Christian Gellweiler writes:
In the ou=people tree are all persons in a given company. They are
organized in groups listed in the ou=groups tree stored as aliases to
the ou=people tree.
Note that this means a search operation inside ou=groups with
LDAP_DEREF_ALWAYS will not make use of indices, since it much follow
each alias to examine the aliased entry, and indexing is not done
"through" aliases.
At least that was the situation some years ago when we got rid of our
aliases, and finally got rid of the complaints about timeouts from
people whose clients searched with LDAP_DEREF_ALWAYS.