diff --git a/clients/tools/ldapmodify.c b/clients/tools/ldapmodify.c
index 851b41fd75..0a230a2b76 100644
--- a/clients/tools/ldapmodify.c
+++ b/clients/tools/ldapmodify.c
@@ -340,7 +340,8 @@ static int
 process_ldif_rec( char *rbuf )
 {
     char	*line, *dn, *type, *value, *newrdn, *newsup, *p;
-    int		rc, linenum, vlen, modop, replicaport;
+    int		rc, linenum, modop, replicaport;
+	ber_len_t vlen;
     int		expect_modop, expect_sep, expect_ct, expect_newrdn, expect_newsup;
     int		expect_deleteoldrdn, deleteoldrdn;
     int		saw_replica, use_record, new_entry, delete_entry, got_all;
diff --git a/clients/tools/ldapsearch.c b/clients/tools/ldapsearch.c
index be840ee596..0ae11544ec 100644
--- a/clients/tools/ldapsearch.c
+++ b/clients/tools/ldapsearch.c
@@ -9,71 +9,87 @@
 #include <ac/string.h>
 #include <ac/unistd.h>
 
-#include <lber.h>
 #include <ldap.h>
 #include <ldif.h>
 
-#define DEFSEP		"="
+#include "ldap_defaults.h"
 
+#define DEFSEP		"="
 
 static void
 usage( char *s )
 {
-    fprintf( stderr, "usage: %s [options] filter [attributes...]\nwhere:\n", s );
-    fprintf( stderr, "    filter\tRFC-1558 compliant LDAP search filter\n" );
-    fprintf( stderr, "    attributes\twhitespace-separated list of attributes to retrieve\n" );
-    fprintf( stderr, "\t\t*          -- all user attributes\n" );
-    fprintf( stderr, "\t\tempty list -- all non-operational attributes\n" );
-    fprintf( stderr, "\t\t1.1        -- no attributes\n" );
-    fprintf( stderr, "options:\n" );
-    fprintf( stderr, "    -n\t\tshow what would be done but don't actually search\n" );
-    fprintf( stderr, "    -v\t\trun in verbose mode (diagnostics to standard output)\n" );
-    fprintf( stderr, "    -t\t\twrite values to files in /tmp\n" );
-    fprintf( stderr, "    -u\t\tinclude User Friendly entry names in the output\n" );
-    fprintf( stderr, "    -A\t\tretrieve attribute names only (no values)\n" );
-    fprintf( stderr, "    -B\t\tdo not suppress printing of non-ASCII values\n" );
-    fprintf( stderr, "    -L\t\tprint entries in LDIF format (-B is implied)\n" );
-    fprintf( stderr, "    -M\t\tenable Manage DSA IT control (-MM implies critical)\n" );
-    fprintf( stderr, "    -R\t\tdo not automatically follow referrals\n" );
-    fprintf( stderr, "    -d level\tset LDAP debugging level to `level'\n" );
-    fprintf( stderr, "    -F sep\tprint `sep' instead of `=' between attribute names and values\n" );
-    fprintf( stderr, "    -S attr\tsort the results by attribute `attr'\n" );
-    fprintf( stderr, "    -f file\tperform sequence of searches listed in `file'\n" );
-    fprintf( stderr, "    -b basedn\tbase dn for search\n" );
-    fprintf( stderr, "    -s scope\tone of base, one, or sub (search scope)\n" );
-    fprintf( stderr, "    -a deref\tone of never, always, search, or find (alias dereferencing)\n" );
-    fprintf( stderr, "    -l time lim\ttime limit (in seconds) for search\n" );
-    fprintf( stderr, "    -z size lim\tsize limit (in entries) for search\n" );
-    fprintf( stderr, "    -D binddn\tbind dn\n" );
-    fprintf( stderr, "    -w passwd\tbind passwd (for simple authentication)\n" );
-    fprintf( stderr, "    -W\t\tprompt for bind passwd\n" );
+	fprintf( stderr,
+"usage: %s [options] filter [attributes...]\nwhere:\n"
+"	filter\tRFC-1558 compliant LDAP search filter\n"
+"	attributes\twhitespace-separated list of attributes to retrieve\n"
+"\t\t1.1		-- no attributes\n"
+"\t\t*		  -- all user attributes\n"
+"\t\t+		  -- all operational attributes\n"
+"\t\tempty list -- all non-operational attributes\n"
+"options:\n"
+"	-n\t\tshow what would be done but don't actually search\n"
+"	-v\t\trun in verbose mode (diagnostics to standard output)\n"
+"	-t\t\twrite binary values to files in TMPDIR\n"
+"	-tt\t\twrite all values to files in TMPDIR\n"
+"	-T path\twrite files to directory specified by path (default: \"/tmp\")\n"
+"	-V prefix\tURL prefix for files (default: \"file://tmp/\"\n"
+"	-u\t\tinclude User Friendly entry names in the output\n"
+"	-A\t\tretrieve attribute names only (no values)\n"
+"	-B\t\tdo not suppress printing of binary values\n"
+"	-F sep\tprint `sep' instead of `=' between attribute names and values\n"
+"	-L\t\tprint entries in LDIF format (implies -B)\n"
+"	-LL\t\tprint entries in LDIF format without comments\n"
+"	-LLL\t\tprint entries in LDIF format without comments and version\n"
+"	-M\t\tenable Manage DSA IT control (-MM to make critical)\n"
+"	-R\t\tdo not automatically follow referrals\n"
+"	-S attr\tsort the results by attribute `attr'\n"
+"	-d level\tset LDAP debugging level to `level'\n"
+"	-f file\tperform sequence of searches listed in `file'\n"
+"	-b basedn\tbase dn for search\n"
+"	-s scope\tone of base, one, or sub (search scope)\n"
+"	-a deref\tone of never, always, search, or find (alias dereferencing)\n"
+"	-l limit\ttime limit (in seconds) for search\n"
+"	-z limit\tsize limit (in entries) for search\n"
+"	-D binddn\tbind dn\n"
+"	-w passwd\tbind passwd (for simple authentication)\n"
+"	-W\t\tprompt for bind passwd\n"
 #ifdef HAVE_KERBEROS
-    fprintf( stderr, "    -k\t\tuse Kerberos instead of Simple Password authentication\n" );
+"	-k\t\tuse Kerberos instead of Simple Password authentication\n"
 #endif
-    fprintf( stderr, "    -h host\tldap server\n" );
-    fprintf( stderr, "    -p port\tport on ldap server\n" );
-    fprintf( stderr, "    -P version\tprocotol version (2 or 3)\n" );
-    exit( EXIT_FAILURE );
+"	-h host\tldap server\n"
+"	-p port\tport on ldap server\n"
+"	-P version\tprocotol version (2 or 3)\n"
+,		s );
+
+	exit( EXIT_FAILURE );
 }
 
 static void print_entry LDAP_P((
-    LDAP	*ld,
-    LDAPMessage	*entry,
-    int		attrsonly));
+	LDAP	*ld,
+	LDAPMessage	*entry,
+	int		attrsonly));
 
-static int write_ldif_value LDAP_P((
-	char *type,
+static int write_ldif LDAP_P((
+	int type,
+	char *name,
 	char *value,
-	unsigned long vallen ));
+	ber_len_t vallen ));
 
 static int dosearch LDAP_P((
 	LDAP	*ld,
-    char	*base,
-    int		scope,
-    char	**attrs,
-    int		attrsonly,
-    char	*filtpatt,
-    char	*value));
+	char	*base,
+	int		scope,
+	char	**attrs,
+	int		attrsonly,
+	char	*filtpatt,
+	char	*value));
+
+#define TMPDIR "/tmp"
+#define URLPRE "file:/tmp/"
+
+static char *tmpdir = NULL;
+static char *urlpre = NULL;
 
 static char	*binddn = NULL;
 static char	*passwd = NULL;
@@ -83,122 +99,132 @@ static int	ldapport = 0;
 static char	*sep = DEFSEP;
 static char	*sortattr = NULL;
 static int	skipsortattr = 0;
-static int	verbose, not, includeufn, allow_binary, vals2tmp, ldif;
+static int	verbose, not, includeufn, binary, vals2tmp, ldif;
 
 int
 main( int argc, char **argv )
 {
-    char		*infile, *filtpattern, **attrs, line[ BUFSIZ ];
-    FILE		*fp;
-    int			rc, i, first, scope, deref, attrsonly, manageDSAit;
-    int			referrals, timelimit, sizelimit, debug;
+	char		*infile, *filtpattern, **attrs, line[ BUFSIZ ];
+	FILE		*fp;
+	int			rc, i, first, scope, deref, attrsonly, manageDSAit;
+	int			referrals, timelimit, sizelimit, debug;
 	int		authmethod, version, want_bindpw;
-    LDAP		*ld;
+	LDAP		*ld;
 
