diff --git a/tests/data/deref.out b/tests/data/deref.out
new file mode 100644
index 0000000000..d21057354e
--- /dev/null
+++ b/tests/data/deref.out
@@ -0,0 +1,41 @@
+dn: o=deref
+objectClass: top
+objectClass: organization
+o: deref
+description: deref test database
+
+dn: ou=users,o=deref
+objectClass: top
+objectClass: organizationalUnit
+ou: users
+description: container for test deref users
+
+dn: ou=groups,o=deref
+objectClass: top
+objectClass: organizationalUnit
+ou: users
+ou: groups
+description: container for test deref groups
+
+dn: cn=Howard Chu,ou=users,o=deref
+objectClass: inetOrgPerson
+cn: Howard Chu
+sn: Chu
+uid: hyc
+
+dn: cn=Pierangelo Masarati,ou=users,o=deref
+objectClass: inetOrgPerson
+cn: Pierangelo Masarati
+sn: Masarati
+uid: ando
+
+dn: cn=Test Group,ou=groups,o=deref
+# member: <uid=hyc>;cn=Howard Chu,ou=users,o=deref
+
+# member: <uid=ando>;cn=Pierangelo Masarati,ou=users,o=deref
+
+objectClass: groupOfNames
+cn: Test Group
+member: cn=Howard Chu,ou=users,o=deref
+member: cn=Pierangelo Masarati,ou=users,o=deref
+
diff --git a/tests/data/slapd-deref.conf b/tests/data/slapd-deref.conf
new file mode 100644
index 0000000000..42e78b8444
--- /dev/null
+++ b/tests/data/slapd-deref.conf
@@ -0,0 +1,48 @@
+# stand-alone slapd config -- for testing (with deref overlay)
+# $OpenLDAP$
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 2004-2021 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+
+include		@SCHEMADIR@/core.schema
+include		@SCHEMADIR@/cosine.schema
+include		@SCHEMADIR@/inetorgperson.schema
+include		@SCHEMADIR@/openldap.schema
+
+#
+pidfile		@TESTDIR@/slapd.1.pid
+argsfile	@TESTDIR@/slapd.1.args
+
+#mod#modulepath	../servers/slapd/back-@BACKEND@/
+#mod#moduleload	back_@BACKEND@.la
+#derefmod#moduleload ../servers/slapd/overlays/deref.la
+
+#######################################################################
+# database definitions
+#######################################################################
+
+database	@BACKEND@
+suffix		"o=deref"
+rootdn		"cn=Manager,o=deref"
+rootpw		secret
+#~null~#directory	@TESTDIR@/db.1.a
+#indexdb#index		objectClass	eq
+#indexdb#index		cn,sn,uid	pres,eq,sub
+#ndb#dbname db_1
+#ndb#include @DATADIR@/ndb.conf
+
+overlay			deref
+
+database config
+include 	@TESTDIR@/configpw.conf
+
+database	monitor
diff --git a/tests/data/test-deref.ldif b/tests/data/test-deref.ldif
new file mode 100755
index 0000000000..82fdb6d3e7
--- /dev/null
+++ b/tests/data/test-deref.ldif
@@ -0,0 +1,43 @@
+# base
+
+dn: o=deref
+objectClass: top
+objectClass: organization
+o: deref
+description: deref test database
+
+# user container
+
+dn: ou=users,o=deref
+objectClass: top
+objectClass: organizationalUnit
+ou: users
+description: container for test deref users
+
+# group container
+
+dn: ou=groups,o=deref
+objectClass: top
+objectClass: organizationalUnit
+ou: users
+description: container for test deref groups
