LDAP referrals are bound using "<ROOT>" as the binding DN

[conrosebraugh]

If a query returns ldap referrals, pyramid_ldap binds to the referrals using "" as the binding DN (with no password). When it tries querying against these referrals, an error is returned ("proper bind must be made...").

This could be avoided if there was some way to change the protocol version used (ldap referrals are "new" in version 3). Or subsequent connections could use the binding dn used in the first connection

[dataflake]

This issue is invalid. pyramid_ldap doesn't do anything with referrals. There's no code for it. The automatic referral chasing and re-binding happens elsewhere. AFAIK python-ldap does it by default, and it's a python-ldap option to turn off referral chasing. At that point referrals would bubble up to application code as exceptions of type ldap.REFERRAL.