ITS#6699

CHANGES

@@ -30,6 +30,7 @@ OpenLDAP 2.4.24 Engineering
 	Fixed slapd-bdb error propogation to overlays (ITS#6633)
 	Fixed slapd-ldap debug output of timeout (ITS#6721)
 	Fixed slapd-ldap DNSSRV referral chaining (ITS#6565)
+	Fixed slapd-ldap chaining with onelevel scope (ITS#6699)
 	Fixed slapd-ldap with SASL/EXTERNAL (ITS#6642)
 	Fixed slapd-ndb to honor rootpw setting (ITS#6661)
 	Fixed slapd-meta anon retry with failed auth method (ITS#6643)

servers/slapd/back-ldap/chain.c

@@ -708,7 +708,11 @@ ldap_chain_search(
 
 		} else {
 			/* RFC 4511: if scope is absent, use original */
-			tmp_oq_search.rs_scope = op->ors_scope;
+			/* Section 4.5.3: if scope is onelevel, use base */
+			if ( op->ors_scope == LDAP_SCOPE_ONELEVEL )
+				tmp_oq_search.rs_scope = LDAP_SCOPE_BASE;
+			else
+				tmp_oq_search.rs_scope = op->ors_scope;
 		}
 
 		rc = LDAP_SUCCESS;