-    infile = NULL;
-    debug = verbose = allow_binary = not = vals2tmp =
-	    attrsonly = manageDSAit = ldif = want_bindpw = 0;
+	infile = NULL;
+	debug = verbose = binary = not = vals2tmp =
+		attrsonly = manageDSAit = ldif = want_bindpw = 0;
 
 	deref = referrals = sizelimit = timelimit = version = -1;
 
 	scope = LDAP_SCOPE_SUBTREE;
-    authmethod = LDAP_AUTH_SIMPLE;
+	authmethod = LDAP_AUTH_SIMPLE;
 
-    while (( i = getopt( argc, argv, "WKknuvtMRABLD:s:f:h:b:d:P:p:F:a:w:l:z:S:")) != EOF ) {
+	while (( i = getopt( argc, argv,
+		"WKknuvtMRABLD:s:f:h:b:d:P:p:F:a:w:l:z:S:T:V:")) != EOF )
+	{
 	switch( i ) {
 	case 'n':	/* do Not do any searches */
-	    ++not;
-	    break;
+		++not;
+		break;
 	case 'v':	/* verbose mode */
-	    ++verbose;
-	    break;
+		++verbose;
+		break;
 	case 'd':
-	    debug |= atoi( optarg );
-	    break;
+		debug |= atoi( optarg );
+		break;
 	case 'k':	/* use kerberos bind */
 #ifdef HAVE_KERBEROS
 		authmethod = LDAP_AUTH_KRBV4;
 #else
 		fprintf (stderr, "%s was not compiled with Kerberos support\n", argv[0]);
 #endif
-	    break;
+		break;
 	case 'K':	/* use kerberos bind, 1st part only */
 #ifdef HAVE_KERBEROS
 		authmethod = LDAP_AUTH_KRBV41;
 #else
 		fprintf (stderr, "%s was not compiled with Kerberos support\n", argv[0]);
 #endif
-	    break;
+		break;
 	case 'u':	/* include UFN */
-	    ++includeufn;
-	    break;
+		++includeufn;
+		break;
 	case 't':	/* write attribute values to /tmp files */
-	    ++vals2tmp;
-	    break;
+		++vals2tmp;
+		break;
 	case 'M':
 		/* enable Manage DSA IT */
 		manageDSAit++;
 		break;
 	case 'R':	/* don't automatically chase referrals */
 		referrals = (int) LDAP_OPT_OFF;
-	    break;
+		break;
 	case 'A':	/* retrieve attribute names only -- no values */
-	    ++attrsonly;
-	    break;
+		++attrsonly;
+		break;
 	case 'L':	/* print entries in LDIF format */
-	    ++ldif;
-	    /* fall through -- always allow binary when outputting LDIF */
+		++ldif;
+		/* fall through -- always allow binary when outputting LDIF */
 	case 'B':	/* allow binary values to be printed */
-	    ++allow_binary;
-	    break;
+		++binary;
+		break;
 	case 's':	/* search scope */
-	    if ( strcasecmp( optarg, "base" ) == 0 ) {
+		if ( strcasecmp( optarg, "base" ) == 0 ) {
 		scope = LDAP_SCOPE_BASE;
-	    } else if ( strcasecmp( optarg, "one" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "one" ) == 0 ) {
 		scope = LDAP_SCOPE_ONELEVEL;
-	    } else if ( strcasecmp( optarg, "sub" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "sub" ) == 0 ) {
 		scope = LDAP_SCOPE_SUBTREE;
-	    } else {
+		} else {
 		fprintf( stderr, "scope should be base, one, or sub\n" );
 		usage( argv[ 0 ] );
-	    }
-	    break;
+		}
+		break;
 
 	case 'a':	/* set alias deref option */
-	    if ( strcasecmp( optarg, "never" ) == 0 ) {
+		if ( strcasecmp( optarg, "never" ) == 0 ) {
 		deref = LDAP_DEREF_NEVER;
-	    } else if ( strcasecmp( optarg, "search" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "search" ) == 0 ) {
 		deref = LDAP_DEREF_SEARCHING;
-	    } else if ( strcasecmp( optarg, "find" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "find" ) == 0 ) {
 		deref = LDAP_DEREF_FINDING;
-	    } else if ( strcasecmp( optarg, "always" ) == 0 ) {
+		} else if ( strcasecmp( optarg, "always" ) == 0 ) {
 		deref = LDAP_DEREF_ALWAYS;
-	    } else {
+		} else {
 		fprintf( stderr, "alias deref should be never, search, find, or always\n" );
 		usage( argv[ 0 ] );
-	    }
-	    break;
-	    
+		}
+		break;
+		
+	case 'T':	/* field separator */
+		if( tmpdir ) free( tmpdir );
+		tmpdir = strdup( optarg );
+		break;
+	case 'V':	/* field separator */
+		if( urlpre ) free( urlpre );
+		urlpre = strdup( optarg );
+		break;
 	case 'F':	/* field separator */
-	    sep = strdup( optarg );
-	    break;
+		sep = strdup( optarg );
+		break;
 	case 'f':	/* input file */
-	    infile = strdup( optarg );
-	    break;
+		infile = strdup( optarg );
+		break;
 	case 'h':	/* ldap host */
-	    ldaphost = strdup( optarg );
-	    break;
+		ldaphost = strdup( optarg );
+		break;
 	case 'b':	/* searchbase */
-	    base = strdup( optarg );
-	    break;
+		base = strdup( optarg );
+		break;
 	case 'D':	/* bind DN */
-	    binddn = strdup( optarg );
-	    break;
+		binddn = strdup( optarg );
+		break;
 	case 'p':	/* ldap port */
-	    ldapport = atoi( optarg );
-	    break;
+		ldapport = atoi( optarg );
+		break;
 	case 'w':	/* bind password */
-	    passwd = strdup( optarg );
+		passwd = strdup( optarg );
 		{
 			char* p;
 
@@ -206,16 +232,16 @@ main( int argc, char **argv )
 				*p = '*';
 			}
 		}
-	    break;
+		break;
 	case 'l':	/* time limit */
-	    timelimit = atoi( optarg );
-	    break;
+		timelimit = atoi( optarg );
+		break;
 	case 'z':	/* size limit */
-	    sizelimit = atoi( optarg );
-	    break;
+		sizelimit = atoi( optarg );
+		break;
 	case 'S':	/* sort attribute */
-	    sortattr = strdup( optarg );
-	    break;
+		sortattr = strdup( optarg );
+		break;
 	case 'W':
 		want_bindpw++;
 		break;
@@ -234,41 +260,65 @@ main( int argc, char **argv )
 		}
 		break;
 	default:
-	    usage( argv[0] );
+		usage( argv[0] );
+	}
 	}
-    }
 
-    if ( argc - optind < 1 ) {
-	usage( argv[ 0 ] );
-    }
-    filtpattern = strdup( argv[ optind ] );
-    if ( argv[ optind + 1 ] == NULL ) {
-	attrs = NULL;
-    } else if ( sortattr == NULL || *sortattr == '\0' ) {
-        attrs = &argv[ optind + 1 ];
-    } else {
-	for ( i = optind + 1; i < argc; i++ ) {
-	    if ( strcasecmp( argv[ i ], sortattr ) == 0 ) {
-		break;
-	    }
+	if ( argc - optind < 1 ) {
+		usage( argv[ 0 ] );
 	}
-	if ( i == argc ) {
-		skipsortattr = 1;
-		argv[ optind ] = sortattr;
+
+	filtpattern = strdup( argv[ optind ] );
+
+	if ( argv[ optind + 1 ] == NULL ) {
+		attrs = NULL;
+	} else if ( sortattr == NULL || *sortattr == '\0' ) {
+		attrs = &argv[ optind + 1 ];
 	} else {
-		optind++;
+		for ( i = optind + 1; i < argc; i++ ) {
+			if ( strcasecmp( argv[ i ], sortattr ) == 0 ) {
+				break;
+			}
+		}
+		if ( i == argc ) {
+			skipsortattr = 1;
+			argv[ optind ] = sortattr;
+		} else {
+			optind++;
+		}
+		attrs = &argv[ optind ];
 	}
-        attrs = &argv[ optind ];
-    }
 
-    if ( infile != NULL ) {
-	if ( infile[0] == '-' && infile[1] == '\0' ) {
-	    fp = stdin;
-	} else if (( fp = fopen( infile, "r" )) == NULL ) {
-	    perror( infile );
-	    return( EXIT_FAILURE );
+	if ( infile != NULL ) {
+		if ( infile[0] == '-' && infile[1] == '\0' ) {
+			fp = stdin;
+		} else if (( fp = fopen( infile, "r" )) == NULL ) {
+			perror( infile );
+			return EXIT_FAILURE;
+		}
+	}
+
+	if( tmpdir == NULL
+		&& (tmpdir = getenv("TMPDIR")) == NULL
+		&& (tmpdir = getenv("TMP")) == NULL
+		&& (tmpdir = getenv("TEMP")) == NULL )
+	{
+		tmpdir = "/tmp";
+	}
+
+	if( urlpre == NULL ) {
+		urlpre = malloc( sizeof("file:///") + strlen(tmpdir) );
+
+		if( urlpre == NULL ) {
+			perror( "malloc" );
+			return EXIT_FAILURE;
+		}
+
+		sprintf( urlpre, "file:///%s/",
+			tmpdir[0] == '/' ? &tmpdir[1] : tmpdir );
+
+		/* urlpre should be URLized.... */
 	}
-    }
 
 	if ( debug ) {
 		if( ber_set_option( NULL, LBER_OPT_DEBUG_LEVEL, &debug ) != LBER_OPT_SUCCESS ) {
@@ -284,16 +334,16 @@ main( int argc, char **argv )
 	(void) SIGNAL( SIGPIPE, SIG_IGN );
 #endif
 
