https://bugs.openldap.org/show_bug.cgi?id=10023
--- Comment #4 from Howard Chu hyc@openldap.org --- (In reply to ipuleston@sonicwall.com from comment #1)
To make it properly asynchronous, what should be happening on a -2 return code is that control is returned to the caller of ldap_sasl_bind() etc. with return code LDAP_X_CONNECTING. That caller should then use poll or select to wait for the connect to complete, and then in the case of TLS it would need to make the call to start that (via ldap_int_tls_start).
Note that ldap_int_* functions are for internal use only, not for users to invoke.