Hello,

...

Hi. I don't have time to work at this right now, but I think the solution would be to modify slapo-chain(5) so that when a referral's DN is "" and the DN in the original request is not "", to use that DN instead. The original request DN can be found in op->o_req_dn.

we tested the following - with success:

Just replace in servers/slapd/back-ldap/chain.c, function ldap_chain_op(), line 485-486:

op->o_req_dn = pdn;
op->o_req_ndn = ndn;

With:

    if (pdn.bv_len > 0) {
        op->o_req_dn = pdn;
    }
    if (ndn.bv_len > 0) {
        op->o_req_ndn = ndn;
    }

It would be great if this came into the official code.

This issue was fixed consistently in HEAD code more than a month ago, please test it and report, so in case it works the ITS can be closed and the fix released.

Thanks, p.