In the LDAP back end, return aliases when the CLIENT_REFERRALS_ONLY flag isn't set (abusing that flag to recognize a client name lookup). Based on a patch from Luke Howard. https://github.com/krb5/krb5/commit/3e76c60f9f08b5f9f78d8e266d0109c85405c06f Commit By: ghudson Revision: 22708 Changed Files: U trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c