+
+
+dn: cn=Howard Chu,ou=users,o=deref
+objectClass: inetOrgPerson
+cn: Howard Chu
+sn: Chu
+uid: hyc
+
+dn: cn=Pierangelo Masarati,ou=users,o=deref
+objectClass: inetOrgPerson
+cn: Pierangelo Masarati
+sn: Masarati
+uid: ando
+
+dn: cn=Test Group,ou=groups,o=deref
+objectClass: groupOfNames
+cn: Test Group
+member: cn=Howard Chu,ou=users,o=deref
+member: cn=Pierangelo Masarati,ou=users,o=deref
+
diff --git a/tests/run.in b/tests/run.in
index ca0c1d81e1..ba649aaf00 100644
--- a/tests/run.in
+++ b/tests/run.in
@@ -45,6 +45,7 @@ AC_argon2=argon2@BUILD_PW_ARGON2@
 AC_autoca=autoca@BUILD_AUTOCA@
 AC_constraint=constraint@BUILD_CONSTRAINT@
 AC_dds=dds@BUILD_DDS@
+AC_deref=deref@BUILD_DEREF@
 AC_dynlist=dynlist@BUILD_DYNLIST@
 AC_memberof=memberof@BUILD_MEMBEROF@
 AC_pcache=pcache@BUILD_PROXYCACHE@
@@ -77,7 +78,7 @@ if test "${AC_asyncmeta}" = "asyncmetamod" && test "${AC_LIBS_DYNAMIC}" = "stati
 	AC_meta="asyncmetano"
 fi
 export AC_ldap AC_mdb AC_meta AC_asyncmeta AC_monitor AC_null AC_perl AC_relay AC_sql \
-	AC_accesslog AC_argon2 AC_autoca AC_constraint AC_dds AC_dynlist AC_memberof \
+	AC_accesslog AC_argon2 AC_autoca AC_constraint AC_dds AC_deref AC_dynlist AC_memberof \
 	AC_pcache AC_ppolicy AC_refint AC_remoteauth \
 	AC_retcode AC_rwm AC_unique AC_syncprov AC_translucent \
 	AC_valsort \
diff --git a/tests/scripts/conf.sh b/tests/scripts/conf.sh
index 60e0d2786f..dcd3ea9a5e 100755
--- a/tests/scripts/conf.sh
+++ b/tests/scripts/conf.sh
@@ -38,6 +38,7 @@ sed -e "s/@BACKEND@/${BACKEND}/"			\
 	-e "s/^#${RDBMS}#//"			\
 	-e "s/^#${AC_accesslog}#//"			\
 	-e "s/^#${AC_dds}#//"				\
+	-e "s/^#${AC_deref}#//"				\
 	-e "s/^#${AC_dynlist}#//"			\
 	-e "s/^#${AC_pcache}#//"			\
 	-e "s/^#${AC_ppolicy}#//"			\
diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh
index c1c767b13b..77b094c63e 100755
--- a/tests/scripts/defines.sh
+++ b/tests/scripts/defines.sh
@@ -33,6 +33,7 @@ ARGON2=${AC_argon2-argon2no}
 AUTOCA=${AC_autoca-autocano}
 CONSTRAINT=${AC_constraint-constraintno}
 DDS=${AC_dds-ddsno}
+DEREF=${AC_deref-derefno}
 DYNLIST=${AC_dynlist-dynlistno}
 MEMBEROF=${AC_memberof-memberofno}
 PROXYCACHE=${AC_pcache-pcacheno}
@@ -147,6 +148,7 @@ ASYNCMETACONF=$DATADIR/slapd-asyncmeta.conf
 GLUELDAPCONF=$DATADIR/slapd-glue-ldap.conf
 ACICONF=$DATADIR/slapd-aci.conf
 VALSORTCONF=$DATADIR/slapd-valsort.conf
+DEREFCONF=$DATADIR/slapd-deref.conf
 DYNLISTCONF=$DATADIR/slapd-dynlist.conf
 RCONSUMERCONF=$DATADIR/slapd-repl-consumer-remote.conf
 PLSRCONSUMERCONF=$DATADIR/slapd-syncrepl-consumer-persist-ldap.conf
@@ -318,6 +320,7 @@ LDIFTRANSLUCENTCONFIG=$DATADIR/test-translucent-config.ldif
 LDIFTRANSLUCENTADD=$DATADIR/test-translucent-add.ldif
 LDIFTRANSLUCENTMERGED=$DATADIR/test-translucent-merged.ldif
 LDIFMETA=$DATADIR/test-meta.ldif
+LDIFDEREF=$DATADIR/test-deref.ldif
 LDIFVALSORT=$DATADIR/test-valsort.ldif
 SQLADD=$DATADIR/sql-add.ldif
 LDIFUNORDERED=$DATADIR/test-unordered.ldif
