Quoting Francesco Malvezzi <francesco.malvezzi(a)unimore.it>:
I'm pretty sure it's similar to my current configuration
which has the
serious drawback that it turns cn=config in a shadow referral so I can't
update cn=config any longer.
I don't know, I'm going to test it as soon as I get a new server
installed a few hours from now.
Upon first glance, it seemed to me that it would do what you want.