diff --git a/contrib/slapd-modules/mqtt/Makefile b/contrib/slapd-modules/mqtt/Makefile
new file mode 100644
index 0000000..2cb4db7
--- /dev/null
+++ b/contrib/slapd-modules/mqtt/Makefile
@@ -0,0 +1,45 @@
+# $OpenLDAP$
+
+LDAP_SRC = ../../..
+LDAP_BUILD = ../../..
+LDAP_INC = -I$(LDAP_BUILD)/include -I$(LDAP_SRC)/include -I$(LDAP_SRC)/servers/slapd
+LDAP_LIB = $(LDAP_BUILD)/libraries/libldap_r/libldap_r.la \
+	$(LDAP_BUILD)/libraries/liblber/liblber.la
+
+LIBTOOL = $(LDAP_BUILD)/libtool
+CC = gcc
+OPT = -g -O2 -Wall
+DEFS = 
+INCS = $(LDAP_INC)
+LIBS = $(LDAP_LIB) -lmosquitto
+
+PROGRAMS = mqtt.la
+LTVER = 0:0:0
+
+prefix=/usr/local
+exec_prefix=$(prefix)
+ldap_subdir=/openldap
+
+libdir=$(exec_prefix)/lib
+libexecdir=$(exec_prefix)/libexec
+moduledir = $(libdir)$(ldap_subdir)
+
+.SUFFIXES: .c .o .lo
+
+.c.lo:
+	$(LIBTOOL) --mode=compile $(CC) $(OPT) $(DEFS) $(INCS) -c $<
+
+all: $(PROGRAMS)
+
+mqtt.la: mqtt.lo
+	$(LIBTOOL) --mode=link $(CC) $(OPT) -version-info $(LTVER) \
+	-rpath $(moduledir) -module -o $@ $? $(LIBS)
+
+clean:
+	rm -rf *.o *.lo *.la .libs
+
+install: $(PROGRAMS)
+	mkdir -p $(DESTDIR)$(moduledir)
+	for p in $(PROGRAMS) ; do \
+		$(LIBTOOL) --mode=install cp $$p $(DESTDIR)$(moduledir) ; \
+	done
diff --git a/contrib/slapd-modules/mqtt/mqtt.c b/contrib/slapd-modules/mqtt/mqtt.c
new file mode 100644
index 0000000..b3a0a31
--- /dev/null
+++ b/contrib/slapd-modules/mqtt/mqtt.c
@@ -0,0 +1,389 @@
+/* $OpenLDAP$ */
+/* This work is part of OpenLDAP Software <http://www.openldap.org/>.
+ *
+ * Copyright 2014 Timo Teräs <timo.teras@iki.fi>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted only as authorized by the OpenLDAP
+ * Public License.
+ *
+ * A copy of this license is available in file LICENSE in the
+ * top-level directory of the distribution or, alternatively, at
+ * http://www.OpenLDAP.org/license.html.
