From: Pierangelo Masarati <ando@openldap.org>
Date: Sat, 7 Oct 2006 18:07:56 +0000 (+0000)
Subject: more on clarification of special proxy identities and resilience to connection failure
X-Git-Tag: OPENLDAP_REL_ENG_2_3_MP~74
X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=f8d1a618668499d9b0dbdb9e3cd24e2aa0bafa0f;p=openldap

more on clarification of special proxy identities and resilience to connection failure
---

diff --git a/servers/slapd/back-ldap/add.c b/servers/slapd/back-ldap/add.c
index 62a6ca8efc..9d6d0fc22c 100644
--- a/servers/slapd/back-ldap/add.c
+++ b/servers/slapd/back-ldap/add.c
@@ -38,7 +38,7 @@ ldap_back_add(
 {
 	ldapinfo_t		*li = (ldapinfo_t *)op->o_bd->be_private;
 
-	ldapconn_t		*lc;
+	ldapconn_t		*lc = NULL;
 	int			i = 0,
 				j = 0;
 	Attribute		*a;
@@ -54,8 +54,7 @@ ldap_back_add(
 	Debug( LDAP_DEBUG_ARGS, "==> ldap_back_add(\"%s\")\n",
 			op->o_req_dn.bv_val, 0, 0 );
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		lc = NULL;
 		goto cleanup;
 	}
diff --git a/servers/slapd/back-ldap/back-ldap.h b/servers/slapd/back-ldap/back-ldap.h
index 7f276242f3..3490e4a0ef 100644
--- a/servers/slapd/back-ldap/back-ldap.h
+++ b/servers/slapd/back-ldap/back-ldap.h
@@ -48,7 +48,9 @@ typedef struct ldapconn_t {
 	Connection		*lc_conn;
 #define	LDAP_BACK_PCONN		((void *)0x0)
 #define	LDAP_BACK_PCONN_TLS	((void *)0x1)
-#define	LDAP_BACK_PCONN_ID(c)	((void *)(c) > LDAP_BACK_PCONN_TLS ? (c)->c_connid : -1)
+#define LDAP_BACK_PCONN_PRIV	(-1)
+#define LDAP_BACK_PCONN_ISPRIV(lc)	((void *)(lc)->lc_conn <= LDAP_BACK_PCONN_TLS)
+#define	LDAP_BACK_PCONN_ID(lc)	(LDAP_BACK_PCONN_ISPRIV((lc)) ? LDAP_BACK_PCONN_PRIV : (lc)->lc_conn->c_connid )
 #ifdef HAVE_TLS
 #define	LDAP_BACK_PCONN_SET(op)	((op)->o_conn->c_is_tls ? LDAP_BACK_PCONN_TLS : LDAP_BACK_PCONN)
 #else /* ! HAVE_TLS */
@@ -310,7 +312,9 @@ typedef enum ldap_back_send_t {
 	LDAP_BACK_RETRY_DONTSEND	= (LDAP_BACK_RETRYING),
 	LDAP_BACK_RETRY_SOK		= (LDAP_BACK_RETRYING|LDAP_BACK_SENDOK),
 	LDAP_BACK_RETRY_SERR		= (LDAP_BACK_RETRYING|LDAP_BACK_SENDERR),
-	LDAP_BACK_RETRY_SRES		= (LDAP_BACK_RETRYING|LDAP_BACK_SENDRESULT)
+	LDAP_BACK_RETRY_SRES		= (LDAP_BACK_RETRYING|LDAP_BACK_SENDRESULT),
+
+	LDAP_BACK_GETCONN		= 0x10
 } ldap_back_send_t;
 
 /* define to use asynchronous StartTLS */
@@ -325,6 +329,10 @@ typedef enum ldap_back_send_t {
 		(tv)->tv_usec = LDAP_BACK_RESULT_UTIMEOUT; \
 	} while ( 0 )
 
+#ifndef LDAP_BACK_PRINT_CONNTREE
+#define LDAP_BACK_PRINT_CONNTREE 0
+#endif /* !LDAP_BACK_PRINT_CONNTREE */
+
 LDAP_END_DECL
 
 #include "proto-ldap.h"
diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index 213d36b392..92018cf823 100644
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -35,13 +35,9 @@
 
 #include "lutil_ldap.h"
 
-#ifndef PRINT_CONNTREE
-#define PRINT_CONNTREE 0
-#endif /* !PRINT_CONNTREE */
-
 #define LDAP_CONTROL_OBSOLETE_PROXY_AUTHZ	"2.16.840.1.113730.3.4.12"
 
-#if PRINT_CONNTREE > 0
+#if LDAP_BACK_PRINT_CONNTREE > 0
 static void
 ravl_print( Avlnode *root, int depth )
 {
@@ -68,13 +64,13 @@ ravl_print( Avlnode *root, int depth )
 	ravl_print( root->avl_left, depth+1 );
 }
 
-static void
-myprint( Avlnode *root, char *msg )
+void
+ldap_back_print_conntree( Avlnode *root, char *msg )
 {
 	fprintf( stderr, "========> %s\n", msg );
 	
 	if ( root == 0 ) {
-		fprintf( stderr, "\tNULL\n" );
+		fprintf( stderr, "\t(empty)\n" );
 
 	} else {
 		ravl_print( root, 0 );
@@ -82,13 +78,23 @@ myprint( Avlnode *root, char *msg )
 	
 	fprintf( stderr, "<======== %s\n", msg );
 }
-#endif /* PRINT_CONNTREE */
+#endif /* LDAP_BACK_PRINT_CONNTREE */
+
+static ldapconn_t *
+ldap_back_getconn( Operation *op, SlapReply *rs, ldap_back_send_t sendok,
+	struct berval *binddn, struct berval *bindcred );
 
 static int
-ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_send_t sendok );
+ldap_back_is_proxy_authz( Operation *op, SlapReply *rs, ldap_back_send_t sendok,
+	struct berval *binddn, struct berval *bindcred );
 
 static int
-ldap_back_prepare_conn( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok );
+ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs,
+	ldap_back_send_t sendok, struct berval *binddn, struct berval *bindcred );
+
+static int
+ldap_back_prepare_conn( ldapconn_t **lcp, Operation *op, SlapReply *rs,
+	ldap_back_send_t sendok );
 
 static int
 ldap_back_conndnlc_cmp( const void *c1, const void *c2 );
@@ -102,7 +108,7 @@ ldap_back_bind( Operation *op, SlapReply *rs )
 	int rc = 0;
 	ber_int_t msgid;
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_BIND_SERR );
+	lc = ldap_back_getconn( op, rs, LDAP_BACK_BIND_SERR, NULL, NULL );
 	if ( !lc ) {
 		return rs->sr_err;
 	}
@@ -169,6 +175,10 @@ retry_lock:;
 			goto retry_lock;
 		}
 
+#if LDAP_BACK_PRINT_CONNTREE > 0
+		ldap_back_print_conntree( li->li_conninfo.lai_tree, ">>> ldap_back_bind" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
+	
 		assert( lc->lc_refcnt == 1 );
 		tmplc = avl_delete( &li->li_conninfo.lai_tree, (caddr_t)lc,
 				ldap_back_conndnlc_cmp );
@@ -180,7 +190,7 @@ retry_lock:;
 			{
 				Debug( LDAP_DEBUG_TRACE,
 					"=>ldap_back_bind: destroying conn %ld (refcnt=%u)\n",
-					LDAP_BACK_PCONN_ID( lc->lc_conn ), lc->lc_refcnt, 0 );
+					LDAP_BACK_PCONN_ID( lc ), lc->lc_refcnt, 0 );
 
 				if ( tmplc->lc_refcnt != 0 ) {
 					/* taint it */
@@ -206,9 +216,9 @@ retry_lock:;
 				ldap_back_conndn_cmp, ldap_back_conndn_dup );
 		}
 
