Don't send the dereference OID unless client asked for extended DNs

diff --git a/source4/dsdb/samdb/ldb_modules/extended_dn_out.c b/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
index deca9689174b308bbb9631940645a8e7d50d49c4..9c178f276078c6cd1915d04ee2424157153b9be7 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
+++ b/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
@@ -376,6 +376,10 @@ static int extended_dn_out_search(struct ldb_module *module, struct ldb_request
        
        const_attrs = req->op.search.attrs;
 
+       /* We only need to do special processing if we were asked for
+        * the extended DN, or we are 'store DN+GUID+SID'
+        * (!dereference) mode.  (This is the normal mode for LDB on
+        * tdb). */
        if (control || (storage_format_control && private && !private->dereference)) {
                ac->inject = true;
                if (extended_ctrl) {
@@ -445,9 +449,10 @@ static int extended_dn_out_search(struct ldb_module *module, struct ldb_request
                }
        }
 
-       if (private && private->dereference && private->dereference_control) {
-
-               /* Add in dereference control */
+       /* Add in dereference control, if we were asked to, we are
+        * using the 'dereference' mode (such as with an OpenLDAP
+        * backend) and have the control prepared */
+       if (control && private && private->dereference && private->dereference_control) {
                ret = ldb_request_add_control(down_req,
                                              DSDB_OPENLDAP_DEREFERENCE_CONTROL,
                                              false, private->dereference_control);