can solaris9 query netgroups in an OpenLDAP server?

["Brian K. Jones" <jonesy@CS.Princeton.EDU>]

Hi, 

To be more specific, I have an issue with getting this to work. I've seen 
others via google with the same issue, but I have yet to see a solution that 
makes sense. I'm using a newly installed solaris 9 test box (fully patched 
via jumpstart, by the way), with the solaris native ldap client binaries and 
libs. I've installed nothing on this box from source. 

Basically, I'd like to use "compat" mode on solaris, with a "passwd_compat: 
ldap" line in /etc/nsswitch.conf. It only partly works: I can put a "+@" line 
in /etc/passwd, put the right stuff in /etc/nsswitch.conf, and run "getent 
passwd", and all of the proper entries are returned as one would expect. 
Perfect. 

Unfortunately, the minute you pass in a filter, you're sunk. ie "getent passwd 
jonesy" returns nothing, and on the ldap server side, you get stuff like 
this:

May 10 15:49:36 ldap slapd[13909]: get_filter: unknown filter type=129
May 10 15:49:36 ldap slapd[13909]: get_filter: unknown filter type=130
May 10 15:49:36 ldap slapd[13909]: conn=184 op=1 SRCH 
base="ou=Netgroup,dc=my,dc=domain" scope=2 
filter="(&(objectClass=nisNetgroup)(?=undefined)(?=undefined)(?=undefined)"

Does anyone have this working? (Symas employees are exempt from answering that 
one)

Can anyone tell me what solaris is asking for here that the server doesn't 
understand? 

Any pointers greatly appreciated. 
brian.