client_id","scopes":["openid"]}}}}},
+							"clientid":"client_id","scopes":["openid"]}}}}},
 							"log":{"level":"debug"}}`)
 
 		err = os.WriteFile(tmpfile.Name(), content, 0o0600)