Some SASL mechanisms, such as those for KerberosV5, requires that
the IO stream subsequent to authentication be "wrapped" inside
a security layer for possible integrity and privacy protections.
Currently, SASL support is done external to the main LDAP provider.
When the IO streams need to be updated, SASL needs to update
the existing IO streams of the LDAP provider. Although it can update
the IO streams now, it cannot redirect the LDAP provider's reader
thread to use the new input stream (the reader thread is blocked on the
"read").

Similarly, StartTLS is an extension that needs to update the
LDAP provider's IO streams. It has the same problem as SASL.