This means a ldaps connection may drop before any LDAP protocol exchange
occurs (due to expired cert, unrecognized CAs, etc.).
  Change ldap_pvt_tls_connect to copy any TLS error string to ld_error upon
connection failure, otherwise client just sees "can't contact LDAP server."

slapd/connection.c: add flush/delay when SSL_accept fails, to allow any
TLS alerts we generated to propagate back to the client. (Which will then
be picked up by ldap_pvt_tls_connect on the client...)

that called entry_free() on failure. This change would cause a memory leak
from all the other backends. Instead, remove the entry_free calls in these
two backends and let the frontend take care of it for everyone.

distributions define them now.

anyway.

are created detached by default. We need to set the thread attributes in
advance, otherwise pthread_detach will fail.

against Cyrus SASLdb.  Like other cleartext mechanisms,
should be protected from eavesdropping.

SASL to LDAP translation.  plus comments and other minor changes

states.

external store, but not yet tested.  [Intent is to support
both in same server... may not be doable]

and other error handling changes