--- a/hgext/reviewboard/tests/test-ldap-association.t
+++ b/hgext/reviewboard/tests/test-ldap-association.t
@@ -316,24 +316,40 @@ Update Bugzilla address and reassociate
 
 Create two users with the same Bugzilla address
 
   $ mozreview create-user user6@example.com user6password 'User Six [:user6]' --uid 2005 --scm-level 1 --bugzilla-email conflict@example.com
   Created user 11
   $ mozreview create-user conflict@example.com conflictpassword 'Conflict [:conflict]' --uid 2006 --scm-level 1
   Created user 12
 
-Dump the users so they are mirrored over to Review Board
+Dump the users so they are mirrored over to Review Board, then delete the
+associations this created.
 
   $ rbmanage dump-user user6 > /dev/null
+  $ rbmanage associate-ldap-user user6 none > /dev/null
   $ rbmanage dump-user conflict > /dev/null
+  $ rbmanage associate-ldap-user conflict none > /dev/null
 
 Trigger automatic association and check the logs
 
   $ rbmanage associate-employee-ldap --email conflict@example.com
   LDAP association failed.
   $ mozreview exec rbweb grep -i ldap /reviewboard/logs/reviewboard.log | tail -n 1
   ????-??-?? ??:??:??,??? - INFO -  - Could not update ldap association: More than one match for conflict@example.com (glob)
 
+Ensure automatic association doesn't overwrite existing valid associations.
+
+  $ mozreview create-user user7@example.com user7password 'User Seven [:user7]'
+  Created user 13
+  $ mozreview create-ldap-user uSeven@example.org uSeven 2007 'User Seven' --scm-level 1
+  $ rbmanage dump-user user7 > /dev/null
+  $ rbmanage associate-ldap-user user7 uSeven@example.org
+  uSeven@example.org associated with user7
+  $ rbmanage associate-employee-ldap --email user7@example.com
+  user7@example.com already associated with uSeven@example.org
+  $ mozreview exec rbweb grep -i ldap /reviewboard/logs/reviewboard.log | tail -n 1
+  ????-??-?? ??:??:??,??? - INFO -  - Associating user: user7@example.com already associated with ldap_username: uSeven@example.org (glob)
+
 Cleanup
 
   $ mozreview stop
   stopped 9 containers

--- a/testing/vcttesting/reviewboard/mach_commands.py
+++ b/testing/vcttesting/reviewboard/mach_commands.py
@@ -608,19 +608,20 @@ class ReviewBoardCommands(object):
         user = ext.get_ldap_associations().get_item(username).ldap_username
 
         if user:
             print('ldap username: %s' % user)
         else:
             print('no ldap username associated with %s' % username)
 
     @Command('associate-ldap-user', category='reviewboard',
-        description='Associate an LDAP email address with a user.')
+             description='Associate an LDAP email address with a user.')
     @CommandArgument('username', help='Username to associate with ldap')
-    @CommandArgument('email', help='LDAP email to associate')
+    @CommandArgument('email',
+                     help='LDAP email to associate, or "none" to clear')
     @CommandArgument('--request-username',
                      default='mozreview',
                      help='Username to make request with')
     @CommandArgument('--request-password',
                      default='mrpassword',
                      help='Password to make request with')
     @CommandArgument('--anonymous',
                      action='store_true',
@@ -633,25 +634,31 @@ class ReviewBoardCommands(object):
         # We use the "mozreview" account by default which has the special
         # permission to read / associate ldap email addresses.
         root = self._get_root(username=request_username,
                               password=request_password,
                               anonymous=anonymous)
         ext = root.get_extension(
             extension_name='mozreview.extension.MozReviewExtension')
 
+        if email == "none":
+            email = None
+
         try:
             association = ext.get_ldap_associations().get_item(username)
             association.update(ldap_username=email)
         except APIError as e:
             print('API Error: %s: %s: %s' % (e.http_status, e.error_code,
-                e.rsp['err']['msg']))
+                  e.rsp['err']['msg']))
             return 1
 
-        print('%s associated with %s' % (email, username))
+        if email is None:
+            print('association for %s cleared' % email)
+        else:
+            print('%s associated with %s' % (email, username))
 
     @Command('associate-employee-ldap', category='reviewboard',
              description='Associate LDAP for Mozilla employees.')
     @CommandArgument('--request-username',
                      default='mozreview',
                      help='Username to make request with')
     @CommandArgument('--request-password',
                      default='mrpassword',