> Looks to me like the mentioned features have been implemented and this ITS > should be closed. OK? Yes, everything seems to be implemented. Note that chained operations only work for a single hop, since back-ldap does not allow to add proxied authz control when already set. Thanks, p.