-    if ( verbose ) {
-	fprintf( stderr, "ldap_init( %s, %d )\n",
-		(ldaphost != NULL) ? ldaphost : "<DEFAULT>",
-		ldapport );
-    }
+	if ( verbose ) {
+		fprintf( stderr, "ldap_init( %s, %d )\n",
+			(ldaphost != NULL) ? ldaphost : "<DEFAULT>",
+			ldapport );
+	}
 
-    if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) {
-	perror( "ldap_init" );
-	return( EXIT_FAILURE );
-    }
+	if (( ld = ldap_init( ldaphost, ldapport )) == NULL ) {
+		perror( "ldap_init" );
+		return( EXIT_FAILURE );
+	}
 
 	if (deref != -1 &&
 		ldap_set_option( ld, LDAP_OPT_DEREF, (void *) &deref ) != LDAP_OPT_SUCCESS )
@@ -324,25 +374,14 @@ main( int argc, char **argv )
 		fprintf( stderr, "Could not set LDAP_OPT_PROTOCOL_VERSION %d\n", version );
 	}
 
-	if (want_bindpw)
+	if (want_bindpw) {
 		passwd = getpass("Enter LDAP Password: ");
-
-    if ( ldap_bind_s( ld, binddn, passwd, authmethod ) != LDAP_SUCCESS ) {
-	ldap_perror( ld, "ldap_bind" );
-	return( EXIT_FAILURE );
-    }
-
-    if ( verbose ) {
-	fprintf( stderr, "filter pattern: %s\nreturning: ", filtpattern );
-	if ( attrs == NULL ) {
-	    printf( "ALL" );
-	} else {
-	    for ( i = 0; attrs[ i ] != NULL; ++i ) {
-		fprintf( stderr, "%s ", attrs[ i ] );
-	    }
 	}
-	fprintf( stderr, "\n" );
-    }
+
+	if ( ldap_bind_s( ld, binddn, passwd, authmethod ) != LDAP_SUCCESS ) {
+		ldap_perror( ld, "ldap_bind" );
+		return( EXIT_FAILURE );
+	}
 
 	if ( manageDSAit ) {
 		int err;
@@ -366,197 +405,270 @@ main( int argc, char **argv )
 		}
 	}
 
-    if ( infile == NULL ) {
-	rc = dosearch( ld, base, scope, attrs, attrsonly, filtpattern, "" );
-    } else {
-	rc = 0;
-	first = 1;
-	while ( rc == 0 && fgets( line, sizeof( line ), fp ) != NULL ) {
-	    line[ strlen( line ) - 1 ] = '\0';
-	    if ( !first ) {
-		putchar( '\n' );
-	    } else {
-		first = 0;
-	    }
-	    rc = dosearch( ld, base, scope, attrs, attrsonly, filtpattern,
-		    line );
+	if ( verbose ) {
+		fprintf( stderr, "filter%s: %s\nreturning: ",
+			infile != NULL ? " pattern" : "",
+			filtpattern );
+
+		if ( attrs == NULL ) {
+			printf( "ALL" );
+		} else {
+			for ( i = 0; attrs[ i ] != NULL; ++i ) {
+				fprintf( stderr, "%s ", attrs[ i ] );
+			}
+		}
+		fprintf( stderr, "\n" );
 	}
-	if ( fp != stdin ) {
-	    fclose( fp );
+
+	if ( ldif ) {
+		if (ldif < 3 ) {
+			/* TEMPORARILY put the version in a comment many tools cannot yet a version attribute  */
+			printf( "# version: 1\n");
+		}
+
+		if (ldif < 2 ) {
+			printf( "#\n# filter%s: %s\n# returning: ",
+				infile != NULL ? " pattern" : "",
+				filtpattern );
+
+			if ( attrs == NULL ) {
+				printf( "ALL" );
+			} else {
+				for ( i = 0; attrs[ i ] != NULL; ++i ) {
+					printf( "%s ", attrs[ i ] );
+				}
+			}
+			printf( "\n#\n\n" );
+		}
 	}
-    }
 
-    ldap_unbind( ld );
+	if ( infile == NULL ) {
+		rc = dosearch( ld, base, scope, attrs, attrsonly, NULL, filtpattern );
 
+	} else {
+		rc = 0;
+		first = 1;
+		while ( rc == 0 && fgets( line, sizeof( line ), fp ) != NULL ) {
+			line[ strlen( line ) - 1 ] = '\0';
+			if ( !first ) {
+				putchar( '\n' );
+			} else {
+				first = 0;
+			}
+			rc = dosearch( ld, base, scope, attrs, attrsonly,
+				filtpattern, line );
+		}
+		if ( fp != stdin ) {
+			fclose( fp );
+		}
+	}
 
+	ldap_unbind( ld );
 	return( rc );
 }
 
 
 static int dosearch(
 	LDAP	*ld,
-    char	*base,
-    int		scope,
-    char	**attrs,
-    int		attrsonly,
-    char	*filtpatt,
-    char	*value)
+	char	*base,
+	int		scope,
+	char	**attrs,
+	int		attrsonly,
+	char	*filtpatt,
+	char	*value)
 {
-    char		filter[ BUFSIZ ];
-    int			rc, first, matches;
-    LDAPMessage		*res, *e;
+	char		filter[ BUFSIZ ];
+	int			rc, first, matches;
+	LDAPMessage		*res, *e;
 
-    sprintf( filter, filtpatt, value );
+	if( filtpatt != NULL ) {
+		sprintf( filter, filtpatt, value );
 
-    if ( verbose ) {
-	fprintf( stderr, "filter is: (%s)\n", filter );
-    }
+		if ( verbose ) {
+			fprintf( stderr, "filter is: (%s)\n", filter );
+		}
 
-    if ( not ) {
-	return( LDAP_SUCCESS );
-    }
+		if( ldif == 1 ) {
+			printf( "#\n# filter: %s\n#\n", filter );
+		}
 
-    if ( ldap_search( ld, base, scope, filter, attrs, attrsonly ) == -1 ) {
+	} else {
+		sprintf( filter, "%s", value );
+	}
+
+	if ( not ) {
+		return( LDAP_SUCCESS );
+	}
+
+	if ( ldap_search( ld, base, scope, filter, attrs, attrsonly ) == -1 ) {
 		int ld_errno;
 		ldap_perror( ld, "ldap_search" );
 
 		ldap_get_option(ld, LDAP_OPT_ERROR_NUMBER, &ld_errno);
 		return( ld_errno );
-    }
+	}
 
-    matches = 0;
-    first = 1;
-    res = NULL;
-    while ( (rc = ldap_result( ld, LDAP_RES_ANY, sortattr ? 1 : 0, NULL, &res ))
-	    == LDAP_RES_SEARCH_ENTRY ) {
+	matches = 0;
+	first = 1;
+	res = NULL;
+	while ( (rc = ldap_result( ld, LDAP_RES_ANY, sortattr ? 1 : 0, NULL, &res ))
+		== LDAP_RES_SEARCH_ENTRY ) {
 	matches++;
 	e = ldap_first_entry( ld, res );
 	if ( !first ) {
-	    putchar( '\n' );
+		putchar( '\n' );
 	} else {
-	    first = 0;
+		first = 0;
 	}
 	print_entry( ld, e, attrsonly );
 	ldap_msgfree( res );
 	res = NULL;
-    }
-    if ( rc == -1 ) {
+	}
+	if ( rc == -1 ) {
 	ldap_perror( ld, "ldap_result" );
 	return( rc );
-    }
-    if (( rc = ldap_result2error( ld, res, 0 )) != LDAP_SUCCESS ) {
-        ldap_perror( ld, "ldap_search" );
-    }
-    if ( sortattr != NULL ) {
-	    (void) ldap_sort_entries( ld, &res,
-		    ( *sortattr == '\0' ) ? NULL : sortattr, strcasecmp );
-	    matches = 0;
-	    first = 1;
-	    for ( e = ldap_first_entry( ld, res ); e != NULL;
-		    e = ldap_next_entry( ld, e ) ) {
+	}
+	if (( rc = ldap_result2error( ld, res, 0 )) != LDAP_SUCCESS ) {
+		ldap_perror( ld, "ldap_search" );
+	}
+	if ( sortattr != NULL ) {
+		(void) ldap_sort_entries( ld, &res,
+			( *sortattr == '\0' ) ? NULL : sortattr, strcasecmp );
+		matches = 0;
+		first = 1;
+		for ( e = ldap_first_entry( ld, res ); e != NULL;
+			e = ldap_next_entry( ld, e ) ) {
 		matches++;
 		if ( !first ) {
-		    putchar( '\n' );
+			putchar( '\n' );
 		} else {
-		    first = 0;
+			first = 0;
 		}
 		print_entry( ld, e, attrsonly );
-	    }
-    }
+		}
+	}
 