-#if PRINT_CONNTREE > 0
-		myprint( li->li_conninfo.lai_tree, "ldap_back_bind" );
-#endif /* PRINT_CONNTREE */
+#if LDAP_BACK_PRINT_CONNTREE > 0
+		ldap_back_print_conntree( li->li_conninfo.lai_tree, "<<< ldap_back_bind" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
 	
 		ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex );
 		switch ( lerr ) {
@@ -336,6 +346,10 @@ ldap_back_freeconn( Operation *op, ldapconn_t *lc, int dolock )
 		ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
 	}
 
+#if LDAP_BACK_PRINT_CONNTREE > 0
+	ldap_back_print_conntree( li->li_conninfo.lai_tree, ">>> ldap_back_freeconn" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
+
 	tmplc = avl_delete( &li->li_conninfo.lai_tree, (caddr_t)lc,
 			ldap_back_conndnlc_cmp );
 	assert( LDAP_BACK_CONN_TAINTED( lc ) || tmplc == lc );
@@ -343,6 +357,10 @@ ldap_back_freeconn( Operation *op, ldapconn_t *lc, int dolock )
 		ldap_back_conn_free( (void *)lc );
 	}
 
+#if LDAP_BACK_PRINT_CONNTREE > 0
+	ldap_back_print_conntree( li->li_conninfo.lai_tree, "<<< ldap_back_freeconn" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
+
 	if ( dolock ) {
 		ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex );
 	}
@@ -600,13 +618,19 @@ error_return:;
 	return rs->sr_err;
 }
 
-ldapconn_t *
-ldap_back_getconn( Operation *op, SlapReply *rs, ldap_back_send_t sendok )
+static ldapconn_t *
+ldap_back_getconn(
+	Operation		*op,
+	SlapReply		*rs,
+	ldap_back_send_t	sendok,
+	struct berval		*binddn,
+	struct berval		*bindcred )
 {
 	ldapinfo_t	*li = (ldapinfo_t *)op->o_bd->be_private;
 	ldapconn_t	*lc = NULL,
 			lc_curr = { 0 };
-	int		refcnt = 1, binding = 1;
+	int		refcnt = 1,
+			binding = 1;
 
 	/* if the server is quarantined, and
 	 * - the current interval did not expire yet, or
@@ -648,11 +672,23 @@ ldap_back_getconn( Operation *op, SlapReply *rs, ldap_back_send_t sendok )
 	} else {
 		lc_curr.lc_local_ndn = op->o_ndn;
 		/* Explicit binds must not be shared */
-		if ( op->o_tag == LDAP_REQ_BIND || SLAP_IS_AUTHZ_BACKEND( op ) ) {
+		if ( op->o_tag == LDAP_REQ_BIND ) {
 			lc_curr.lc_conn = op->o_conn;
-	
+
 		} else {
-			lc_curr.lc_conn = LDAP_BACK_PCONN_SET( op );
+			if ( !( sendok & LDAP_BACK_BINDING ) && 
+				ldap_back_is_proxy_authz( op, rs, sendok, binddn, bindcred ) )
+			{
+				lc_curr.lc_local_ndn = *binddn;
+				lc_curr.lc_conn = LDAP_BACK_PCONN_SET( op );
+				LDAP_BACK_CONN_ISIDASSERT_SET( &lc_curr );
+
+			} else if ( SLAP_IS_AUTHZ_BACKEND( op ) ) {
+				lc_curr.lc_conn = op->o_conn;
+
+			} else {
+				lc_curr.lc_conn = LDAP_BACK_PCONN_SET( op );
+			}
 		}
 	}
 
@@ -683,17 +719,42 @@ retry_lock:
 		if ( ldap_back_prepare_conn( &lc, op, rs, sendok ) != LDAP_SUCCESS ) {
 			return NULL;
 		}
+
 		if ( sendok & LDAP_BACK_BINDING ) {
 			LDAP_BACK_CONN_BINDING_SET( lc );
 		}
+
 		lc->lc_conn = lc_curr.lc_conn;
 		ber_dupbv( &lc->lc_local_ndn, &lc_curr.lc_local_ndn );
 
+		/*
+		 * the rationale is: connections as the rootdn are privileged,
+		 * so acl_authcDN is to be used; however, in some cases
+		 * one already configured identity assertion with a highly
+		 * privileged idassert_authcDN, so if acl_authcDN is NULL
+		 * and idassert_authcDN is not, use the second instead.
+		 *
+		 * might change in the future, because it's preferable
+		 * to make clear what identity is being used, since
+		 * the only drawback is that one risks to configure
+		 * the same identity twice...
+		 */
 		if ( LDAP_BACK_CONN_ISPRIV( &lc_curr ) ) {
-			ber_dupbv( &lc->lc_cred, &li->li_acl_passwd );
-			ber_dupbv( &lc->lc_bound_ndn, &li->li_acl_authcDN );
+			if ( BER_BVISNULL( &li->li_acl_authcDN ) && !BER_BVISNULL( &li->li_idassert_authcDN ) ) {
+				ber_dupbv( &lc->lc_bound_ndn, &li->li_idassert_authcDN );
+				ber_dupbv( &lc->lc_cred, &li->li_idassert_passwd );
+
+			} else {
+				ber_dupbv( &lc->lc_bound_ndn, &li->li_acl_authcDN );
+				ber_dupbv( &lc->lc_cred, &li->li_acl_passwd );
+			}
 			LDAP_BACK_CONN_ISPRIV_SET( lc );
 
+		} else if ( LDAP_BACK_CONN_ISIDASSERT( &lc_curr ) ) {
+			ber_dupbv( &lc->lc_bound_ndn, &li->li_idassert_authcDN );
+			ber_dupbv( &lc->lc_cred, &li->li_idassert_passwd );
+			LDAP_BACK_CONN_ISIDASSERT_SET( lc );
+
 		} else {
 			BER_BVZERO( &lc->lc_cred );
 			BER_BVZERO( &lc->lc_bound_ndn );
@@ -737,14 +798,18 @@ retry_lock:
 		/* Inserts the newly created ldapconn in the avl tree */
 		ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
 
+#if LDAP_BACK_PRINT_CONNTREE > 0
+		ldap_back_print_conntree( li->li_conninfo.lai_tree, ">>> ldap_back_getconn(insert)" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
+	
 		assert( lc->lc_refcnt == 1 );
 		assert( lc->lc_binding == 1 );
 		rs->sr_err = avl_insert( &li->li_conninfo.lai_tree, (caddr_t)lc,
 			ldap_back_conndn_cmp, ldap_back_conndn_dup );
 
-#if PRINT_CONNTREE > 0
-		myprint( li->li_conninfo.lai_tree, "ldap_back_getconn" );
-#endif /* PRINT_CONNTREE */
+#if LDAP_BACK_PRINT_CONNTREE > 0
+		ldap_back_print_conntree( li->li_conninfo.lai_tree, "<<< ldap_back_getconn(insert)" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
 	
 		ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex );
 
