diff --git a/servers/slapd/sasl.c b/servers/slapd/sasl.c
index f42a13de13..a5362fc737 100644
--- a/servers/slapd/sasl.c
+++ b/servers/slapd/sasl.c
@@ -306,6 +306,8 @@ slap_sasl_checkpass(
 	cred.bv_val = (char *)pass;
 	cred.bv_len = passlen;
 
+	/* XXX do we need to check sasldb as well? */
+
 	/* XXX can we do both steps at once? */
 	rc = slap_sasl_getdn( conn, (char *)username, NULL, &dn,
 		FLAG_GETDN_AUTHCID | FLAG_GETDN_FINAL );