Auth_with_ldap currently prevents the use of an empty base due to the presence of my $base = $ldap->{base} or die ldapserver_error('base'); An AD Global Catalog search will automatically query all domains in a forest if a blank base is specified, but otherwise limits the search to the domain matching the base. Not being able to specify an empty base makes things difficult if the forest contains disjoint domains that cannot be combined into a single search base. (Uncertain how this interacts with the work on bug 8993, but being able to use the forest wide Global Catalog searches removes a lot of the contortions needed to direct requests to the correct host responsible for a domain.)