-    if ( verbose ) {
-        printf( "%d matches\n", matches );
-    }
+	if ( verbose ) {
+		printf( "%d matches\n", matches );
+	}
 
-    ldap_msgfree( res );
-    return( rc );
+	ldap_msgfree( res );
+	return( rc );
 }
 
 
 void print_entry(
-    LDAP	*ld,
-    LDAPMessage	*entry,
-    int		attrsonly)
+	LDAP	*ld,
+	LDAPMessage	*entry,
+	int		attrsonly)
 {
-    char		*a, *dn, *ufn, tmpfname[ 64 ];
-    int			i, j, notascii;
-    BerElement		*ber = NULL;
-    struct berval	**bvals;
-    FILE		*tmpfp;
+	char		*a, *dn, *ufn;
+	char	tmpfname[ 256 ];
+	char	url[ 256 ];
+	int			i;
+	BerElement		*ber = NULL;
+	struct berval	**bvals;
+	FILE		*tmpfp;
 
-    dn = ldap_get_dn( ld, entry );
-    if ( ldif ) {
-	write_ldif_value( "dn", dn, strlen( dn ));
-    } else {
-	printf( "%s\n", dn );
-    }
-    if ( includeufn ) {
-	ufn = ldap_dn2ufn( dn );
+	dn = ldap_get_dn( ld, entry );
+	ufn = NULL;
+
+	if ( ldif == 1 ) {
+		ufn = ldap_dn2ufn( dn );
+		write_ldif( LDIF_PUT_COMMENT, NULL, ufn, strlen( ufn ));
+	}
 	if ( ldif ) {
-	    write_ldif_value( "ufn", ufn, strlen( ufn ));
+		write_ldif( LDIF_PUT_VALUE, "dn", dn, strlen( dn ));
 	} else {
-	    printf( "%s\n", ufn );
+		printf( "%s\n", dn );
 	}
-	ldap_memfree( ufn );
-    }
-    ldap_memfree( dn );
 
-    for ( a = ldap_first_attribute( ld, entry, &ber ); a != NULL;
-	    a = ldap_next_attribute( ld, entry, ber ) ) {
-	if ( skipsortattr && strcasecmp( a, sortattr ) == 0 ) {
-	    continue;
-	}
-	if ( attrsonly ) {
-	    if ( ldif ) {
-		write_ldif_value( a, "", 0 );
-	    } else {
-		printf( "%s\n", a );
-	    }
-	} else if (( bvals = ldap_get_values_len( ld, entry, a )) != NULL ) {
-	    for ( i = 0; bvals[i] != NULL; i++ ) {
-		if ( vals2tmp ) {
-		    sprintf( tmpfname, "/tmp/ldapsearch-%s-XXXXXX", a );
-		    tmpfp = NULL;
-
-		    if ( mktemp( tmpfname ) == NULL ) {
-			perror( tmpfname );
-		    } else if (( tmpfp = fopen( tmpfname, "w")) == NULL ) {
-			perror( tmpfname );
-		    } else if ( fwrite( bvals[ i ]->bv_val,
-			    bvals[ i ]->bv_len, 1, tmpfp ) == 0 ) {
-			perror( tmpfname );
-		    } else if ( ldif ) {
-			write_ldif_value( a, tmpfname, strlen( tmpfname ));
-		    } else {
-			printf( "%s%s%s\n", a, sep, tmpfname );
-		    }
-
-		    if ( tmpfp != NULL ) {
-			fclose( tmpfp );
-		    }
-		} else {
-		    notascii = 0;
-		    if ( !allow_binary ) {
-			for ( j = 0; (unsigned long) j < bvals[ i ]->bv_len; ++j ) {
-			    if ( !isascii( bvals[ i ]->bv_val[ j ] )) {
-				notascii = 1;
-				break;
-			    }
-			}
-		    }
-
-		    if ( ldif ) {
-			write_ldif_value( a, bvals[ i ]->bv_val,
-				bvals[ i ]->bv_len );
-		    } else {
-			printf( "%s%s%s\n", a, sep,
-				notascii ? "NOT ASCII" : bvals[ i ]->bv_val );
-		    }
+	if ( includeufn ) {
+		if( ufn == NULL ) {
+			ufn = ldap_dn2ufn( dn );
+		}
+		if ( ldif ) {
+			write_ldif( LDIF_PUT_VALUE, "ufn", ufn, strlen( ufn ));
+		} else {
+			printf( "%s\n", ufn );
+		}
+	}
+
+	if( ufn != NULL ) ldap_memfree( ufn );
+	ldap_memfree( dn );
+
+	for ( a = ldap_first_attribute( ld, entry, &ber ); a != NULL;
+		a = ldap_next_attribute( ld, entry, ber ) )
+	{
+		if ( skipsortattr && strcasecmp( a, sortattr ) == 0 ) {
+			continue;
+		}
+
+		if ( attrsonly ) {
+			if ( ldif ) {
+				write_ldif( LDIF_PUT_NOVALUE, a, NULL, 0 );
+			} else {
+				printf( "%s\n", a );
+			}
+
+		} else if (( bvals = ldap_get_values_len( ld, entry, a )) != NULL ) {
+			for ( i = 0; bvals[i] != NULL; i++ ) {
+				if ( vals2tmp > 1 || ( vals2tmp
+					&& ldif_is_not_printable( bvals[i]->bv_val, bvals[i]->bv_len ) ))
+				{
+					/* write value to file */
+					sprintf( tmpfname, "%s" LDAP_DIRSEP "ldapsearch-%s-XXXXXX",
+						tmpdir, a );
+					tmpfp = NULL;
+
+					if ( mktemp( tmpfname ) == NULL ) {
+						perror( tmpfname );
+						continue;
+					}
+
+					if (( tmpfp = fopen( tmpfname, "w")) == NULL ) {
+						perror( tmpfname );
+						continue;
+					}
+
+					if ( fwrite( bvals[ i ]->bv_val,
+						bvals[ i ]->bv_len, 1, tmpfp ) == 0 )
+					{
+						perror( tmpfname );
+						fclose( tmpfp );
+						continue;
+					}
+
+					fclose( tmpfp );
+
+					sprintf( url, "%s%s", urlpre,
+						&tmpfname[strlen(tmpdir) + sizeof(LDAP_DIRSEP) - 1] );
+
+					if ( ldif ) {
+						write_ldif( LDIF_PUT_URL, a, url, strlen( url ));
+					} else {
+						printf( "%s%s%s\n", a, sep, url );
+					}
+
+
+				} else {
+					if ( ldif ) {
+						write_ldif( LDIF_PUT_VALUE, a,
+							bvals[ i ]->bv_val, bvals[ i ]->bv_len );
+
+					} else {
+						int notprint = !binary && !vals2tmp
+							&& ldif_is_not_printable( bvals[i]->bv_val,
+								bvals[i]->bv_len ); 
+						printf( "%s%s", a, sep );
+						puts( notprint ? "NOT PRINTABLE" : bvals[ i ]->bv_val );
+						puts( "\n" );
+					}
+				}
+			}
+			ber_bvecfree( bvals );
 		}
-	    }
-	    ber_bvecfree( bvals );
 	}
-    }
 
 	if( ber != NULL ) {
 		ber_free( ber, 0 );
@@ -565,16 +677,16 @@ void print_entry(
 
 
 int
-write_ldif_value( char *type, char *value, unsigned long vallen )
+write_ldif( int type, char *name, char *value, ber_len_t vallen )
 {
-    char	*ldif;
+	char	*ldif;
 
-    if (( ldif = ldif_type_and_value( type, value, (int)vallen )) == NULL ) {
-	return( -1 );
-    }
+	if (( ldif = ldif_put( type, name, value, vallen )) == NULL ) {
+		return( -1 );
+	}
 
-    fputs( ldif, stdout );
-    ber_memfree( ldif );
+	fputs( ldif, stdout );
+	ber_memfree( ldif );
 
-    return( 0 );
+	return( 0 );
 }
diff --git a/include/ldif.h b/include/ldif.h
index ee0fac4903..8ce760d67c 100644
--- a/include/ldif.h
+++ b/include/ldif.h
@@ -7,6 +7,7 @@
  * license is available at http://www.OpenLDAP.org/license.html or
  * in file LICENSE in the top-level directory of the distribution.
  */
+
 /* Portions
  * Copyright (c) 1996 Regents of the University of Michigan.
  * All rights reserved.
@@ -32,10 +33,10 @@ extern int ldif_debug;
 
