Authentication Problem Regarding aliasedObjectName

[Christian Felsing <pug@felsing.net>]

Hello,

my installation has two OUs, one contains real inetOrgPerson objects, 
other one contains aliases to the first OU. First OU contains DNs which 
are not acceptable to a specific application (pls. don't ask me why) so 
2nd OU was introduced with DNs which are acceptable to that application. 
Unfortunally, authentication to an alias seems to be not possible, 
because that application is not able to do dereferencing.

OU1:

# 007@x86.be, freemail, my.net
dn: uid=007@example.com,ou=mail,dc=my,dc=net
objectClass: top
objectClass: inetOrgPerson
uid: 007@x86.be
cn: testuser

Application does not like DN "uid=007@example.com,ou=mail,dc=my,dc=net" 
but other applications depend on it. So following was introduced:

OU2:

# testuser, members, my.net
dn: uid=testuser,ou=members,dc=my,dc=net
objectClass: top
objectClass: alias
objectClass: extensibleObject
uid: testuser
aliasedObjectName: uid=007@example.com,ou=mail,dc=my,dc=net

That application would accept DN "uid=testuser,ou=members,dc=my,dc=net", 
but is not able to dereference that to 
"uid=007@example.com,ou=mail,dc=my,dc=net" :-(

Is there a way to let a proxy do dereferencing an aliasedObjectName to 
"real" object, so that application may be able to authenticate to that 
proxy ?

best regards
Christian