Search problem on AD about openvpn-auth-ldap HOT 6 OPEN

I've looked at the code and it's in searchWithFilter() in LFLDAPConnection.m 
calling
openldap's function ldap_search_ext_s()

The weird thing is, if I use openldap's ldapsearch(1), it work:

$ ldapsearch -h $ad_ip -D 'CN=ldapbrowser,CN=Users,dc=XXX,dc=YYY' -W -x -b
'dc=XXX,dc=YYY' 'samaccountname=bruno.clermont'
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <dc=XXX,dc=YYY> with scope subtree
# filter: samaccountname=bruno.clermont
# requesting: ALL
#

# Bruno Clermont, Users, YYY, XXX, ZZZ
dn: CN=Bruno Clermont,OU=Users,OU=YYY,DC=XXX,DC=ZZZ
[and the content of the entry]

I found the problem:

ldapsearch(1) (code at
http://www.openldap.org/devel/cvsweb.cgi/~checkout~/clients/tools/ldapsearch.c) 
is
using ldap_search_ext(3) which is asynchronous while this plugin use the 
synchronous
ldap_search_ext_s(3).

Because of denied access by the AD server, ldap_search_ext_s(3) catch a
LDAP_OPERATIONS_ERROR while ldap_search_ext_s(3) get result and ignored those
sub-tree operations error.

The only possible bug fix for this issue is to move to the asynchronous search.

For me, I'll just ignore LDAP_OPERATIONS_ERROR.

This calls for supporting search across multiple trees.

Any patch for this? Without this feature its almost unusable for us.

You can use this SearchFilter for BaseDN "DC=XXX,DC=YYY":
SearchFilter "(&(objectCategory=person)(sAMAccountName=%u))"

or restrict to users from VPN group:
SearchFilter 
"(&(objectCategory=person)(sAMAccountName=%u)(memberOf=CN=VPN,OU=GGG,DC=XXX,DC=Y
YY))"