diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index de9cda67bc4343afdb164b89394f242ffe84df70..b89921e7bd52ab77a44854ca6b53b211f4ad882e 100644
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -888,7 +888,8 @@ dn_match_cleanup:;
 				at != NULL;
 				at = attrs_find( at->a_next, b->a_dn_at ) )
 			{
-				if( value_find( b->a_dn_at, at->a_vals, &bv ) == 0 ) {
+				if( value_find_ex( b->a_dn_at,
+					SLAP_MR_VALUE_NORMALIZED_MATCH, at->a_vals, &bv ) == 0 ) {
 					/* found it */
 					match = 1;
 					break;
@@ -1801,7 +1802,7 @@ aci_mask(
 			at != NULL;
 			at = attrs_find( at->a_next, ad ) )
 		{
-			if (value_find( ad, at->a_vals, &bv) == 0 ) {
+			if (value_find( ad, SLAP_MR_VALUE_NORMALIZED_MATCH, at->a_vals, &bv) == 0 ) {
 				rc = 1;
 				break;
 			}
diff --git a/servers/slapd/back-bdb/group.c b/servers/slapd/back-bdb/group.c
index ad9b979b5b6e84498f5377514c29fb6d31a9e137..c471433445bbd7f7c3cf23d388349e74e52e2fe9 100644
--- a/servers/slapd/back-bdb/group.c
+++ b/servers/slapd/back-bdb/group.c
@@ -205,7 +205,8 @@ dn2entry_retry:
 		group_oc_name, group_at_name, 0 ); 
 #endif
 
-	if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS ) {
+	if( value_find_ex( group_at, SLAP_MR_VALUE_NORMALIZED_MATCH,
+		attr->a_vals, op_ndn ) != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( BACK_BDB, DETAIL1, 
 			"bdb_group: \"%s\" not in \"%s\": %s\n",
diff --git a/servers/slapd/back-ldap/group.c b/servers/slapd/back-ldap/group.c
index 5581cdfc642a30418a4f41da49316140748ce830..8448e87d8aabc3ec06b52b34bb517b3ee2e1d484 100644
--- a/servers/slapd/back-ldap/group.c
+++ b/servers/slapd/back-ldap/group.c
@@ -82,7 +82,8 @@ ldap_back_group(
 			 * attribute has not been required
 			 */
 			if ((attr = attr_find(target->e_attrs, group_at)) != NULL) {
-				if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS  )
+				if( value_find_ex( group_at, SLAP_MR_VALUE_NORMALIZED_MATCH,
+					attr->a_vals, op_ndn ) != LDAP_SUCCESS )
 					return(1);
 				return(0);
 			} /* else: repeat the search */
diff --git a/servers/slapd/back-ldbm/group.c b/servers/slapd/back-ldbm/group.c
index f8d5074bc8ff5dba34a8977ffe077b7a5fe9f6f3..750a66d929047144101067217d97fe180e71d7a2 100644
--- a/servers/slapd/back-ldbm/group.c
+++ b/servers/slapd/back-ldbm/group.c
@@ -178,7 +178,8 @@ ldbm_back_group(
 #endif
 
 
-	if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS ) {
+	if( value_find_ex( group_at, SLAP_MR_VALUE_NORMALIZED_MATCH,
+		attr->a_vals, op_ndn ) != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( BACK_LDBM, DETAIL1, 
 			"ldbm_back_group: \"%s\" not in \"%s\": %s\n",
diff --git a/servers/slapd/back-meta/group.c b/servers/slapd/back-meta/group.c
index b482847d6a18f7370b3e30f7303a2d33e4305898..70a6366cebb6ba13468423358fffcbddbbe00488 100644
--- a/servers/slapd/back-meta/group.c
+++ b/servers/slapd/back-meta/group.c
@@ -144,8 +144,9 @@ meta_back_group(
 			 */
 			attr = attr_find( target->e_attrs, group_at );
 			if ( attr != NULL ) {
-				rc = value_find( group_at, attr->a_vals, 
-						op_ndn );
+				rc = value_find_ex( group_at,
+					SLAP_MR_VALUE_SYNTAX_CONVERTED_MATCH,
+					attr->a_vals, op_ndn );
 				if ( rc != LDAP_SUCCESS ) {
 					return 1;
 				}
diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index b15cd8864fdbf3131bbf82c5b065d055c4eef2e0..4aae99a7f0264d565cc5a1b6f178c2493fb814e7 100644
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -439,6 +439,7 @@ typedef struct slap_matching_rule {
 #define SLAP_MR_ASSERTION_SYNTAX_MATCH			0x0000U
 #define SLAP_MR_VALUE_SYNTAX_MATCH				0x0001U
 #define SLAP_MR_VALUE_SYNTAX_CONVERTED_MATCH	0x0003U
+#define SLAP_MR_VALUE_NORMALIZED_MATCH	0x0004U
 
 #define SLAP_IS_MR_ASSERTION_SYNTAX_MATCH( usage ) \
 	(!((usage) & SLAP_MR_VALUE_SYNTAX_MATCH))
diff --git a/servers/slapd/value.c b/servers/slapd/value.c
index a232d066e98c4c9ae3346bb6fda8ae57bbd8741c..a1e081664d1d40f043fc7f1d652bf7c1cc186b08 100644
--- a/servers/slapd/value.c
+++ b/servers/slapd/value.c
@@ -391,7 +391,8 @@ int value_find_ex(
 		flags |= SLAP_MR_VALUE_SYNTAX_CONVERTED_MATCH;
 	}
 
-	if( mr->smr_syntax->ssyn_normalize ) {
+	if( !(flags & SLAP_MR_VALUE_NORMALIZED_MATCH) &&
+		mr->smr_syntax->ssyn_normalize ) {
 		struct berval nval_tmp = { 0, NULL };
 
 		rc = mr->smr_syntax->ssyn_normalize(