 /*
  * Macro to calculate maximum number of bytes that the base64 equivalent
- * of an item that is "vlen" bytes long will take up.  Base64 encoding
+ * of an item that is "len" bytes long will take up.  Base64 encoding
  * uses one byte for every six bits in the value plus up to two pad bytes.
  */
-#define LDIF_BASE64_LEN(vlen)	(((vlen) * 4 / 3 ) + 3)
+#define LDIF_BASE64_LEN(len)	(((len) * 4 / 3 ) + 3)
 
 /*
  * Macro to calculate maximum size that an LDIF-encoded type (length
@@ -43,31 +44,49 @@ extern int ldif_debug;
  * first newline + base64 value + continued lines.  Each continued line
  * needs room for a newline and a leading space character.
  */
-#define LDIF_SIZE_NEEDED(tlen,vlen) \
-    ((tlen) + 4 + LDIF_BASE64_LEN(vlen) \
-    + ((LDIF_BASE64_LEN(vlen) + (tlen) + 3) / LDIF_LINE_WIDTH * 2 ))
+#define LDIF_SIZE_NEEDED(nlen,vlen) \
+    ((nlen) + 4 + LDIF_BASE64_LEN(vlen) \
+    + ((LDIF_BASE64_LEN(vlen) + (nlen) + 3) / LDIF_LINE_WIDTH * 2 ))
 
 LDAP_F( int )
 ldif_parse_line LDAP_P((
 	LDAP_CONST char *line,
-	char **type, char **value, int *vlen));
+	char **name,
+	char **value,
+	ber_len_t *vlen));
 
 LDAP_F( char * )
 ldif_getline LDAP_P(( char **next ));
 
+#define LDIF_PUT_NOVALUE	0x0000	/* no value */
+#define LDIF_PUT_VALUE		0x0001	/* value w/ auto detection */
+#define LDIF_PUT_TEXT		0x0002	/* assume text */
+#define	LDIF_PUT_BINARY		0x0004	/* assume binary (convert to base64) */
+#define LDIF_PUT_B64		0x0008	/* pre-converted base64 value */
+
+#define LDIF_PUT_COMMENT	0x0010	/* comment */
+#define LDIF_PUT_URL		0x0020	/* url */
+#define LDIF_PUT_SEP		0x0040	/* separator */
+
 LDAP_F( void )
-ldif_put_type_and_value LDAP_P((
+ldif_sput LDAP_P((
 	char **out,
-	LDAP_CONST char *t,
+	int type,
+	LDAP_CONST char *name,
 	LDAP_CONST char *val,
-	int vlen ));
+	ber_len_t vlen ));
 
 LDAP_F( char * )
-ldif_type_and_value LDAP_P((
-	LDAP_CONST char *type,
+ldif_put LDAP_P((
+	int type,
+	LDAP_CONST char *name,
 	LDAP_CONST char *val,
-	int vlen ));
+	ber_len_t vlen ));
 
+LDAP_F( int )
+ldif_is_not_printable LDAP_P((
+	LDAP_CONST char *val,
+	ber_len_t vlen ));
 
 LDAP_END_DECL
 
diff --git a/libraries/libldif/line64.c b/libraries/libldif/line64.c
index 28936e1f76..7ec2bdde53 100644
--- a/libraries/libldif/line64.c
+++ b/libraries/libldif/line64.c
@@ -55,7 +55,7 @@ ldif_parse_line(
     LDAP_CONST char	*line,
     char	**type,
     char	**value,
-    int		*vlen
+    ber_len_t *vlen
 )
 {
 	char	*p, *s, *d, *byte, *stop;
@@ -69,7 +69,7 @@ ldif_parse_line(
 	*type = line;
 
 	for ( s = line; *s && *s != ':'; s++ )
-		;	/* NULL */
+		/* EMPTY */;
 	if ( *s == '\0' ) {
 		ber_pvt_log_printf( LDAP_DEBUG_PARSE, ldif_debug,
 			"ldif_parse_line missing ':'\n");
@@ -167,9 +167,11 @@ ldif_parse_line(
  * space character, it is a continuation of the previous line. the white
  * space character (nb: only one char), and preceeding newline are changed
  * into CONTINUED_LINE_MARKER chars, to be deleted later by the
- * str_parse_line() routine above.
+ * ldif_parse_line() routine above.
  *
- * it takes a pointer to a pointer to the buffer on the first call,
+ * ldif_getline will skip over any line which starts '#'.
+ *
+ * ldif_getline takes a pointer to a pointer to the buffer on the first call,
  * which it updates and must be supplied on subsequent calls.
  */
 
@@ -202,99 +204,198 @@ ldif_getline( char **next )
 	return( line );
 }
 
+/* compatibility with U-Mich off by one bug */
+#define LDIF_KLUDGE 1
+
 void
-ldif_put_type_and_value(
+ldif_sput(
 	char **out,
-	LDAP_CONST char *t,
+	int type,
+	LDAP_CONST char *name,
 	LDAP_CONST char *val,
-	int vlen )
+	ber_len_t vlen )
 {
-	unsigned char	*byte, *p, *stop;
+	unsigned char	*byte, *stop;
 	unsigned char	buf[3];
 	unsigned long	bits;
 	char		*save;
-	int		i, b64, pad, len, savelen;
-	len = 0;
+	int		pad;
 
-	/* put the type + ": " */
-	for ( p = (unsigned char *) t; *p; p++, len++ ) {
-		*(*out)++ = *p;
+	ber_len_t savelen;
+	ber_len_t len=0;
+	ber_len_t i;
+
+	/* prefix */
+	switch( type ) {
+	case LDIF_PUT_COMMENT:
+		if( name != NULL ) break;
+
+		*(*out)++ = '#';
+		len++;
+
+		if( vlen ) {
+			*(*out)++ = ' ';
+			len++;
+			break;
+		}
+
+		/* no value, fall-thru */
+
+	case LDIF_PUT_SEP:
+		*(*out)++ = '\n';
+		return;
 	}
-	*(*out)++ = ':';
-	len++;
+
+	/* name (attribute type) */
+	if( name != NULL ) {
+		/* put the name + ":" */
+		for ( i=0 ; name[i]; i++ ) {
+			*(*out)++ = name[i];
+			len++;
+		}
+
+		if( type != LDIF_PUT_COMMENT ) {
+			*(*out)++ = ':';
+			len++;
+		}
+
+#ifdef LDAP_DEBUG
+	} else {
+		assert( type == LDIF_PUT_COMMENT );
+#endif
+	}
+
+	switch( type ) {
+	case LDIF_PUT_NOVALUE:
+		*(*out)++ = '\n';
+		return;
+
+	case LDIF_PUT_URL: /* url value */
+		*(*out)++ = '<';
+		len++;
+		break;
+
+	case LDIF_PUT_B64: /* base64 value */
+		*(*out)++ = ':';
+		len++;
+		break;
+	}
+
+	switch( type ) {
+	case LDIF_PUT_TEXT:
+	case LDIF_PUT_URL:
+	case LDIF_PUT_B64:
+		*(*out)++ = ' ';
+		len++;
+		/* fall-thru */
+
+	case LDIF_PUT_COMMENT:
+		/* pre-encoded names */
+		for ( i=0; i < vlen; i++ ) {
+			if ( len > LDIF_LINE_WIDTH ) {
+				*(*out)++ = '\n';
+				*(*out)++ = ' ';
+				len = 1;
+			}
+
+			*(*out)++ = val[i];
+			len++;
+		}
+		*(*out)++ = '\n';
+		return;
+	}
+
 	save = *out;
 	savelen = len;
+
 	*(*out)++ = ' ';
-	b64 = 0;
+	len++;
+
+	if( vlen == 0 ) {
+		*(*out)++ = '\n';
+		return;
+	}
 
 	stop = (unsigned char *) (val + vlen);
-	if ( isascii( val[0] ) && (isspace( val[0] ) || val[0] == ':') ) {
-		b64 = 1;
-	} else {
+
+	if ( type == LDIF_PUT_VALUE &&
+		isgraph( val[0] ) && val[0] != ':' && val[0] != '<' &&
+		isgraph( val[vlen-1] ) )
+	{
+		int b64 = 0;
+
 		for ( byte = (unsigned char *) val; byte < stop;
-		    byte++, len++ ) {
+		    byte++, len++ )
+		{
 			if ( !isascii( *byte ) || !isprint( *byte ) ) {
 				b64 = 1;
 				break;
 			}
-			if ( len > LDIF_LINE_WIDTH ) {
+			if ( len > LDIF_LINE_WIDTH+LDIF_KLUDGE ) {
 				*(*out)++ = '\n';
 				*(*out)++ = ' ';
 				len = 1;
 			}
 			*(*out)++ = *byte;
 		}
-	}
-	if ( b64 ) {
-		*out = save;
-		*(*out)++ = ':';
-		*(*out)++ = ' ';
-		len = savelen + 2;
-		/* convert to base 64 (3 bytes => 4 base 64 digits) */
-		for ( byte = (unsigned char *) val; byte < stop - 2;
-		    byte += 3 ) {
-			bits = (byte[0] & 0xff) << 16;
-			bits |= (byte[1] & 0xff) << 8;
-			bits |= (byte[2] & 0xff);
 
