When searching a Microsoft Active Directory (v. 2008) for addresses using kerberos/sasl bindings, any searches yield 'unknown api error'. I have good kerberos credentials on the machine, and other kerberised ldap elements of the stack (nslcd/ldapsearch) work.

Reproducible: Always

Steps to Reproduce:
1. Configure LDAP address source with GSSAPI/SASL bindings via kaddressbook/settings/ldap server settings
2. From new email dialogue in kmail, select new recipient, 'search directory service', enter any name
3.
Actual Results:  
Search gives an error. Full text (redacted as best I can):

LDAP server returned the error: Unknown API error 
Additional info: 
The LDAP URL was: ldap://ldap.server:389DC=foo,DC=bar,DC=com??sub?%28%26%28%7C%28objectclass%3Dperson%29%28objectclass%3Dgroupofnames%29%28mail%3D%2A%29%29%28%7C%28cn%3D%2Asearchterm%2A%29%28sn%3D%2Asearchterm%2A%29%29%29?!bindname,x-mech=GSS-SPNEGO,x-sasl

Expected Results:  
LDAP search showing results with the name 'searchterm'

This works at home on my openldap server, leading me to believe it's an ldap service interop issue.

Are there steps I can take to debug this? I'm not familiar with C++ but I have good knowledge of the linux stack from a sysadmin perspective.

Note that this used to work on an older KDE (until 4.8 from memory) - I recall that the ldap subsystem was reworked around that time.