diff --git a/servers/slapd/controls.c b/servers/slapd/controls.c
index 8840f35ad185d6766ac4c27ac76f91cd3dc0af9a..838cc947ab179d8434f36ce55a87ada9b5ef904f 100644
--- a/servers/slapd/controls.c
+++ b/servers/slapd/controls.c
@@ -765,7 +765,8 @@ static int parseProxyAuthz (
 	rc = slap_sasl_getdn( op->o_conn, op, &ctrl->ldctl_value,
 			NULL, &dn, SLAP_GETDN_AUTHZID );
 
-	if( rc != LDAP_SUCCESS || !dn.bv_len ) {
+	/* FIXME: empty DN in proxyAuthz control should be legal... */
+	if( rc != LDAP_SUCCESS /* || !dn.bv_len */ ) {
 		if ( dn.bv_val ) {
 			ch_free( dn.bv_val );
 		}