Maybe I'm understanding the requirements incorrectly, but what's wrong
I agree with Dieter that I don't see how the referenced ITS applies.
For one project, I used:
suffix "ou=Local Users,dc=rutgers,dc=edu"
in production for a couple years. It didn't work until 2.3.27 or so, when
enhancements to back-ldap/meta made it possible. "Local Users" is
politically guaranteed to be disjoint in this case. IIRC duplicates will
indeed show up twice, with the local entry first.
I also recall the glue syntax changes of the 2.3.3-era. There were
concerns over the amount of rope available there; make sure to keep those
discussions in mind...