Okay, found a problem. The code chases referrals in the form: ldap://localhost:9009/ using an empty DN. This is incorrect. It should be treated the same as: ldap://localhost:9009 as, per RFC 2254, they are equivalent.