@@ -349,6 +352,8 @@ TRANSLUCENTDN="uid=binder,o=translucent"
 TRANSLUCENTPASSWD="bindtest"
 METABASEDN="ou=Meta,$BASEDN"
 METAMANAGERDN="cn=Manager,$METABASEDN"
+DEREFDN="cn=Manager,o=deref"
+DEREFBASEDN="o=deref"
 VALSORTDN="cn=Manager,o=valsort"
 VALSORTBASEDN="o=valsort"
 MONITORDN="cn=Monitor"
@@ -434,6 +439,7 @@ SUBTREERENAMEOUT=$DATADIR/subtree-rename.out
 ACIOUT=$DATADIR/aci.out
 DYNLISTOUT=$DATADIR/dynlist.out
 DDSOUT=$DATADIR/dds.out
+DEREFOUT=$DATADIR/deref.out
 MEMBEROFOUT=$DATADIR/memberof.out
 MEMBEROFREFINTOUT=$DATADIR/memberof-refint.out
 SHTOOL="$SRCDIR/../build/shtool"
diff --git a/tests/scripts/test084-deref b/tests/scripts/test084-deref
new file mode 100755
index 0000000000..9b7c51ddcd
--- /dev/null
+++ b/tests/scripts/test084-deref
@@ -0,0 +1,94 @@
+#! /bin/sh
+# $OpenLDAP$
+## This work is part of OpenLDAP Software <http://www.openldap.org/>.
+##
+## Copyright 2021 The OpenLDAP Foundation.
+## All rights reserved.
+##
+## Redistribution and use in source and binary forms, with or without
+## modification, are permitted only as authorized by the OpenLDAP
+## Public License.
+##
+## A copy of this license is available in the file LICENSE in the
+## top-level directory of the distribution or, alternatively, at
+## <http://www.OpenLDAP.org/license.html>.
+
+echo "running defines.sh"
+. $SRCDIR/scripts/defines.sh
+
+if test $DEREF = derefno; then
+	echo "Deref overlay not available, test skipped"
+	exit 0
+fi
+
+mkdir -p $TESTDIR $DBDIR1
+
+$SLAPPASSWD -g -n >$CONFIGPWF
+echo "rootpw `$SLAPPASSWD -T $CONFIGPWF`" >$TESTDIR/configpw.conf
+
+echo "Running slapadd to build slapd database..."
+. $CONFFILTER $BACKEND < $DEREFCONF > $CONF1
+$SLAPADD -f $CONF1 -l $LDIFDEREF
+RC=$?
+if test $RC != 0 ; then
+	echo "slapadd failed ($RC)!"
+	exit $RC
+fi
+
+echo "Starting slapd on TCP/IP port $PORT1..."
+$SLAPD -f $CONF1 -h $URI1 -d $LVL > $LOG1 2>&1 &
+PID=$!
+if test $WAIT != 0 ; then
+    echo PID $PID
+    read foo
+fi
+KILLPIDS="$PID"
+
+sleep 1
+
+echo "Testing slapd deref control operations..."
+for i in 0 1 2 3 4 5; do
+	$LDAPSEARCH -s base -b "$MONITOR" -H $URI1 \
+		'objectclass=*' > /dev/null 2>&1
+	RC=$?
+	if test $RC = 0 ; then
+		break
+	fi
+	echo "Waiting 5 seconds for slapd to start..."
+	sleep 5
+done
+
+if test $RC != 0 ; then
+	echo "ldapsearch failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
+echo "Sending deref control..."
+
+$LDAPSEARCH -b "$DEREFBASEDN" -H $URI1 \
+	-E 'deref=member:uid' > $SEARCHOUT 2>&1
+
+RC=$?
+if test $RC != 0 ; then
+	echo "ldapsearch failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
+echo "Comparing output..."
+$CMP $SEARCHOUT $DEREFOUT > $CMPOUT
+
+if test $? != 0 ; then
+	echo "Comparison failed"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit 1
+fi
+
+test $KILLSERVERS != no && kill -HUP $KILLPIDS
+
+test $KILLSERVERS != no && wait
+
+echo ">>>>> Test succeeded"
+
+exit 0