fix ITS#3484

servers/slapd/back-ldap/chain.c

@@ -362,6 +362,12 @@ end_of_searchref:;
 	    	break;
 	case LDAP_REQ_EXTENDED:
 		rc = lback->bi_extended( op, rs );
+		/* FIXME: ldap_back_extended() by design 
+		 * doesn't send result; frontend is expected
+		 * to send it... */
+		if ( rc != SLAPD_ABANDON ) {
+			send_ldap_extended( op, rs );
+		}
 		break;
 	default:
 		rc = SLAP_CB_CONTINUE;

servers/slapd/passwd.c

@@ -113,6 +113,11 @@ int passwd_extop(
 		goto error_return;
 	}
 
+	/* check for referrals */
+	if ( backend_check_referrals( op, rs ) != LDAP_SUCCESS ) {
+		rc = rs->sr_err;
+		goto error_return;
+	}
 
 #ifndef SLAPD_MULTIMASTER
 	/* This does not apply to multi-master case */

tests/scripts/test032-chain

@@ -217,6 +217,28 @@ for P in $PORT1 $PORT2 ; do
 	fi
 done
 
+NEWPW=newsecret
+echo "Using ldappasswd on second server with scope on first server..."
+$LDAPPASSWD -h $LOCALHOST -p $PORT2 \
+	-w secret -s $NEWPW \
+	-D "$MANAGERDN" "$BJORNSDN" >> $TESTOUT 2>&1
+RC=$?
+if test $RC != 0 ; then
+	echo "ldappasswd failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
+echo "Binding with newly changed password on first server..."
+$LDAPWHOAMI -h $LOCALHOST -p $PORT1 \
+	-D "$BJORNSDN" -w $NEWPW
+RC=$?
+if test $RC != 0 ; then
+	echo "ldapwhoami failed ($RC)!"
+	test $KILLSERVERS != no && kill -HUP $KILLPIDS
+	exit $RC
+fi
+
 test $KILLSERVERS != no && kill -HUP $KILLPIDS
 
 echo ">>>>> Test succeeded"