ando@sys-net.it writes:

Proxy backends use ldap_set_option(3) to set alias dereferencing when requested by a search operation (and do not clean it up afterwards, as far as I can tell). Since LDAP handlers are pooled and reused, this behavior is inherently broken.

I note you committed this with an ldap_int_* interface. But it could be useful outside OpenLDAP code too.

Seems to me this is what client-side controls are for. Extending the client-side functionality without needing a new API.