Let me refer to the following case, hoping that this will help to spot all possible side effects resulted from the usage of empty suffixes.
Using a configuration like the one below, searches for attr=hasSubordinates against the ldap backend as 'uid=<uid>,ou=People', fail because searchDN is rewritten to: [rw] searchDN: "ou=People" -> "ou=People,dc=contacts,dc=uoa,dc=gr" database bdb suffix "dc=contacts,dc=foo,dc=bar" ..... ..... database ldap suffix "ou=People" overlay rwm rwm-suffixmassage "ou=People,dc=foo,dc=bar" uri "ldap://server.foo.bar"; ...... ...... database relay suffix "" relay "dc=contacts,dc=foo,dc=bar" massage Nikos
