The “Dereference Plugin” is a CAS plugin to be used with an LDAP server. It can only be used with LDAP servers supporting the Dereference Control , namely OpenLDAP.
The dereference plugin is a pre op search plugin, provided by the ldap control of the same name. In essence, this plugin allows CAS server to overcome a typical limitation of SSO systems and return attributes originated not only from the main ldap object of the logged on user, but also from other ldap objects that are referenced by LDAP DN attributes in users' main object.