@@ -764,8 +829,14 @@ retry_lock:
 			}
 			/* taint connection, so that it'll be freed when released */
 			ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
+#if LDAP_BACK_PRINT_CONNTREE > 0
+			ldap_back_print_conntree( li->li_conninfo.lai_tree, ">>> ldap_back_getconn(delete)" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
 			(void *)avl_delete( &li->li_conninfo.lai_tree, (caddr_t)lc,
 					ldap_back_conndnlc_cmp );
+#if LDAP_BACK_PRINT_CONNTREE > 0
+			ldap_back_print_conntree( li->li_conninfo.lai_tree, "<<< ldap_back_getconn(delete)" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
 			ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex );
 			LDAP_BACK_CONN_TAINTED_SET( lc );
 			break;
@@ -792,8 +863,14 @@ retry_lock:
 			/* let it be used, but taint/delete it so that 
 			 * no-one else can look it up any further */
 			ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
+#if LDAP_BACK_PRINT_CONNTREE > 0
+			ldap_back_print_conntree( li->li_conninfo.lai_tree, ">>> ldap_back_getconn(timeout)" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
 			(void *)avl_delete( &li->li_conninfo.lai_tree, (caddr_t)lc,
 					ldap_back_conndnlc_cmp );
+#if LDAP_BACK_PRINT_CONNTREE > 0
+			ldap_back_print_conntree( li->li_conninfo.lai_tree, "<<< ldap_back_getconn(timeout)" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
 			ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex );
 			LDAP_BACK_CONN_TAINTED_SET( lc );
 		}
@@ -910,11 +987,7 @@ done:;
 }
 
 /*
- * ldap_back_dobind
- *
- * Note: as the check for the value of lc->lc_bound was already here, I removed
- * it from all the callers, and I made the function return the flag, so
- * it can be used to simplify the check.
+ * ldap_back_dobind_int
  *
  * Note: dolock indicates whether li->li_conninfo.lai_mutex must be locked or not
  */
@@ -929,15 +1002,33 @@ ldap_back_dobind_int(
 {	
 	ldapinfo_t	*li = (ldapinfo_t *)op->o_bd->be_private;
 
-	ldapconn_t	*lc = *lcp;
+	ldapconn_t	*lc;
+	struct berval	binddn = slap_empty_bv,
+			bindcred = slap_empty_bv;
 
-	int		rc,
+	int		rc = 0,
 			isbound,
 			binding = 0;
 	ber_int_t	msgid;
 
+	assert( lcp != NULL );
 	assert( retries >= 0 );
 
+	if ( sendok & LDAP_BACK_GETCONN ) {
+		assert( *lcp == NULL );
+
+		lc = ldap_back_getconn( op, rs, sendok, &binddn, &bindcred );
+		if ( lc == NULL ) {
+			return 0;
+		}
+		*lcp = lc;
+
+	} else {
+		lc = *lcp;
+	}
+
+	assert( lc != NULL );
+
 retry_lock:;
  	if ( dolock ) {
  		ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
@@ -1005,13 +1096,11 @@ retry_lock:;
 	 * but the "override" flag is given to idassert.
 	 * It allows to use SASL bind and yet proxyAuthz users
 	 */
-	if ( op->o_conn != NULL && !op->o_do_not_cache &&
-		( !LDAP_BACK_CONN_ISPRIV( lc ) ||
-			LDAP_BACK_CONN_ISIDASSERT( lc ) ||
-			BER_BVISEMPTY( &lc->lc_bound_ndn ) ) &&
-		( !isbound || ( li->li_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) ) )
-	{
-		(void)ldap_back_proxy_authz_bind( lc, op, rs, sendok );
+	if ( LDAP_BACK_CONN_ISIDASSERT( lc ) ) {
+		if ( BER_BVISEMPTY( &binddn ) && BER_BVISEMPTY( &bindcred ) ) {
+			ldap_back_is_proxy_authz( op, rs, sendok, &binddn, &bindcred );
+		}
+		(void)ldap_back_proxy_authz_bind( lc, op, rs, sendok, &binddn, &bindcred );
 		goto done;
 	}
 
@@ -1051,7 +1140,9 @@ retry_lock:;
 		rs->sr_err = slap_map_api2result( rs );
 		if ( rs->sr_err != LDAP_SUCCESS ) {
 			LDAP_BACK_CONN_ISBOUND_CLEAR( lc );
-			send_ldap_result( op, rs );
+			if ( sendok & LDAP_BACK_SENDERR ) {
+				send_ldap_result( op, rs );
+			}
 
 		} else {
 			LDAP_BACK_CONN_ISBOUND_SET( lc );
@@ -1121,6 +1212,12 @@ retry:;
 			ldap_back_quarantine( op, rs );
 		}
 
+		if ( rs->sr_err != LDAP_SUCCESS &&
+			( sendok & LDAP_BACK_SENDERR ) )
+		{
+			send_ldap_result( op, rs );
+		}
+
 		return 0;
 	}
 
@@ -1136,20 +1233,26 @@ done:;
 	rc = LDAP_BACK_CONN_ISBOUND( lc );
 	if ( !rc ) {
 		ldap_back_release_conn_lock( op, rs, lcp, dolock );
+
+	} else if ( LDAP_BACK_SAVECRED( li ) ) {
+		ldap_set_rebind_proc( lc->lc_ld, li->li_rebind_f, lc );
 	}
 
 	return rc;
 }
 
+/*
+ * ldap_back_dobind
+ *
+ * Note: dolock indicates whether li->li_conninfo.lai_mutex must be locked or not
+ */
 int
-ldap_back_dobind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
+ldap_back_dobind( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
 {
 	ldapinfo_t	*li = (ldapinfo_t *)op->o_bd->be_private;
 
-	/* NOTE: ldap_back_dobind_int() may free lc;
-	 * callers of ldap_back_dobind() MUST no longer deal with lc
-	 * in case of failure */
-	return ldap_back_dobind_int( &lc, op, rs, sendok, li->li_nretries, 1 );
+	return ldap_back_dobind_int( lcp, op, rs,
+		( sendok | LDAP_BACK_GETCONN ), li->li_nretries, 1 );
 }
 
 /*
@@ -1516,15 +1619,16 @@ ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_
 }
 
 static int
-ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_send_t sendok )
+ldap_back_is_proxy_authz( Operation *op, SlapReply *rs, ldap_back_send_t sendok,
+	struct berval *binddn, struct berval *bindcred )
 {
 	ldapinfo_t	*li = (ldapinfo_t *)op->o_bd->be_private;
-	struct berval	binddn = slap_empty_bv;
-	struct berval	bindcred = slap_empty_bv;
 	struct berval	ndn;
 	int		dobind = 0;
-	int		msgid;
-	int		rc;
+
+	if ( op->o_conn == NULL || op->o_do_not_cache ) {
+		goto done;
+	}
 
 	/* don't proxyAuthz if protocol is not LDAPv3 */
 	switch ( li->li_version ) {
@@ -1542,51 +1646,27 @@ ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_b
 		if ( sendok & LDAP_BACK_SENDERR ) {
 			send_ldap_result( op, rs );
 		}
-		LDAP_BACK_CONN_ISBOUND_CLEAR( lc );
 		goto done;
 	}
 
-	LDAP_BACK_CONN_ISIDASSERT_SET( lc );
+	/* safe default */
+	*binddn = slap_empty_bv;
+	*bindcred = slap_empty_bv;
 
-	if ( op->o_tag == LDAP_REQ_BIND ) {
-		ndn = op->o_req_ndn;
-
-	} else if ( !BER_BVISNULL( &op->o_conn->c_ndn ) ) {
+	if ( !BER_BVISNULL( &op->o_conn->c_ndn ) ) {
 		ndn = op->o_conn->c_ndn;
 
