s4:dsdb Make the dereference control critical if input is critical

This helps us ensure that the backend knows about and respects the
dereference control if our caller has asked that the extended DN control
be considered critical.

Andrew Bartlett

1 files changed, 3 insertions, 1 deletions

diff --git a/source4/dsdb/samdb/ldb_modules/extended_dn_out.c b/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
index ba4054a4c3..92ce328eb2 100644
--- a/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
+++ b/source4/dsdb/samdb/ldb_modules/extended_dn_out.c
@@ -549,6 +549,7 @@ static int extended_dn_out_search(struct ldb_module *module, struct ldb_request
 	const char * const *const_attrs;
 	struct ldb_context *ldb = ldb_module_get_ctx(module);
 	int ret;
+	bool critical;
 
 	struct extended_dn_out_private *p = talloc_get_type(ldb_module_get_private(module), struct extended_dn_out_private);
 
@@ -646,6 +647,7 @@ static int extended_dn_out_search(struct ldb_module *module, struct ldb_request
 
 	/* mark extended DN and storage format controls as done */
 	if (control) {
+		critical = control->critical;
 		control->critical = 0;
 	}
 
@@ -659,7 +661,7 @@ static int extended_dn_out_search(struct ldb_module *module, struct ldb_request
 	if (control && p && p->dereference && p->dereference_control) {
 		ret = ldb_request_add_control(down_req,
 					      DSDB_OPENLDAP_DEREFERENCE_CONTROL,
-					      false, p->dereference_control);
+					      critical, p->dereference_control);
 		if (ret != LDB_SUCCESS) {
 			return ret;
 		}