Don't attempt to return empty referrals.

diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 79dbe4340d2dd7b06aece8dc7ab274e32f8504a0..d331d657507f59662fb34dd14add9afc6c83fd8c 100644 (file)
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -46,7 +46,14 @@ int passwd_extop(
                } else if( conn->c_authz_backend->be_update_ndn != NULL ) {
                        /* we SHOULD return a referral in this case */
                        *refs = conn->c_authz_backend->be_update_refs;
-                       rc = LDAP_REFERRAL;
+
+                       if( *refs ) {
+                               rc = LDAP_REFERRAL;
+
+                       } else {
+                               rc = LDAP_UNWILLING_TO_PERFORM;
+                               *text = "authorization database is a read-only replica";
+                       }
 
                } else {
                        rc = conn->c_authz_backend->be_extended(