Digging into postgres sources found the problem. File auth.c in line 1376 does some ldap configuration parse using sscanf with the mask “ldap://%127[^:]:%d/%127[^;];%127[^;];%127s”. The sscanf function reads until it finds a blank space, tab or new line, so if the string contains any blank space after the last ‘:’ everything else is ignored!
