Timo, you are so right!
Today in the morning I checked the libs from the dovecot-auth binary and see the following output
# ldd /usr/local/libexec/dovecot/dovecot-auth libcrypt_d.so.1 => /usr/lib/libcrypt_d.so.1 libpam.so.1 => /usr/lib/libpam.so.1 libldap.so.5 => /usr/lib/libldap.so.5 ...
The binary was linked with the Solaris ldap-library, not with the openldap-library. In a first test I move the Solaris library and after a rebuild everything is fine, the dovecot-auth gets 0.0% cpu time and ldd shows me the right openldap lib. After a copyback of the Solaris lib and a dovecot recompile, the process gets again 100% cpu.
In my $LD_LIBRARY_PATH /usr/lib is behind /usr/local/lib (for openldap), although dovecot-auth was linked with the Solaris lib. The way that works for me is the following LDFLAGS directive to the configure command, because the --with-ldap flag has no directory option:
LDFLAGS=-L"/usr/local/BerkeleyDB/lib -L/usr/local/lib /usr/local/lib/libldap-2.4.so.2"
Is there a smarter way to link with the right lib and ignore the solaris one?
Mark