I've been able to reproduce the issue, and I think it's solved (back-ldap/search.c 1.235 -> 1.236); however I'm afraid I didn't understand all the details of your configuration, so I might have tested something different.

The bug was in ldap_back_entry_get() setting up a connection based on the o_tag field, which is that of the current operation (a bind, in your case). I fixed it by always re-setting the tag to LDAP_REQ_SEARCH, under the assumption that ldap_back_entry_get() doesn't need to know what operation required the entry to be looked up.

Please test and report; in case of further issues, I might need the full slapd.conf of the proxy (unless the above is all, of course...)

Thanks; this seems to fix the issue, at least in my test cases.

Matthew Backes Symas Corporation mbackes@symas.com