Actually, slapd has supported sasl_setpass for many years...

and proxies them to a remote server.

Note in manual that res parameter should be freed regardless of return value
of ldap_search_ext_s (or friends).

minimal documentation of authid-rewrite* stuff