You may be getting hit by ITS#4744 (fixed in 2.4.30 and you provider is older) http://www.openldap.org/its/index.cgi/Archive.Software%20Bugs?id=4744;select... but will take a closer look at your config.
Ive rebuilt OpenLDAP on provider to 2.4.31 but it's still happening. I've rebuilt twice - first with SASL, then without and it makes no difference either.
This is driving me crazy bannanas now. Anything in my config that's wrong?
What's the cause of "Strong(er) authentication required" error?
If I do ldapmodify -x -D ".." -h "provider.hostname" -W -f "modfile.ldif" it works fine. It's only when slapo-chain handles the referrals.
Cheers