I have to use slapd-ldap in "strong bind" mode which means that user binds using its own credentials and no identity assertion is performed. If slapd-ldap is the only module that is processing request then everything works fine. If slapd-ldap is processing an request forwarded from slapd-relay (with slapo-rwm) or request to database with slapo-translucent then the authentication problem occurs.

The solution was a little less intrusive than the one you proposed, but your analysis was just fine and definitely effective in pointing me to the core of the issue. It should now be fixed in HEAD, please test.

servers/slapd/back-ldap/bind.c new revision: 1.255; previous revision: 1.254

Thanks, p.