 	} else {
 		ndn = op->o_ndn;
 	}
 
-	/*
-	 * FIXME: we need to let clients use proxyAuthz
-	 * otherwise we cannot do symmetric pools of servers;
-	 * we have to live with the fact that a user can
-	 * authorize itself as any ID that is allowed
-	 * by the authzTo directive of the "proxyauthzdn".
-	 */
-	/*
-	 * NOTE: current Proxy Authorization specification
-	 * and implementation do not allow proxy authorization
-	 * control to be provided with Bind requests
-	 */
-	/*
-	 * if no bind took place yet, but the connection is bound
-	 * and the "proxyauthzdn" is set, then bind as 
-	 * "proxyauthzdn" and explicitly add the proxyAuthz 
-	 * control to every operation with the dn bound 
-	 * to the connection as control value.
-	 */
-	/* bind as proxyauthzdn only if no idassert mode
-	 * is requested, or if the client's identity
-	 * is authorized */
 	switch ( li->li_idassert_mode ) {
 	case LDAP_BACK_IDASSERT_LEGACY:
 		if ( !BER_BVISNULL( &ndn ) && !BER_BVISEMPTY( &ndn ) ) {
 			if ( !BER_BVISNULL( &li->li_idassert_authcDN ) && !BER_BVISEMPTY( &li->li_idassert_authcDN ) )
 			{
-				binddn = li->li_idassert_authcDN;
-				bindcred = li->li_idassert_passwd;
+				*binddn = li->li_idassert_authcDN;
+				*bindcred = li->li_idassert_passwd;
 				dobind = 1;
 			}
 		}
@@ -1600,12 +1680,11 @@ ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_b
 				if ( sendok & LDAP_BACK_SENDERR ) {
 					send_ldap_result( op, rs );
 				}
-				LDAP_BACK_CONN_ISBOUND_CLEAR( lc );
 
 			} else {
 				rs->sr_err = LDAP_SUCCESS;
-				binddn = slap_empty_bv;
-				bindcred = slap_empty_bv;
+				*binddn = slap_empty_bv;
+				*bindcred = slap_empty_bv;
 				break;
 			}
 
@@ -1627,12 +1706,11 @@ ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_b
 					if ( sendok & LDAP_BACK_SENDERR ) {
 						send_ldap_result( op, rs );
 					}
-					LDAP_BACK_CONN_ISBOUND_CLEAR( lc );
 
 				} else {
 					rs->sr_err = LDAP_SUCCESS;
-					binddn = slap_empty_bv;
-					bindcred = slap_empty_bv;
+					*binddn = slap_empty_bv;
+					*bindcred = slap_empty_bv;
 					break;
 				}
 
@@ -1640,13 +1718,38 @@ ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_b
 			}
 		}
 
-		binddn = li->li_idassert_authcDN;
-		bindcred = li->li_idassert_passwd;
+		*binddn = li->li_idassert_authcDN;
+		*bindcred = li->li_idassert_passwd;
 		dobind = 1;
 		break;
 	}
 
-	if ( dobind && li->li_idassert_authmethod == LDAP_AUTH_SASL ) {
+done:;
+	return dobind;
+}
+
+static int
+ldap_back_proxy_authz_bind(
+	ldapconn_t		*lc,
+	Operation		*op,
+	SlapReply		*rs,
+	ldap_back_send_t	sendok,
+	struct berval		*binddn,
+	struct berval		*bindcred )
+{
+	ldapinfo_t	*li = (ldapinfo_t *)op->o_bd->be_private;
+	struct berval	ndn;
+	int		msgid;
+	int		rc;
+
+	if ( !BER_BVISNULL( &op->o_conn->c_ndn ) ) {
+		ndn = op->o_conn->c_ndn;
+
+	} else {
+		ndn = op->o_ndn;
+	}
+
+	if ( li->li_idassert_authmethod == LDAP_AUTH_SASL ) {
 #ifdef HAVE_CYRUS_SASL
 		void		*defaults = NULL;
 		struct berval	authzID = BER_BVNULL;
@@ -1707,7 +1810,7 @@ ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_b
 				li->li_idassert_passwd.bv_val,
 				authzID.bv_val );
 
-		rs->sr_err = ldap_sasl_interactive_bind_s( lc->lc_ld, binddn.bv_val,
+		rs->sr_err = ldap_sasl_interactive_bind_s( lc->lc_ld, binddn->bv_val,
 				li->li_idassert_sasl_mech.bv_val, NULL, NULL,
 				LDAP_SASL_QUIET, lutil_sasl_interact,
 				defaults );
@@ -1734,14 +1837,15 @@ ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_b
 
 	switch ( li->li_idassert_authmethod ) {
 	case LDAP_AUTH_NONE:
-		BER_BVSTR( &binddn, "" );
-		BER_BVSTR( &bindcred, "" );
+		/* FIXME: do we really need this? */
+		BER_BVSTR( binddn, "" );
+		BER_BVSTR( bindcred, "" );
 		/* fallthru */
 
 	case LDAP_AUTH_SIMPLE:
 		rs->sr_err = ldap_sasl_bind( lc->lc_ld,
-				binddn.bv_val, LDAP_SASL_SIMPLE,
-				&bindcred, NULL, NULL, &msgid );
+				binddn->bv_val, LDAP_SASL_SIMPLE,
+				bindcred, NULL, NULL, &msgid );
 		rc = ldap_back_op_result( lc, op, rs, msgid,
 			-1, (sendok|LDAP_BACK_BINDING) );
 		break;
@@ -1761,14 +1865,14 @@ ldap_back_proxy_authz_bind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_b
 		 * so that referral chasing is attempted using the right
 		 * identity */
 		LDAP_BACK_CONN_ISBOUND_SET( lc );
-		ber_bvreplace( &lc->lc_bound_ndn, &binddn );
+		ber_bvreplace( &lc->lc_bound_ndn, binddn );
 
 		if ( LDAP_BACK_SAVECRED( li ) ) {
 			if ( !BER_BVISNULL( &lc->lc_cred ) ) {
 				memset( lc->lc_cred.bv_val, 0,
 						lc->lc_cred.bv_len );
 			}
-			ber_bvreplace( &lc->lc_cred, &bindcred );
+			ber_bvreplace( &lc->lc_cred, bindcred );
 			ldap_set_rebind_proc( lc->lc_ld, li->li_rebind_f, lc );
 		}
 	}
diff --git a/servers/slapd/back-ldap/compare.c b/servers/slapd/back-ldap/compare.c
index 9062b921fa..1d667993a2 100644
--- a/servers/slapd/back-ldap/compare.c
+++ b/servers/slapd/back-ldap/compare.c
@@ -38,14 +38,13 @@ ldap_back_compare(
 {
 	ldapinfo_t		*li = (ldapinfo_t *)op->o_bd->be_private;
 
-	ldapconn_t		*lc;
+	ldapconn_t		*lc = NULL;
 	ber_int_t		msgid;
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	LDAPControl		**ctrls = NULL;
 	int			rc = LDAP_SUCCESS;
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		lc = NULL;
 		goto cleanup;
 	}
diff --git a/servers/slapd/back-ldap/config.c b/servers/slapd/back-ldap/config.c
index 1bbcf7dacf..d43ef4d8d5 100644
--- a/servers/slapd/back-ldap/config.c
+++ b/servers/slapd/back-ldap/config.c
@@ -1836,7 +1836,7 @@ ldap_back_exop_whoami(
 		&& !strcmp( op->o_conn->c_authz_backend->be_type, "ldap" )
 		&& !dn_match( &op->o_ndn, &op->o_conn->c_ndn ) )
 	{
-		ldapconn_t	*lc;
+		ldapconn_t	*lc = NULL;
 		LDAPControl c, *ctrls[2] = {NULL, NULL};
 		LDAPMessage *res;
 		Operation op2 = *op;
@@ -1846,8 +1846,7 @@ ldap_back_exop_whoami(
 
 		ctrls[0] = &c;
 		op2.o_ndn = op->o_conn->c_ndn;
-		lc = ldap_back_getconn(&op2, rs, LDAP_BACK_SENDERR);
-		if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+		if ( !ldap_back_dobind( &lc, &op2, rs, LDAP_BACK_SENDERR ) ) {
 			return -1;
 		}
 		c.ldctl_oid = LDAP_CONTROL_PROXY_AUTHZ;
diff --git a/servers/slapd/back-ldap/delete.c b/servers/slapd/back-ldap/delete.c
index 6990bb22fd..e759a2d321 100644
--- a/servers/slapd/back-ldap/delete.c
+++ b/servers/slapd/back-ldap/delete.c
@@ -38,15 +38,13 @@ ldap_back_delete(
 {
 	ldapinfo_t	*li = (ldapinfo_t *)op->o_bd->be_private;
 