-			for ( i = 0; i < 4; i++, len++, bits <<= 6 ) {
-				if ( len > LDIF_LINE_WIDTH ) {
-					*(*out)++ = '\n';
-					*(*out)++ = ' ';
-					len = 1;
-				}
-
-				/* get b64 digit from high order 6 bits */
-				*(*out)++ = nib2b64[ (bits & 0xfc0000L) >> 18 ];
-			}
+		if( !b64 ) {
+			*(*out)++ = '\n';
+			return;
 		}
+	}
 
-		/* add padding if necessary */
-		if ( byte < stop ) {
-			for ( i = 0; byte + i < stop; i++ ) {
-				buf[i] = byte[i];
+	*out = save;
+	*(*out)++ = ':';
+	*(*out)++ = ' ';
+	len = savelen + 2;
+
+	/* convert to base 64 (3 bytes => 4 base 64 digits) */
+	for ( byte = (unsigned char *) val;
+		byte < stop - 2;
+	    byte += 3 )
+	{
+		bits = (byte[0] & 0xff) << 16;
+		bits |= (byte[1] & 0xff) << 8;
+		bits |= (byte[2] & 0xff);
+
+		for ( i = 0; i < 4; i++, len++, bits <<= 6 ) {
+			if ( len > LDIF_LINE_WIDTH+LDIF_KLUDGE ) {
+				*(*out)++ = '\n';
+				*(*out)++ = ' ';
+				len = 1;
 			}
-			for ( pad = 0; i < 3; i++, pad++ ) {
-				buf[i] = '\0';
+
+			/* get b64 digit from high order 6 bits */
+			*(*out)++ = nib2b64[ (bits & 0xfc0000L) >> 18 ];
+		}
+	}
+
+	/* add padding if necessary */
+	if ( byte < stop ) {
+		for ( i = 0; byte + i < stop; i++ ) {
+			buf[i] = byte[i];
+		}
+		for ( pad = 0; i < 3; i++, pad++ ) {
+			buf[i] = '\0';
+		}
+		byte = buf;
+		bits = (byte[0] & 0xff) << 16;
+		bits |= (byte[1] & 0xff) << 8;
+		bits |= (byte[2] & 0xff);
+
+		for ( i = 0; i < 4; i++, len++, bits <<= 6 ) {
+			if ( len > LDIF_LINE_WIDTH+LDIF_KLUDGE ) {
+				*(*out)++ = '\n';
+				*(*out)++ = ' ';
+				len = 1;
 			}
-			byte = buf;
-			bits = (byte[0] & 0xff) << 16;
-			bits |= (byte[1] & 0xff) << 8;
-			bits |= (byte[2] & 0xff);
 
-			for ( i = 0; i < 4; i++, len++, bits <<= 6 ) {
-				if ( len > LDIF_LINE_WIDTH ) {
-					*(*out)++ = '\n';
-					*(*out)++ = ' ';
-					len = 1;
-				}
-
-				if( i + pad < 4 ) {
-					/* get b64 digit from low order 6 bits */
-					*(*out)++ = nib2b64[ (bits & 0xfc0000L) >> 18 ];
-				} else {
-					*(*out)++ = '=';
-				}
+			if( i + pad < 4 ) {
+				/* get b64 digit from low order 6 bits */
+				*(*out)++ = nib2b64[ (bits & 0xfc0000L) >> 18 ];
+			} else {
+				*(*out)++ = '=';
 			}
 		}
 	}
@@ -302,27 +403,57 @@ ldif_put_type_and_value(
 }
 
 
-char *
-ldif_type_and_value( LDAP_CONST char *type, LDAP_CONST char *val, int vlen )
 /*
- * return BER malloc'd, zero-terminated LDIF line
+ * ldif_type_and_value return BER malloc'd, zero-terminated LDIF line
  */
+char *
+ldif_put(
+	int type,
+	LDAP_CONST char *name,
+	LDAP_CONST char *val,
+	ber_len_t vlen )
 {
     char	*buf, *p;
-    int		tlen;
+    ber_len_t nlen;
 
-    tlen = strlen( type );
-    if (( buf = (char *) ber_memalloc( LDIF_SIZE_NEEDED( tlen, vlen ) + 1 ))
-		== NULL )
-	{
+    nlen = ( name != NULL ) ? strlen( name ) : 0;
+
+	buf = (char *) ber_memalloc( LDIF_SIZE_NEEDED( nlen, vlen ) + 1 );
+
+    if ( buf == NULL ) {
 		ber_pvt_log_printf( LDAP_DEBUG_ANY, ldif_debug,
 			"ldif_type_and_value: malloc failed!" );
 		return NULL;
     }
 
     p = buf;
-    ldif_put_type_and_value( &p, type, val, vlen );
+    ldif_sput( &p, type, name, val, vlen );
     *p = '\0';
 
     return( buf );
 }
+
+int ldif_is_not_printable(
+	LDAP_CONST char *val,
+	ber_len_t vlen )
+{
+	if( vlen == 0 || val == NULL  ) {
+		return -1;
+	}
+
+	if( isgraph( val[0] ) && val[0] != ':' && val[0] != '<' &&
+		isgraph( val[vlen-1] ) )
+	{
+		ber_len_t i;
+
+		for ( i = 0; val[i]; i++ ) {
+			if ( !isascii( val[i] ) || !isprint( val[i] ) ) {
+				return 1;
+			}
+		}
+
+		return 0;
+	}
+
+	return 1;
+}
diff --git a/servers/slapd/entry.c b/servers/slapd/entry.c
index e0465230e9..ce08b132d1 100644
--- a/servers/slapd/entry.c
+++ b/servers/slapd/entry.c
@@ -24,7 +24,8 @@ str2entry( char	*s )
 	char		*type;
 	char		*value;
 	char		*next;
-	int		vlen, nvals, maxvals;
+	ber_len_t	vlen;
+	int		nvals, maxvals;
 	struct berval	bval;
 	struct berval	*vals[2];
 	char		ptype[64];
@@ -194,7 +195,7 @@ entry2str(
 		/* put "dn: <dn>" */
 		tmplen = strlen( e->e_dn );
 		MAKE_SPACE( LDIF_SIZE_NEEDED( 2, tmplen ));
-		ldif_put_type_and_value( (char **) &ecur, "dn", e->e_dn, tmplen );
+		ldif_sput( (char **) &ecur, LDIF_PUT_VALUE, "dn", e->e_dn, tmplen );
 	}
 
 	/* put the attributes */
@@ -204,7 +205,7 @@ entry2str(
 			bv = a->a_vals[i];
 			tmplen = strlen( a->a_type );
 			MAKE_SPACE( LDIF_SIZE_NEEDED( tmplen, bv->bv_len ));
-			ldif_put_type_and_value( (char **) &ecur, a->a_type,
+			ldif_sput( (char **) &ecur, LDIF_PUT_VALUE, a->a_type,
 			    bv->bv_val, bv->bv_len );
 		}
 	}
diff --git a/servers/slapd/repl.c b/servers/slapd/repl.c
index 1b59f2be86..122872f92b 100644
--- a/servers/slapd/repl.c
+++ b/servers/slapd/repl.c
@@ -77,7 +77,8 @@ replog(
 				buf = (char *) ch_malloc( len );
 
 				bufp = buf;
-				ldif_put_type_and_value( &bufp, ml->ml_type,
+				ldif_sput( &bufp, LDIF_PUT_VALUE,
+					ml->ml_type,
 				    ml->ml_bvalues[i]->bv_val,
 				    ml->ml_bvalues[i]->bv_len );
 				*bufp = '\0';
diff --git a/servers/slapd/tools/ldif.c b/servers/slapd/tools/ldif.c
index 269a9b4d8a..94381c6202 100644
--- a/servers/slapd/tools/ldif.c
+++ b/servers/slapd/tools/ldif.c
@@ -71,7 +71,7 @@ main( int argc, char **argv )
 			cur += nread;
 		}
 
-		if (( out = ldif_type_and_value( type, val, cur )) == NULL ) {
+		if (( out = ldif_put( LDIF_PUT_BINARY, type, val, cur )) == NULL ) {
 		    	perror( "ldif_type_and_value" );
 			exit( 1 );
 		}
@@ -86,7 +86,7 @@ main( int argc, char **argv )
 	while ( fgets( buf, sizeof(buf), stdin ) != NULL ) {
 		if( buf[len=strlen(buf)] == '\n') buf[len] = '\0';
 
