Turns out our LDAP filter is not reentrant - but it is easy to fix - so this patch should make it work. It is needed because filter evaluations can call out to keys being compared which might in turn use the given thread to evaluate their own filter.
felix/trunk/framework/src/main/java/org/apache/felix/framework/FilterImpl.java