-	ldapconn_t		*lc;
+	ldapconn_t		*lc = NULL;
 	ber_int_t		msgid;
 	LDAPControl		**ctrls = NULL;
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	int			rc = LDAP_SUCCESS;
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		return rs->sr_err;
 	}
 
diff --git a/servers/slapd/back-ldap/extended.c b/servers/slapd/back-ldap/extended.c
index 0a4620f8b2..da178559b6 100644
--- a/servers/slapd/back-ldap/extended.c
+++ b/servers/slapd/back-ldap/extended.c
@@ -44,7 +44,7 @@ ldap_back_extended_one( Operation *op, SlapReply *rs, BI_op_extended exop )
 {
 	ldapinfo_t	*li = (ldapinfo_t *) op->o_bd->be_private;
 
-	ldapconn_t	*lc;
+	ldapconn_t	*lc = NULL;
 	LDAPControl	**oldctrls = NULL;
 	int		rc;
 
@@ -52,8 +52,7 @@ ldap_back_extended_one( Operation *op, SlapReply *rs, BI_op_extended exop )
 	 * called twice; maybe we could avoid the 
 	 * ldap_back_dobind() call inside each extended()
 	 * call ... */
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		return -1;
 	}
 
@@ -112,7 +111,7 @@ ldap_back_exop_passwd(
 {
 	ldapinfo_t	*li = (ldapinfo_t *) op->o_bd->be_private;
 
-	ldapconn_t	*lc;
+	ldapconn_t	*lc = NULL;
 	req_pwdexop_s	*qpw = &op->oq_pwdexop;
 	LDAPMessage	*res;
 	ber_int_t	msgid;
@@ -120,8 +119,7 @@ ldap_back_exop_passwd(
 	int		do_retry = 1;
 	char *text = NULL;
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		return -1;
 	}
 
@@ -231,15 +229,14 @@ ldap_back_exop_generic(
 {
 	ldapinfo_t	*li = (ldapinfo_t *) op->o_bd->be_private;
 
-	ldapconn_t	*lc;
+	ldapconn_t	*lc = NULL;
 	LDAPMessage	*res;
 	ber_int_t	msgid;
 	int		rc;
 	int		do_retry = 1;
 	char *text = NULL;
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		return -1;
 	}
 
diff --git a/servers/slapd/back-ldap/modify.c b/servers/slapd/back-ldap/modify.c
index 57109032f7..18c9f1ca29 100644
--- a/servers/slapd/back-ldap/modify.c
+++ b/servers/slapd/back-ldap/modify.c
@@ -38,7 +38,7 @@ ldap_back_modify(
 {
 	ldapinfo_t		*li = (ldapinfo_t *)op->o_bd->be_private;
 
-	ldapconn_t		*lc;
+	ldapconn_t		*lc = NULL;
 	LDAPMod			**modv = NULL,
 				*mods = NULL;
 	Modifications		*ml;
@@ -48,8 +48,7 @@ ldap_back_modify(
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	LDAPControl		**ctrls = NULL;
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		return rs->sr_err;
 	}
 
diff --git a/servers/slapd/back-ldap/modrdn.c b/servers/slapd/back-ldap/modrdn.c
index f158e32368..010b03c94f 100644
--- a/servers/slapd/back-ldap/modrdn.c
+++ b/servers/slapd/back-ldap/modrdn.c
@@ -38,15 +38,14 @@ ldap_back_modrdn(
 {
 	ldapinfo_t		*li = (ldapinfo_t *)op->o_bd->be_private;
 
-	ldapconn_t		*lc;
+	ldapconn_t		*lc = NULL;
 	ber_int_t		msgid;
 	LDAPControl		**ctrls = NULL;
 	ldap_back_send_t	retrying = LDAP_BACK_RETRYING;
 	int			rc = LDAP_SUCCESS;
 	char			*newSup = NULL;
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		return rs->sr_err;
 	}
 
diff --git a/servers/slapd/back-ldap/proto-ldap.h b/servers/slapd/back-ldap/proto-ldap.h
index 98dbaaacaf..4cc5b14de9 100644
--- a/servers/slapd/back-ldap/proto-ldap.h
+++ b/servers/slapd/back-ldap/proto-ldap.h
@@ -46,10 +46,9 @@ extern BI_connection_destroy	ldap_back_conn_destroy;
 extern BI_entry_get_rw		ldap_back_entry_get;
 
 int ldap_back_freeconn( Operation *op, ldapconn_t *lc, int dolock );
-ldapconn_t *ldap_back_getconn( Operation *op, SlapReply *rs, ldap_back_send_t sendok );
 void ldap_back_release_conn_lock( Operation *op, SlapReply *rs, ldapconn_t **lcp, int dolock );
 #define ldap_back_release_conn(op, rs, lc) ldap_back_release_conn_lock((op), (rs), &(lc), 1)
-int ldap_back_dobind( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_send_t sendok );
+int ldap_back_dobind( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok );
 int ldap_back_retry( ldapconn_t **lcp, Operation *op, SlapReply *rs, ldap_back_send_t sendok );
 int ldap_back_map_result( SlapReply *rs );
 int ldap_back_op_result( ldapconn_t *lc, Operation *op, SlapReply *rs,
@@ -82,6 +81,11 @@ ldap_back_quarantine(
 	Operation	*op,
 	SlapReply	*rs );
 
+#ifdef LDAP_BACK_PRINT_CONNTREE
+extern void
+ldap_back_print_conntree( Avlnode *root, char *msg );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
+
 extern void slap_retry_info_destroy( slap_retry_info_t *ri );
 extern int slap_retry_info_parse( char *in, slap_retry_info_t *ri,
 	char *buf, ber_len_t buflen );
diff --git a/servers/slapd/back-ldap/search.c b/servers/slapd/back-ldap/search.c
index ff79c320ef..c15f571e00 100644
--- a/servers/slapd/back-ldap/search.c
+++ b/servers/slapd/back-ldap/search.c
@@ -143,7 +143,7 @@ ldap_back_search(
 {
 	ldapinfo_t	*li = (ldapinfo_t *) op->o_bd->be_private;
 
-	ldapconn_t	*lc;
+	ldapconn_t	*lc = NULL;
 	struct timeval	tv;
 	time_t		stoptime = (time_t)(-1);
 	LDAPMessage	*res,
@@ -160,8 +160,7 @@ ldap_back_search(
 	/* FIXME: shouldn't this be null? */
 	const char	*save_matched = rs->sr_matched;
 