-		if (( out = ldif_type_and_value( type, buf, strlen( buf ) ))
+		if (( out = ldif_put( LDIF_PUT_VALUE, type, buf, strlen( buf ) ))
 		    == NULL ) {
 		    	perror( "ldif_type_and_value" );
 			exit( 1 );
diff --git a/servers/slapd/tools/ldif2id2children-bdb2.c b/servers/slapd/tools/ldif2id2children-bdb2.c
index 713b461dd9..f7a1b8319c 100644
--- a/servers/slapd/tools/ldif2id2children-bdb2.c
+++ b/servers/slapd/tools/ldif2id2children-bdb2.c
@@ -130,7 +130,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen;
+		ber_len_t		vlen;
 		Datum		key, data;
 
 		ldbm_datum_init( key );
diff --git a/servers/slapd/tools/ldif2id2children.c b/servers/slapd/tools/ldif2id2children.c
index 459579e7f1..1a72b1f17f 100644
--- a/servers/slapd/tools/ldif2id2children.c
+++ b/servers/slapd/tools/ldif2id2children.c
@@ -132,7 +132,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen;
+		ber_len_t		vlen;
 		Datum		key, data;
 
 		ldbm_datum_init( key );
@@ -219,7 +219,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char	*type, *val, *s, *dn;
-		int	vlen;
+		ber_len_t	vlen;
 		ID	pid;
 		char	buf2[20];
 		Datum	key, data;
diff --git a/servers/slapd/tools/ldif2index-bdb2.c b/servers/slapd/tools/ldif2index-bdb2.c
index d832256607..53fabcc2ab 100644
--- a/servers/slapd/tools/ldif2index-bdb2.c
+++ b/servers/slapd/tools/ldif2index-bdb2.c
@@ -121,7 +121,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen;
+		ber_len_t	vlen;
 
 		if ( fgets( line, sizeof(line), stdin ) != NULL ) {
 			int     len;
diff --git a/servers/slapd/tools/ldif2index.c b/servers/slapd/tools/ldif2index.c
index 6dfe83f382..f654baaa08 100644
--- a/servers/slapd/tools/ldif2index.c
+++ b/servers/slapd/tools/ldif2index.c
@@ -123,7 +123,7 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen;
+		ber_len_t		vlen;
 
 		if ( fgets( line, sizeof(line), stdin ) != NULL ) {
 			int     len;
diff --git a/servers/slapd/tools/ldif2ldbm-bdb2.c b/servers/slapd/tools/ldif2ldbm-bdb2.c
index 8ba47bb95a..e1471f92a4 100644
--- a/servers/slapd/tools/ldif2ldbm-bdb2.c
+++ b/servers/slapd/tools/ldif2ldbm-bdb2.c
@@ -214,7 +214,8 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen, indexmask, syntaxmask;
+		ber_len_t		vlen;
+		int indexmask, syntaxmask;
 
 		if ( fgets( line, sizeof(line), stdin ) != NULL ) {
 			int     len;
diff --git a/servers/slapd/tools/ldif2ldbm.c b/servers/slapd/tools/ldif2ldbm.c
index 407401196d..e95c5dddb2 100644
--- a/servers/slapd/tools/ldif2ldbm.c
+++ b/servers/slapd/tools/ldif2ldbm.c
@@ -222,7 +222,8 @@ main( int argc, char **argv )
 	vals[1] = NULL;
 	while ( ! stop ) {
 		char		*type, *val, *s;
-		int		vlen, indexmask, syntaxmask;
+		ber_len_t	vlen;
+		int			indexmask, syntaxmask;
 
 		if ( fgets( line, sizeof(line), stdin ) != NULL ) {
 			int     len;
diff --git a/servers/slurpd/re.c b/servers/slurpd/re.c
index 911cb61661..fa171ca159 100644
--- a/servers/slurpd/re.c
+++ b/servers/slurpd/re.c
@@ -125,9 +125,9 @@ Re_parse(
     int			state;
     int			nml;
     char		*buf, *rp, *p;
-    long		buflen;
+    size_t		buflen;
     char		*type, *value;
-    int			len;
+    ber_len_t	len;
     int			nreplicas;
 
     if ( re == NULL ) {
@@ -158,7 +158,7 @@ Re_parse(
 	if ( strncmp( buf, ERROR_STR, strlen( ERROR_STR )) == 0 ) {
 	    continue;
 	}
-	buflen = ( long ) strlen( buf );
+	buflen = strlen( buf );
 	if ( ldif_parse_line( buf, &type, &value, &len ) < 0 ) {
 	    Debug( LDAP_DEBUG_ANY,
 		    "Error: Re_parse: malformed replog file\n",
@@ -208,7 +208,7 @@ Re_parse(
 	if (( buf = ldif_getline( &rp )) == NULL ) {
 	    break;
 	}
-	buflen = ( long ) strlen( buf );
+	buflen = strlen( buf );
 	if (( buflen == 1 ) && ( buf[ 0 ] == '-' )) {
 	    type = "-";
 	    value = NULL;
@@ -259,7 +259,8 @@ get_repl_hosts(
     char		buf[ LDIF_LINE_WIDTH + 1 ];
     char		*type, *value, *line, *p;
     Rh			*rh = NULL;
-    int			nreplicas, len;
+    int			nreplicas;
+	ber_len_t	len;
     int			port;
     int			repl_ok;
     int			i;
@@ -566,7 +567,8 @@ Re_write(
 	    }
 	} else {
 	    char *obuf;
-	    obuf = ldif_type_and_value( re->re_mods[ i ].mi_type,
+	    obuf = ldif_put( LDIF_PUT_VALUE,
+			re->re_mods[ i ].mi_type,
 		    re->re_mods[ i ].mi_val ? re->re_mods[ i ].mi_val : "",
 		    re->re_mods[ i ].mi_len );
 	    if ( fputs( obuf, fp ) < 0 ) {
diff --git a/tests/data/acl.out.master b/tests/data/acl.out.master
index c246e03b95..1627d9372e 100644
--- a/tests/data/acl.out.master
+++ b/tests/data/acl.out.master
@@ -102,7 +102,7 @@ uid: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/modify.out.master b/tests/data/modify.out.master
index 22a3b943ef..244770c8a2 100644
--- a/tests/data/modify.out.master
+++ b/tests/data/modify.out.master
@@ -57,7 +57,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/modrdn.out.master b/tests/data/modrdn.out.master
index 8e1061ce05..aecb9c8b35 100644
--- a/tests/data/modrdn.out.master
+++ b/tests/data/modrdn.out.master
@@ -78,7 +78,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/modrdn.out.master.0 b/tests/data/modrdn.out.master.0
index 8e1061ce05..aecb9c8b35 100644
--- a/tests/data/modrdn.out.master.0
+++ b/tests/data/modrdn.out.master.0
@@ -78,7 +78,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/search.out.master b/tests/data/search.out.master
index 4f339c34d6..5ac2183f26 100644
--- a/tests/data/search.out.master
+++ b/tests/data/search.out.master
@@ -17,7 +17,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/test-ordered.ldif b/tests/data/test-ordered.ldif
index a57f997ab5..51ebed0ffa 100644
--- a/tests/data/test-ordered.ldif
+++ b/tests/data/test-ordered.ldif
@@ -120,7 +120,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/data/test.ldif b/tests/data/test.ldif
index aa02a479f1..6d301199b2 100644
--- a/tests/data/test.ldif
+++ b/tests/data/test.ldif
@@ -78,7 +78,7 @@ userpassword: bjensen
 mail: bjensen@mailgw.umich.edu
 homepostaladdress: 123 Wesley $ Ann Arbor, MI 48103
 krbname: bjensen@umich.edu
-multilinedescription: Mythical manager of the rsdd unix project 
+multilinedescription: Mythical manager of the rsdd unix project
 nobatchupdates: TRUE
 notice: Off sailing this month.
 onvacation: FALSE
diff --git a/tests/scripts/defines.sh b/tests/scripts/defines.sh
index 58e0842396..f13800d21e 100755
--- a/tests/scripts/defines.sh
+++ b/tests/scripts/defines.sh
@@ -30,7 +30,7 @@ CLIENTDIR=../clients/tools
 
 SLAPD=../servers/slapd/slapd
 SLURPD=../servers/slurpd/slurpd
-LDAPSEARCH="$CLIENTDIR/ldapsearch $PROTO"
+LDAPSEARCH="$CLIENTDIR/ldapsearch $PROTO -LLL"
 LDAPMODIFY="$CLIENTDIR/ldapmodify $PROTO"
 LDAPADD="$CLIENTDIR/ldapadd $PROTO"
 LDAPMODRDN="$CLIENTDIR/ldapmodrdn $PROTO"
diff --git a/tests/scripts/test001-ldif2ldbm b/tests/scripts/test001-ldif2ldbm
index a93b1d8f55..42123ec417 100755
--- a/tests/scripts/test001-ldif2ldbm
+++ b/tests/scripts/test001-ldif2ldbm
@@ -33,7 +33,7 @@ PID=$!
 
