merges from openldap - upstream