-	lc = ldap_back_getconn( op, rs, LDAP_BACK_SENDERR );
-	if ( !lc || !ldap_back_dobind( lc, op, rs, LDAP_BACK_SENDERR ) ) {
+	if ( !ldap_back_dobind( &lc, op, rs, LDAP_BACK_SENDERR ) ) {
 		return rs->sr_err;
 	}
 
@@ -719,7 +718,7 @@ ldap_back_entry_get(
 {
 	ldapinfo_t	*li = (ldapinfo_t *) op->o_bd->be_private;
 
-	ldapconn_t	*lc;
+	ldapconn_t	*lc = NULL;
 	int		rc = 1,
 			do_not_cache;
 	struct berval	bdn;
@@ -736,8 +735,7 @@ ldap_back_entry_get(
 	/* Tell getconn this is a privileged op */
 	do_not_cache = op->o_do_not_cache;
 	op->o_do_not_cache = 1;
-	lc = ldap_back_getconn( op, &rs, LDAP_BACK_DONTSEND );
-	if ( !lc || !ldap_back_dobind( lc, op, &rs, LDAP_BACK_DONTSEND ) ) {
+	if ( !ldap_back_dobind( &lc, op, &rs, LDAP_BACK_DONTSEND ) ) {
 		op->o_do_not_cache = do_not_cache;
 		return rs.sr_err;
 	}
diff --git a/servers/slapd/back-ldap/unbind.c b/servers/slapd/back-ldap/unbind.c
index faa4b527dc..fc75e675c3 100644
--- a/servers/slapd/back-ldap/unbind.c
+++ b/servers/slapd/back-ldap/unbind.c
@@ -48,11 +48,14 @@ ldap_back_conn_destroy(
 	lc_curr.lc_conn = conn;
 	
 	ldap_pvt_thread_mutex_lock( &li->li_conninfo.lai_mutex );
+#if LDAP_BACK_PRINT_CONNTREE > 0
+		ldap_back_print_conntree( li->li_conninfo.lai_tree, ">>> ldap_back_conn_destroy" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
 	while ( ( lc = avl_delete( &li->li_conninfo.lai_tree, (caddr_t)&lc_curr, ldap_back_conn_cmp ) ) != NULL )
 	{
 		Debug( LDAP_DEBUG_TRACE,
 			"=>ldap_back_conn_destroy: destroying conn %ld (refcnt=%u)\n",
-			LDAP_BACK_PCONN_ID( lc->lc_conn ), lc->lc_refcnt, 0 );
+			LDAP_BACK_PCONN_ID( lc ), lc->lc_refcnt, 0 );
 
 		assert( lc->lc_refcnt == 0 );
 
@@ -63,6 +66,9 @@ ldap_back_conn_destroy(
 		 */
 		ldap_back_conn_free( lc );
 	}
+#if LDAP_BACK_PRINT_CONNTREE > 0
+		ldap_back_print_conntree( li->li_conninfo.lai_tree, "<<< ldap_back_conn_destroy" );
+#endif /* LDAP_BACK_PRINT_CONNTREE */
 	ldap_pvt_thread_mutex_unlock( &li->li_conninfo.lai_mutex );
 
 	return 0;
diff --git a/servers/slapd/back-meta/back-meta.h b/servers/slapd/back-meta/back-meta.h
index f337ea551a..0771431096 100644
--- a/servers/slapd/back-meta/back-meta.h
+++ b/servers/slapd/back-meta/back-meta.h
@@ -33,6 +33,13 @@
 #include "rewrite.h"
 LDAP_BEGIN_DECL
 
+/*
+ * Set META_BACK_PRINT_CONNTREE larger than 0 to dump the connection tree (debug only)
+ */
+#ifndef META_BACK_PRINT_CONNTREE
+#define META_BACK_PRINT_CONNTREE 0
+#endif /* !META_BACK_PRINT_CONNTREE */
+
 struct slap_conn;
 struct slap_op;
 
@@ -187,6 +194,7 @@ typedef struct metasingleconn_t {
 
 typedef struct metaconn_t {
 	struct slap_conn	*mc_conn;
+#define	lc_conn			mc_conn
 	unsigned		mc_refcnt;
 
 	time_t			mc_create_time;
@@ -372,6 +380,13 @@ extern void
 meta_back_conn_free(
 	void			*v_mc );
 
+#if META_BACK_PRINT_CONNTREE > 0
+extern void
+meta_back_print_conntree(
+	Avlnode			*root,
+	char			*msg );
+#endif
+
 extern int
 meta_back_init_one_conn(
 	Operation		*op,
diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index 6d2f75d739..888f1c0d03 100644
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -219,6 +219,9 @@ retry_lock:;
 			}
 
 			assert( mc->mc_refcnt == 1 );
+#if META_BACK_PRINT_CONNTREE > 0
+			meta_back_print_conntree( mi->mi_conninfo.lai_tree, ">>> meta_back_bind" );
+#endif /* META_BACK_PRINT_CONNTREE */
 			tmpmc = avl_delete( &mi->mi_conninfo.lai_tree, (caddr_t)mc,
 				meta_back_conndn_cmp );
 			assert( tmpmc == mc );
@@ -229,7 +232,7 @@ retry_lock:;
 				{
 					Debug( LDAP_DEBUG_TRACE,
 						"=>meta_back_bind: destroying conn %ld (refcnt=%u)\n",
-						LDAP_BACK_PCONN_ID( mc->mc_conn ), mc->mc_refcnt, 0 );
+						LDAP_BACK_PCONN_ID( mc ), mc->mc_refcnt, 0 );
 
 					if ( tmpmc->mc_refcnt != 0 ) {
 						/* taint it */
@@ -252,6 +255,9 @@ retry_lock:;
 			}
 			lerr = avl_insert( &mi->mi_conninfo.lai_tree, (caddr_t)mc,
 				meta_back_conndn_cmp, meta_back_conndn_dup );
+#if META_BACK_PRINT_CONNTREE > 0
+			meta_back_print_conntree( mi->mi_conninfo.lai_tree, "<<< meta_back_bind" );
+#endif /* META_BACK_PRINT_CONNTREE */
 			ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 			if ( lerr == -1 ) {
 				meta_clear_candidates( op, mc );
@@ -560,6 +566,7 @@ meta_back_single_dobind(
 		!op->o_do_not_cache &&
 		( BER_BVISNULL( &msc->msc_bound_ndn ) ||
 			BER_BVISEMPTY( &msc->msc_bound_ndn ) ||
+			( LDAP_BACK_CONN_ISPRIV( msc ) && dn_match( &msc->msc_bound_ndn, &mt->mt_idassert_authcDN ) ) ||
 			( mt->mt_idassert_flags & LDAP_BACK_AUTH_OVERRIDE ) ) )
 	{
 		(void)meta_back_proxy_authz_bind( mc, candidate, op, rs, sendok );
@@ -626,7 +633,7 @@ meta_back_dobind(
 	Debug( LDAP_DEBUG_TRACE,
 		"%s meta_back_dobind: conn=%ld%s\n",
 		op->o_log_prefix,
-		LDAP_BACK_PCONN_ID( mc->mc_conn ),
+		LDAP_BACK_PCONN_ID( mc ),
 		isroot ? " (isroot)" : "" );
 
 	/*
@@ -757,7 +764,7 @@ retry_ok:;
 done:;
 	Debug( LDAP_DEBUG_TRACE,
 		"%s meta_back_dobind: conn=%ld bound=%d\n",
-		op->o_log_prefix, LDAP_BACK_PCONN_ID( mc->mc_conn ), bound );
+		op->o_log_prefix, LDAP_BACK_PCONN_ID( mc ), bound );
 
 	if ( bound == 0 ) {
 		meta_back_release_conn( op, mc );
diff --git a/servers/slapd/back-meta/conn.c b/servers/slapd/back-meta/conn.c
index 99a7899484..976fc7f77d 100644
--- a/servers/slapd/back-meta/conn.c
+++ b/servers/slapd/back-meta/conn.c
@@ -34,13 +34,6 @@
 #include "../back-ldap/back-ldap.h"
 #include "back-meta.h"
 
