Hello,

Hi. I don't have time to work at this right now, but I think the solution would be to modify slapo-chain(5) so that when a referral's DN is "" and the DN in the original request is not "", to use that DN instead. The original request DN can be found in op->o_req_dn.

we tested the following - with success:

Just replace in servers/slapd/back-ldap/chain.c, function ldap_chain_op(), line 485-486:

op->o_req_dn = pdn; op->o_req_ndn = ndn;

With:

if (pdn.bv_len > 0) { op->o_req_dn = pdn; } if (ndn.bv_len > 0) { op->o_req_ndn = ndn; }

It would be great if this came into the official code.

Regards, Jochen.