diff --git a/servers/slapd/acl.c b/servers/slapd/acl.c
index de9cda67bc..b89921e7bd 100644
--- a/servers/slapd/acl.c
+++ b/servers/slapd/acl.c
@@ -888,7 +888,8 @@ dn_match_cleanup:;
 				at != NULL;
 				at = attrs_find( at->a_next, b->a_dn_at ) )
 			{
-				if( value_find( b->a_dn_at, at->a_vals, &bv ) == 0 ) {
+				if( value_find_ex( b->a_dn_at,
+					SLAP_MR_VALUE_NORMALIZED_MATCH, at->a_vals, &bv ) == 0 ) {
 					/* found it */
 					match = 1;
 					break;
@@ -1801,7 +1802,7 @@ aci_mask(
 			at != NULL;
 			at = attrs_find( at->a_next, ad ) )
 		{
-			if (value_find( ad, at->a_vals, &bv) == 0 ) {
+			if (value_find( ad, SLAP_MR_VALUE_NORMALIZED_MATCH, at->a_vals, &bv) == 0 ) {
 				rc = 1;
 				break;
 			}
diff --git a/servers/slapd/back-bdb/group.c b/servers/slapd/back-bdb/group.c
index ad9b979b5b..c471433445 100644
--- a/servers/slapd/back-bdb/group.c
+++ b/servers/slapd/back-bdb/group.c
@@ -205,7 +205,8 @@ dn2entry_retry:
 		group_oc_name, group_at_name, 0 ); 
 #endif
 
-	if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS ) {
+	if( value_find_ex( group_at, SLAP_MR_VALUE_NORMALIZED_MATCH,
+		attr->a_vals, op_ndn ) != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( BACK_BDB, DETAIL1, 
 			"bdb_group: \"%s\" not in \"%s\": %s\n",
diff --git a/servers/slapd/back-ldap/group.c b/servers/slapd/back-ldap/group.c
index 5581cdfc64..8448e87d8a 100644
--- a/servers/slapd/back-ldap/group.c
+++ b/servers/slapd/back-ldap/group.c
@@ -82,7 +82,8 @@ ldap_back_group(
 			 * attribute has not been required
 			 */
 			if ((attr = attr_find(target->e_attrs, group_at)) != NULL) {
-				if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS  )
+				if( value_find_ex( group_at, SLAP_MR_VALUE_NORMALIZED_MATCH,
+					attr->a_vals, op_ndn ) != LDAP_SUCCESS )
 					return(1);
 				return(0);
 			} /* else: repeat the search */
diff --git a/servers/slapd/back-ldbm/group.c b/servers/slapd/back-ldbm/group.c
index f8d5074bc8..750a66d929 100644
--- a/servers/slapd/back-ldbm/group.c
+++ b/servers/slapd/back-ldbm/group.c
@@ -178,7 +178,8 @@ ldbm_back_group(
 #endif
 
 
-	if( value_find( group_at, attr->a_vals, op_ndn ) != LDAP_SUCCESS ) {
+	if( value_find_ex( group_at, SLAP_MR_VALUE_NORMALIZED_MATCH,
+		attr->a_vals, op_ndn ) != LDAP_SUCCESS ) {
 #ifdef NEW_LOGGING
 		LDAP_LOG( BACK_LDBM, DETAIL1, 
 			"ldbm_back_group: \"%s\" not in \"%s\": %s\n",
diff --git a/servers/slapd/back-meta/group.c b/servers/slapd/back-meta/group.c
index b482847d6a..70a6366ceb 100644
--- a/servers/slapd/back-meta/group.c
+++ b/servers/slapd/back-meta/group.c
@@ -144,8 +144,9 @@ meta_back_group(
 			 */
 			attr = attr_find( target->e_attrs, group_at );
 			if ( attr != NULL ) {
-				rc = value_find( group_at, attr->a_vals, 
-						op_ndn );
+				rc = value_find_ex( group_at,
+					SLAP_MR_VALUE_SYNTAX_CONVERTED_MATCH,
+					attr->a_vals, op_ndn );
 				if ( rc != LDAP_SUCCESS ) {
 					return 1;
 				}
diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h
index b15cd8864f..4aae99a7f0 100644
--- a/servers/slapd/slap.h
+++ b/servers/slapd/slap.h
@@ -439,6 +439,7 @@ typedef struct slap_matching_rule {
 #define SLAP_MR_ASSERTION_SYNTAX_MATCH			0x0000U
 #define SLAP_MR_VALUE_SYNTAX_MATCH				0x0001U
 #define SLAP_MR_VALUE_SYNTAX_CONVERTED_MATCH	0x0003U
+#define SLAP_MR_VALUE_NORMALIZED_MATCH	0x0004U
 
 #define SLAP_IS_MR_ASSERTION_SYNTAX_MATCH( usage ) \
 	(!((usage) & SLAP_MR_VALUE_SYNTAX_MATCH))
diff --git a/servers/slapd/value.c b/servers/slapd/value.c
index a232d066e9..a1e081664d 100644
--- a/servers/slapd/value.c
+++ b/servers/slapd/value.c
@@ -391,7 +391,8 @@ int value_find_ex(
 		flags |= SLAP_MR_VALUE_SYNTAX_CONVERTED_MATCH;
 	}
 
-	if( mr->smr_syntax->ssyn_normalize ) {
+	if( !(flags & SLAP_MR_VALUE_NORMALIZED_MATCH) &&
+		mr->smr_syntax->ssyn_normalize ) {
 		struct berval nval_tmp = { 0, NULL };
 
 		rc = mr->smr_syntax->ssyn_normalize(