-/*
- * Set PRINT_CONNTREE larger than 0 to dump the connection tree (debug only)
- */
-#ifndef PRINT_CONNTREE
-#define PRINT_CONNTREE 0
-#endif /* !PRINT_CONNTREE */
-
 /*
  * meta_back_conndn_cmp
  *
@@ -145,7 +138,7 @@ meta_back_conndn_dup(
 /*
  * Debug stuff (got it from libavl)
  */
-#if PRINT_CONNTREE > 0
+#if META_BACK_PRINT_CONNTREE > 0
 static void
 ravl_print( Avlnode *root, int depth )
 {
@@ -172,13 +165,13 @@ ravl_print( Avlnode *root, int depth )
 	ravl_print( root->avl_left, depth + 1 );
 }
 
-static void
-myprint( Avlnode *root, char *msg )
+void
+meta_back_print_conntree( Avlnode *root, char *msg )
 {
 	fprintf( stderr, "========> %s\n", msg );
 	
 	if ( root == 0 ) {
-		fprintf( stderr, "\tNULL\n" );
+		fprintf( stderr, "\t(empty)\n" );
 
 	} else {
 		ravl_print( root, 0 );
@@ -186,7 +179,7 @@ myprint( Avlnode *root, char *msg )
 	
 	fprintf( stderr, "<======== %s\n", msg );
 }
-#endif /* PRINT_CONNTREE */
+#endif /* META_BACK_PRINT_CONNTREE */
 /*
  * End of debug stuff
  */
@@ -895,13 +888,19 @@ retry_lock:;
 			if ( ( mi->mi_conn_ttl != 0 && op->o_time > mc->mc_create_time + mi->mi_conn_ttl )
 				|| ( mi->mi_idle_timeout != 0 && op->o_time > mc->mc_time + mi->mi_idle_timeout ) )
 			{
+#if META_BACK_PRINT_CONNTREE > 0
+				meta_back_print_conntree( mi->mi_conninfo.lai_tree, ">>> meta_back_getconn" );
+#endif /* META_BACK_PRINT_CONNTREE */
 				/* don't let anyone else use this expired connection */
 				(void)avl_delete( &mi->mi_conninfo.lai_tree,
 					(caddr_t)mc, meta_back_conndnmc_cmp );
+#if META_BACK_PRINT_CONNTREE > 0
+				meta_back_print_conntree( mi->mi_conninfo.lai_tree, "<<< meta_back_getconn" );
+#endif /* META_BACK_PRINT_CONNTREE */
 				LDAP_BACK_CONN_TAINTED_SET( mc );
 
 				Debug( LDAP_DEBUG_TRACE, "%s meta_back_getconn: mc=%p conn=%ld expired.\n",
-					op->o_log_prefix, (void *)mc, LDAP_BACK_PCONN_ID( mc->mc_conn ) );
+					op->o_log_prefix, (void *)mc, LDAP_BACK_PCONN_ID( mc ) );
 			}
 
 			/* Don't reuse connections while they're still binding */
@@ -1311,13 +1310,14 @@ done:;
 		 * Inserts the newly created metaconn in the avl tree
 		 */
 		ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
+#if META_BACK_PRINT_CONNTREE > 0
+		meta_back_print_conntree( mi->mi_conninfo.lai_tree, ">>> meta_back_getconn" );
+#endif /* META_BACK_PRINT_CONNTREE */
 		err = avl_insert( &mi->mi_conninfo.lai_tree, ( caddr_t )mc,
 			       	meta_back_conndn_cmp, meta_back_conndn_dup );
-
-#if PRINT_CONNTREE > 0
-		myprint( mi->mi_conninfo.lai_tree, "meta_back_getconn" );
-#endif /* PRINT_CONNTREE */
-		
+#if META_BACK_PRINT_CONNTREE > 0
+		meta_back_print_conntree( mi->mi_conninfo.lai_tree, ">>> meta_back_getconn" );
+#endif /* META_BACK_PRINT_CONNTREE */
 		ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 
 		/*
@@ -1340,7 +1340,7 @@ done:;
 			Debug( LDAP_DEBUG_ANY,
 				"%s meta_back_getconn: candidates=%d conn=%ld insert failed\n",
 				op->o_log_prefix, ncandidates,
-				LDAP_BACK_PCONN_ID( mc->mc_conn ) );
+				LDAP_BACK_PCONN_ID( mc ) );
 	
 			mc->mc_refcnt = 0;	
 			meta_back_conn_free( mc );
@@ -1357,13 +1357,13 @@ done:;
 		Debug( LDAP_DEBUG_TRACE,
 			"%s meta_back_getconn: candidates=%d conn=%ld inserted\n",
 			op->o_log_prefix, ncandidates,
-			LDAP_BACK_PCONN_ID( mc->mc_conn ) );
+			LDAP_BACK_PCONN_ID( mc ) );
 
 	} else {
 		Debug( LDAP_DEBUG_TRACE,
 			"%s meta_back_getconn: candidates=%d conn=%ld fetched\n",
 			op->o_log_prefix, ncandidates,
-			LDAP_BACK_PCONN_ID( mc->mc_conn ) );
+			LDAP_BACK_PCONN_ID( mc ) );
 	}
 	
 	return mc;
@@ -1385,11 +1385,27 @@ meta_back_release_conn_lock(
 	assert( mc->mc_refcnt > 0 );
 	mc->mc_refcnt--;
 	LDAP_BACK_CONN_BINDING_CLEAR( mc );
-	if ( LDAP_BACK_CONN_TAINTED( mc ) ) {
+	/* NOTE: the connection is removed if either it is tainted
+	 * or if it is shared and no one else is using it.  This needs
+	 * to occur because for intrinsic reasons cached connections
+	 * that are not privileged would live forever and pollute
+	 * the connection space (and eat up resources).  Maybe this
+	 * should be configurable... */
+	if ( LDAP_BACK_CONN_TAINTED( mc ) || 
+		( !LDAP_BACK_CONN_ISPRIV( mc ) &&
+			LDAP_BACK_PCONN_ISPRIV( mc ) && 
+			mc->mc_refcnt == 0 ) )
+	{
 		Debug( LDAP_DEBUG_TRACE, "%s meta_back_release_conn: mc=%p conn=%ld tainted.\n",
-			op->o_log_prefix, (void *)mc, LDAP_BACK_PCONN_ID( mc->mc_conn ) );
+			op->o_log_prefix, (void *)mc, LDAP_BACK_PCONN_ID( mc ) );
+#if META_BACK_PRINT_CONNTREE > 0
+		meta_back_print_conntree( mi->mi_conninfo.lai_tree, ">>> meta_back_release_conn" );
+#endif /* META_BACK_PRINT_CONNTREE */
 		(void)avl_delete( &mi->mi_conninfo.lai_tree,
 			( caddr_t )mc, meta_back_conndnmc_cmp );
+#if META_BACK_PRINT_CONNTREE > 0
+		meta_back_print_conntree( mi->mi_conninfo.lai_tree, "<<< meta_back_release_conn" );
+#endif /* META_BACK_PRINT_CONNTREE */
 		if ( mc->mc_refcnt == 0 ) {
 			meta_back_conn_free( mc );
 		}
diff --git a/servers/slapd/back-meta/search.c b/servers/slapd/back-meta/search.c
index cc7647bf69..eb149e50d0 100644
--- a/servers/slapd/back-meta/search.c
+++ b/servers/slapd/back-meta/search.c
@@ -115,12 +115,13 @@ meta_search_dobind_init(
 
