Looks to me like the mentioned features have been implemented and this ITS should be closed. OK?

Yes, everything seems to be implemented. Note that chained operations only work for a single hop, since back-ldap does not allow to add proxied authz control when already set. Thanks, p.