Comment 3 for bug 1733836

A change like that really should be tackled at the lowest level, and not ad-hoc by each of the consumers. If openldap client libraries support it, the python libraries should as well. But that is an argument for the python-ldap team. I'm not against enabling this for Keystone if you want to go ahead an write the code.

I think this would call for a spec, though, to walk through the design decisions.