 	if ( msc->msc_ld == NULL ) {
 		/* for some reason (e.g. because formerly in "binding"
-		 * state, with eventual connection expiration or invalidation,
+		 * state, with eventual connection expiration or invalidation)
 		 * it was not initialized as expected */
 		rc = meta_back_init_one_conn( op, rs, *mcp, candidate,
 			LDAP_BACK_CONN_ISPRIV( *mcp ), LDAP_BACK_DONTSEND );
 		switch ( rc ) {
 		case LDAP_SUCCESS:
+			assert( msc->msc_ld != NULL );
 			break;
 
 		case LDAP_SERVER_DOWN:
@@ -597,7 +598,7 @@ meta_back_search( Operation *op, SlapReply *rs )
 	initial_candidates = ncandidates;
 
 	if ( LogTest( LDAP_DEBUG_TRACE ) ) {
-		char	cnd[BUFSIZ];
+		char	cnd[ BUFSIZ ];
 		int	c;
 
 		for ( c = 0; c < mi->mi_ntargets; c++ ) {
@@ -716,6 +717,7 @@ meta_back_search( Operation *op, SlapReply *rs )
 					break;
 
 				case META_SEARCH_CANDIDATE:
+					candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 					switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates ) )
 					{
 					case META_SEARCH_CANDIDATE:
@@ -766,12 +768,10 @@ meta_back_search( Operation *op, SlapReply *rs )
 get_result:;
 			rc = ldap_result( msc->msc_ld, candidates[ i ].sr_msgid,
 					LDAP_MSG_ONE, &tv, &res );
-
 			switch ( rc ) {
 			case 0:
 				/* FIXME: res should not need to be freed */
 				assert( res == NULL );
-
 				continue;
 
 			case -1:
@@ -781,6 +781,7 @@ really_bad:;
 					candidates[ i ].sr_type = REP_RESULT;
 
 					if ( meta_back_retry( op, rs, &mc, i, LDAP_BACK_DONTSEND ) ) {
+						candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 						switch ( meta_back_search_start( op, rs, &dc, &mc, i, candidates ) )
 						{
 						case META_SEARCH_CANDIDATE:
@@ -1131,6 +1132,7 @@ really_bad:;
 
 				retcode = meta_search_dobind_result( op, rs, &mc, i, candidates, res );
 				if ( retcode == META_SEARCH_CANDIDATE ) {
+					candidates[ i ].sr_msgid = META_MSGID_IGNORE;
 					retcode = meta_back_search_start( op, rs, &dc, &mc, i, candidates );
 				}
 
diff --git a/servers/slapd/back-meta/unbind.c b/servers/slapd/back-meta/unbind.c
index 7433c2613b..1051b0b3b1 100644
--- a/servers/slapd/back-meta/unbind.c
+++ b/servers/slapd/back-meta/unbind.c
@@ -51,16 +51,22 @@ meta_back_conn_destroy(
 	mc_curr.mc_conn = conn;
 	
 	ldap_pvt_thread_mutex_lock( &mi->mi_conninfo.lai_mutex );
+#if META_BACK_PRINT_CONNTREE > 0
+	meta_back_print_conntree( mi->mi_conninfo.lai_tree, ">>> meta_back_conn_destroy" );
+#endif /* META_BACK_PRINT_CONNTREE */
 	while ( ( mc = avl_delete( &mi->mi_conninfo.lai_tree, ( caddr_t )&mc_curr, meta_back_conn_cmp ) ) != NULL )
 	{
 		Debug( LDAP_DEBUG_TRACE,
 			"=>meta_back_conn_destroy: destroying conn %ld\n",
-			LDAP_BACK_PCONN_ID( mc->mc_conn ), 0, 0 );
+			LDAP_BACK_PCONN_ID( mc ), 0, 0 );
 		
 		assert( mc->mc_refcnt == 0 );
 
 		meta_back_conn_free( mc );
 	}
+#if META_BACK_PRINT_CONNTREE > 0
+	meta_back_print_conntree( mi->mi_conninfo.lai_tree, "<<< meta_back_conn_destroy" );
+#endif /* META_BACK_PRINT_CONNTREE */
 	ldap_pvt_thread_mutex_unlock( &mi->mi_conninfo.lai_mutex );
 
 	/*
diff --git a/tests/data/slapd-meta.conf b/tests/data/slapd-meta.conf
index bbc15018bd..11f6f4245d 100644
--- a/tests/data/slapd-meta.conf
+++ b/tests/data/slapd-meta.conf
@@ -56,14 +56,26 @@ bind-timeout	1000000
 # local
 uri		"@URI2@ou=Meta,o=Example,c=US"
 suffixmassage	"ou=Meta,o=Example,c=US" "ou=Meta,dc=example,dc=com"
-pseudorootdn	"cn=manager,ou=meta,dc=example,dc=com"
-pseudorootpw	secret
+###pseudorootdn	"cn=manager,ou=meta,dc=example,dc=com"
+###pseudorootpw	secret
+idassert-bind	bindmethod=simple
+		binddn="cn=manager,ou=meta,dc=example,dc=com"
+		credentials="secret"
+		mode=none
+		flags=non-prescriptive
+idassert-authzFrom	"dn.exact:cn=Manager,o=Example,c=US"
 
 # remote
 uri		"@URI1@o=Example,c=US"
 suffixmassage	"o=Example,c=US" "dc=example,dc=com"
-pseudorootdn	"cn=manager,dc=example,dc=com"
-pseudorootpw	secret
+###pseudorootdn	"cn=manager,dc=example,dc=com"
+###pseudorootpw	secret
+idassert-bind	bindmethod=simple
+		binddn="cn=manager,dc=example,dc=com"
+		credentials="secret"
+		mode=none
+		flags=non-prescriptive
+idassert-authzFrom	"dn.exact:cn=Manager,o=Example,c=US"
 
 limits		dn.exact="cn=Bjorn Jensen,ou=Information Technology Division,ou=People,o=Example,c=US" time=1 size=8
 
diff --git a/tests/scripts/test036-meta-concurrency b/tests/scripts/test036-meta-concurrency
index 53fbb6d703..76d48ac1c4 100755
--- a/tests/scripts/test036-meta-concurrency
+++ b/tests/scripts/test036-meta-concurrency
@@ -23,17 +23,17 @@ if test $BACKMETA = metano ; then
 	exit 0
 fi
 
-# to be removed some time...
-if test "x$TEST_META" = "xno" ; then
-	echo '### Test disabled by "TEST_META=no"; unset TEST_META to re-enable'
-	echo ""
-	exit 0
-else
-	echo "### this test is experimental; in case of problems,"
-	echo "### set \"TEST_META=no\" to disable, and report thru"
-	echo "### the Issue Tracking System <http://www.openldap.org/its/>"
-	echo ""
-fi
+#### No longer experimental, IMHO
+###if test "x$TEST_META" = "xno" ; then
+###	echo '### Test disabled by "TEST_META=no"; unset TEST_META to re-enable'
+###	echo ""
+###	exit 0
+###else
+###	echo "### this test is experimental; in case of problems,"
+###	echo "### set \"TEST_META=no\" to disable, and report thru"
+###	echo "### the Issue Tracking System <http://www.openldap.org/its/>"
+###	echo ""
+###fi
 
 if test x$TESTLOOPS = x ; then
 	TESTLOOPS=50