diff --git a/plugin/ldap/src/main/java/org/zstack/ldap/LdapGlobalProperty.java b/plugin/ldap/src/main/java/org/zstack/ldap/LdapGlobalProperty.java
index 1caf8c2de07..5fd78fba8b7 100755
--- a/plugin/ldap/src/main/java/org/zstack/ldap/LdapGlobalProperty.java
+++ b/plugin/ldap/src/main/java/org/zstack/ldap/LdapGlobalProperty.java
@@ -13,4 +13,10 @@ public class LdapGlobalProperty {
 
     @GlobalProperty(name = "Ldap.addServer.readTimeout", defaultValue = "5000")
     public static int LDAP_ADD_SERVER_READ_TIMEOUT;
+
+    @GlobalProperty(name = "Ldap.referral", defaultValue = "follow")
+    public static String LDAP_REFERRAL;
+
+    @GlobalProperty(name = "Ldap.connect.pool", defaultValue = "false")
+    public static boolean LDAP_CONNECT_POOL;
 }
diff --git a/plugin/ldap/src/main/java/org/zstack/ldap/LdapUtil.java b/plugin/ldap/src/main/java/org/zstack/ldap/LdapUtil.java
index 2b4c22d3eda..1f5e1df7cf8 100644
--- a/plugin/ldap/src/main/java/org/zstack/ldap/LdapUtil.java
+++ b/plugin/ldap/src/main/java/org/zstack/ldap/LdapUtil.java
@@ -1,6 +1,7 @@
 package org.zstack.ldap;
 
 import org.apache.commons.lang.StringUtils;
+import org.apache.logging.log4j.util.Strings;
 import org.springframework.ldap.NamingException;
 import org.springframework.ldap.control.PagedResultsDirContextProcessor;
 import org.springframework.ldap.core.DirContextOperations;
@@ -167,8 +168,11 @@ LdapContextSource buildLdapContextSource(LdapServerInventory inv, Map<String, Ob
             }
         }
         ldapContextSource.setCacheEnvironmentProperties(false);
-        ldapContextSource.setPooled(false);
-        ldapContextSource.setReferral("follow");
+        ldapContextSource.setPooled(LdapGlobalProperty.LDAP_CONNECT_POOL);
+
+        if (!Strings.isEmpty(LdapGlobalProperty.LDAP_REFERRAL)) {
+            ldapContextSource.setReferral(LdapGlobalProperty.LDAP_REFERRAL);
+        }
 
         if (baseEnvironmentProperties != null && !baseEnvironmentProperties.isEmpty()) {
             ldapContextSource.setBaseEnvironmentProperties(baseEnvironmentProperties);
diff --git a/test/src/test/groovy/org/zstack/test/unittest/ldap/TestLdapSearchCase.java b/test/src/test/groovy/org/zstack/test/unittest/ldap/TestLdapSearchCase.java
new file mode 100644
index 00000000000..85ba97041e5
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/unittest/ldap/TestLdapSearchCase.java
@@ -0,0 +1,78 @@
+package org.zstack.test.unittest.ldap;
+
+import com.unboundid.ldap.sdk.*;
+import org.junit.ClassRule;
+import org.junit.Test;
+import org.zapodot.junit.ldap.EmbeddedLdapRule;
+import org.zapodot.junit.ldap.EmbeddedLdapRuleBuilder;
+
+import java.util.Arrays;
+
+public class TestLdapSearchCase {
+    public static String DOMAIN_DSN = "dc=example,dc=com";
+
+    static {
+        System.setProperty("com.unboundid.ldap.sdk.debug.enabled", "true");
+        System.setProperty("com.unboundid.ldap.sdk.debug.level", "FINEST");
+        System.setProperty("com.unboundid.ldap.sdk.LDAPConnectionOptions.followReferrals", "true");
+    }
+
+    @ClassRule
+    public static EmbeddedLdapRule embeddedLdapRule = EmbeddedLdapRuleBuilder
+            .newInstance()
+            .usingDomainDsn("dc=example,dc=com")
+            .importingLdifs("users-import.ldif")
+            .bindingToPort(10389)
+            .build();
+
+    @Test
+    public void testLdapWithIgnore() {
+        try (LDAPConnection ldapConnection = embeddedLdapRule.unsharedLdapConnection()) {
+            ldapConnection.getConnectionOptions().setFollowReferrals(false);
+            SearchResult searchResult = ldapConnection.search(
+                    DOMAIN_DSN,
+                    SearchScope.SUB,
+                    "(objectclass=*)");
+
+            System.out.printf("Found %d entries%n", searchResult.getEntryCount());
+            for (SearchResultEntry entry : searchResult.getSearchEntries()) {
+                System.out.println(entry.getDN());
+                for (Attribute attribute : entry.getAttributes()) {
+                    System.out.printf("  %s: %s%n", attribute.getName(), attribute.getValue());
+                }
+            }
+
+            System.out.println("Found referral URLs:" + Arrays.toString(searchResult.getReferralURLs()));
+            assert searchResult.getEntryCount() == 6;
+        } catch (Exception e) {
+            assert false : "Unexpected error during testLdapWithIgnore";
+        }
+    }
+
+    @Test
+    public void testLdapWithReferral() throws LDAPException {
+        try (LDAPConnection ldapConnection = embeddedLdapRule.unsharedLdapConnection()) {
+            ldapConnection.getConnectionOptions().setFollowReferrals(true);
+            SearchResult searchResult = ldapConnection.search(
+                    DOMAIN_DSN,
+                    SearchScope.SUB,
+                    "(objectclass=*)");
+
+            System.out.printf("Found %d entries%n", searchResult.getEntryCount());
+            for (SearchResultEntry entry : searchResult.getSearchEntries()) {
+                System.out.println(entry.getDN());
+                for (Attribute attribute : entry.getAttributes()) {
+                    System.out.printf("  %s: %s%n", attribute.getName(), attribute.getValue());
+                }
+            }
+
+            System.out.println("Found referral URLs:" + Arrays.toString(searchResult.getReferralURLs()));
+            assert searchResult.getReferenceCount() == 1024;
+        } catch (StackOverflowError e) {
+            System.out.print("stack over flow expected");
+            return;
+        }
+
+        assert false : "Unexpected here";
+    }
+}
diff --git a/test/src/test/resources/users-import.ldif b/test/src/test/resources/users-import.ldif
index a9194dd0d2a..4951536cb42 100644
--- a/test/src/test/resources/users-import.ldif
+++ b/test/src/test/resources/users-import.ldif
@@ -42,4 +42,11 @@ objectClass: inetOrgPerson
 cn: John Steinbeck
 sn: Steinbeck
 uid: jsteinbeck
-userPassword: password
\ No newline at end of file
+userPassword: password
+
+dn: ou=referral test,dc=example,dc=com
+objectClass: extensibleObject
+objectClass: referral
+objectClass: top
+objectClass: person
+ref: ldap://localhost:10389/dc=example,dc=com
\ No newline at end of file