LDAPReferences based on dynamic attribute need to fetch all the object attributes because the attributes matching the LDAP filter may not be part of the attributes mapped by the directory configuration.
This is a regression and it was introduced by NXP-18078 when trying to minimize the LDAP trafic (not returning unneeded attributes).
A partial rollback is needed: the fetchAllAttributes in LDAPSession#getLdapEntry(String, boolean) argument should be always false, except when resolving the references with a dynamic attributes. In all other cases, the attributes mapping in the directory configuration are enough.