--- a/management/univention-ldap/conffiles/etc/ldap/slapd.conf.d/31modules	
+++ a/management/univention-ldap/conffiles/etc/ldap/slapd.conf.d/31modules	
@@ -18,3 +18,4 @@ if configRegistry.is_true('ldap/shadowbind', True):
 @!@
 moduleload	constraint.so
 moduleload	accesslog.so
+moduleload	refint.so
--- a/management/univention-ldap/conffiles/etc/ldap/slapd.conf.d/40univention-ldap-server_database	
+++ a/management/univention-ldap/conffiles/etc/ldap/slapd.conf.d/40univention-ldap-server_database	
@@ -117,3 +117,6 @@ add_content_acl on
 overlay constraint
 constraint_attribute uidNumber regex ^[^0]+[0-9]*$
 constraint_attribute gidNumber regex ^[^0]+[0-9]*$
+
+overlay refint
+refint_attributes secretary