 echo "Using ldapsearch to retrieve all the entries..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+	$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 		'objectClass=*' > $SEARCHOUT 2>&1
 	RC=$?
 	if test $RC = 1 ; then
diff --git a/tests/scripts/test001-slapadd b/tests/scripts/test001-slapadd
index a93b1d8f55..42123ec417 100755
--- a/tests/scripts/test001-slapadd
+++ b/tests/scripts/test001-slapadd
@@ -33,7 +33,7 @@ PID=$!
 
 echo "Using ldapsearch to retrieve all the entries..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+	$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 		'objectClass=*' > $SEARCHOUT 2>&1
 	RC=$?
 	if test $RC = 1 ; then
diff --git a/tests/scripts/test002-populate b/tests/scripts/test002-populate
index 7d2d49df6c..252ce1faa0 100755
--- a/tests/scripts/test002-populate
+++ b/tests/scripts/test002-populate
@@ -22,7 +22,7 @@ PID=$!
 
 echo "Using ldapsearch to check that slapd is running..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -42,7 +42,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Using ldapsearch to read all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'objectclass=*' > $SEARCHOUT 2>&1
 
 kill -HUP $PID
diff --git a/tests/scripts/test003-search b/tests/scripts/test003-search
index 0642b057cf..2999b01117 100755
--- a/tests/scripts/test003-search
+++ b/tests/scripts/test003-search
@@ -30,7 +30,7 @@ PID=$!
 
 echo "Testing slapd searching..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -48,7 +48,7 @@ fi
 cat /dev/null > $SEARCHOUT
 
 echo "Testing exact searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'sn=jensen' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -57,7 +57,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing OR searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'(|(objectclass=rfc822mailgroup)(sn=jones))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -66,7 +66,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing AND matching and ends-with searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'(&(objectclass=rfc822mailgroup)(cn=A*))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -75,7 +75,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing NOT searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'(!(objectclass=person))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
diff --git a/tests/scripts/test004-modify b/tests/scripts/test004-modify
index f5f7cea5b4..234dcd4051 100755
--- a/tests/scripts/test004-modify
+++ b/tests/scripts/test004-modify
@@ -30,7 +30,7 @@ PID=$!
 
 echo "Testing slapd modify operations..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -116,7 +116,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Using ldapsearch to retrieve all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'objectClass=*' > $SEARCHOUT 2>&1
 RC=$?
 kill -HUP $PID
diff --git a/tests/scripts/test005-modrdn b/tests/scripts/test005-modrdn
index 946ad553d9..d7f63a8482 100755
--- a/tests/scripts/test005-modrdn
+++ b/tests/scripts/test005-modrdn
@@ -31,7 +31,7 @@ echo "Testing slapd modrdn operations..."
 
 # Make sure we can search the database
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -73,7 +73,7 @@ fi
 # Ensure the new rdn's can be found
 
 echo "Using ldapsearch to retrieve entries using new rdn (cn=James A Jones III)..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'cn=James A Jones III' | egrep -iv '^createtimestamp:|^modifytimestamp:' \
 	    > $SEARCHOUT 2>&1
 RC=$?
@@ -101,7 +101,7 @@ fi
 
 
 echo "Using ldapsearch to retrieve entries using new rdn (cn=James A Jones II)..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'cn=James A Jones II' | egrep -iv '^createtimestamp:|^modifytimestamp:' \
 	    >  $SEARCHOUT 2>&1
 RC=$?
@@ -131,7 +131,7 @@ fi
 # an attribute.
 
 echo "Using ldapsearch to retrieve entries using removed rdn (cn=James A Jones 2)..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'cn=James A Jones 2' | egrep -iv '^createtimestamp:|^modifytimestamp:' \
 	    > /dev/null 2>&1
 RC=$?
@@ -142,7 +142,7 @@ if test $RC = 0 ; then
 fi
 
 echo "Using ldapsearch to retrieve all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'objectClass=*' > $SEARCHOUT 2>&1
 RC=$?
 if test $RC != 0 ; then
@@ -182,7 +182,7 @@ fi
 # present
 
 echo "Using ldapsearch to retrieve entries using new rdn (cn=James A Jones 1)..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'cn=James A Jones 1' | egrep -iv '^createtimestamp:|^modifytimestamp:' \
 	    >  $SEARCHOUT 2>&1
 RC=$?
diff --git a/tests/scripts/test006-acls b/tests/scripts/test006-acls
index bdcf890aac..6ebc5755ef 100755
--- a/tests/scripts/test006-acls
+++ b/tests/scripts/test006-acls
@@ -30,7 +30,7 @@ PID=$!
 
 echo "Testing slapd access control..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -52,10 +52,10 @@ cat /dev/null > $SEARCHOUT
 # give us nothing if we're not bound, and should return all attributes
 # if we're bound as anyone under UM.
 #
-$LDAPSEARCH -L -b "$JAJDN" -h localhost -p $PORT "objectclass=*" \
+$LDAPSEARCH -b "$JAJDN" -h localhost -p $PORT "objectclass=*" \
 	>> $SEARCHOUT 2>&1
 
-$LDAPSEARCH -L -b "$JAJDN" -h localhost -p $PORT \
+$LDAPSEARCH -b "$JAJDN" -h localhost -p $PORT \
 	-D "$BABSDN" -w bjensen "objectclass=*"  >> $SEARCHOUT 2>&1
 
 
@@ -105,7 +105,7 @@ telephonenumber: +1 810 555 1212
 EOMODS4
 
 echo "Using ldapsearch to retrieve all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	    'objectClass=*' | . $SRCDIR/scripts/acfilter.sh >> $SEARCHOUT 2>&1
 RC=$?
 kill -HUP $PID
diff --git a/tests/scripts/test007-replication b/tests/scripts/test007-replication
index 9521a7ba13..53d71b2775 100755
--- a/tests/scripts/test007-replication
+++ b/tests/scripts/test007-replication
@@ -43,7 +43,7 @@ SLAVEPID=$!
 
 echo "Using ldapsearch to check that master slapd is running..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -54,7 +54,7 @@ done
 
 echo "Using ldapsearch to check that slave slapd is running..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -147,7 +147,7 @@ echo "Waiting 15 seconds for slurpd to send changes..."
 sleep 15
 
 echo "Using ldapsearch to read all the entries from the master..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 	'objectclass=*' > $MASTEROUT 2>&1
 
 if test $RC != 0 ; then
@@ -157,7 +157,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Using ldapsearch to read all the entries from the slave..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'objectclass=*' > $SLAVEOUT 2>&1
 
 if test $RC != 0 ; then
diff --git a/tests/scripts/test008-concurrency b/tests/scripts/test008-concurrency
index 5b8958fc82..2ba50426d8 100755
--- a/tests/scripts/test008-concurrency
+++ b/tests/scripts/test008-concurrency
@@ -36,7 +36,7 @@ PID=$!
 
 echo "Using ldapsearch to check that slapd is running..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -55,7 +55,7 @@ if test $RC != 0 ; then
 fi 
 
 echo "Using ldapsearch to retrieve all the entries..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $PORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $PORT \
 			'objectClass=*' > $SEARCHOUT 2>&1
 RC=$?
 
diff --git a/tests/scripts/test009-referral b/tests/scripts/test009-referral
index 829271c9f6..c4c5bbf83f 100755
--- a/tests/scripts/test009-referral
+++ b/tests/scripts/test009-referral
@@ -39,7 +39,7 @@ SLAVEPID=$!
 
 echo "Testing for master slapd..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $PORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $PORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -56,7 +56,7 @@ fi
 
 echo "Testing for slave slapd..."
 for i in 0 1 2 3 4 5; do
-	$LDAPSEARCH -L -s base -b "$MONITOR" -h localhost -p $SLAVEPORT \
+	$LDAPSEARCH -s base -b "$MONITOR" -h localhost -p $SLAVEPORT \
 		'objectclass=*' > /dev/null 2>&1
 	RC=$?
 	if test $RC = 1 ; then
@@ -68,7 +68,7 @@ done
 cat /dev/null > $SEARCHOUT
 
 echo "Testing exact searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'sn=jensen' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -77,7 +77,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing OR searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'(|(objectclass=rfc822mailgroup)(sn=jones))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -86,7 +86,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing AND matching and ends-with searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'(&(objectclass=rfc822mailgroup)(cn=A*))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"
@@ -95,7 +95,7 @@ if test $RC != 0 ; then
 fi
 
 echo "Testing NOT searching..."
-$LDAPSEARCH -L -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
+$LDAPSEARCH -S "" -b "$BASEDN" -h localhost -p $SLAVEPORT \
 	'(!(objectclass=person))' >> $SEARCHOUT 2>&1
 if test $RC != 0 ; then
 	echo "ldapsearch failed!"