+ */
+/* mqtt-overlay
+ *
+ * This is an OpenLDAP overlay that... */
+
+#include <mosquitto.h>
+#include <unistd.h>
+
+#include "portable.h" 
+#include "slap.h"
+#include "config.h"
+
+typedef struct mqtt_notify_t {
+	struct mqtt_notify_t	*next;
+	char			*topic;
+	char			*dn_group_str;
+	char			*oc_group_str;
+	char			*str_member;
+
+	struct berval		ndn_group;
+	ObjectClass		*oc_group;
+	AttributeDescription	*ad_member;
+	int			notify_pending;
+} mqtt_notify_t;
+
+typedef struct mqtt_t {
+	struct mosquitto *mq;
+	int port;
+	char *hostname, *username, *password;
+	mqtt_notify_t *notify_map;
+} mqtt_t;
+
+static ConfigDriver mqtt_config_notify;
+
+static ConfigTable mqttcfg[] = {
+	{ "mqtt-hostname", "hostname", 2, 2, 0,
+		ARG_STRING|ARG_OFFSET, (void *)offsetof(mqtt_t, hostname),
+		"( OLcfgCtAt:5.1 NAME 'olcMqttHostname' "
+		"DESC 'Hostname of MQTT broker' "
+		"SYNTAX OMsDirectoryString SINGLE-VALUE )",
+		NULL, NULL },
+	{ "mqtt-port", "port", 2, 2, 0,
+		ARG_INT|ARG_OFFSET, (void *)offsetof(mqtt_t, port),
+		"( OLcfgCtAt:5.2 NAME 'olcMqttPort' "
+		"DESC 'Port of MQTT broker' "
+		"SYNTAX OMsInteger SINGLE-VALUE )",
+		NULL, NULL },
+	{ "mqtt-username", "username", 2, 2, 0,
+		ARG_STRING|ARG_OFFSET, (void *)offsetof(mqtt_t, username),
+		"( OLcfgCtAt:5.3 NAME 'olcMqttUsername' "
+		"DESC 'Username for MQTT broker' "
+		"SYNTAX OMsDirectoryString SINGLE-VALUE )",
+		NULL, NULL },
+	{ "mqtt-password", "password", 2, 2, 0,
+		ARG_STRING|ARG_OFFSET, (void *)offsetof(mqtt_t, password),
+		"( OLcfgCtAt:5.4 NAME 'olcMqttPassword' "
+		"DESC 'Password for MQTT broker' "
+		"SYNTAX OMsDirectoryString SINGLE-VALUE )",
+		NULL, NULL },
+	{ "mqtt-notify-password", "topic> <group-dn> <group-oc> <member-ad", 2, 5, 0,
+		ARG_MAGIC, mqtt_config_notify,
+		"( OLcfgCtAt:5.5 NAME 'olcMqttNotifyPassword' "
+		"DESC 'Notify password change on <topic>, optionally checking that the object is in the specified group.'"
+		"SYNTAX OMsDirectoryString X-ORDERED 'VALUES' )",
+		NULL, NULL },
+	{ NULL, NULL, 0, 0, 0, ARG_IGNORED }
+};
+
+static ConfigOCs mqttocs[] = {
+	{ "( OLcfgCtOc:5.1 "
+	  "NAME 'olcMqttConfig' "
+	  "DESC 'MQTT configuration' "
+	  "SUP olcOverlayConfig "
+	  "MAY ( "
+		"olcMqttHostname "
+		"$ olcMqttPort"
+		"$ olcMqttUsername"
+		"$ olcMqttPassword"
+		"$ olcMqttNotifyPassword"
+	  " ) )",
+	  Cft_Overlay, mqttcfg },
+
+	{ NULL, 0, NULL }
+};
+
+static int mqtt_init(BackendInfo *bi)
+{
+	return mosquitto_lib_init();
+}
+
+static int mqtt_destroy(BackendInfo *bi)
+{
+	return mosquitto_lib_cleanup();
+}
+
+static const char *ca_arg(ConfigArgs *c, int n)
+{
+	return (c->argc <= n) ? NULL : c->argv[n];
+}
+
+static void free_notify(mqtt_notify_t *n)
+{
+	ch_free(n->topic);
+	ch_free(n->oc_group_str);
+	ch_free(n->str_member);
+	ch_free(n->dn_group_str);
+	if (!BER_BVISNULL(&n->ndn_group))
+		ber_memfree(n->ndn_group.bv_val);
+	ch_free(n);
+}
+
+static void free_all_notifies(mqtt_t *mqtt)
+{
+	mqtt_notify_t *n, *next;
+
+	for (n = mqtt->notify_map; n; n = next) {
+		next = n->next;
+		free_notify(n);
+	}
+	mqtt->notify_map = NULL;
+}
+
+static int mqtt_config_notify(ConfigArgs *c)
+{
+	slap_overinst *on = (slap_overinst *)c->bi;
+	mqtt_t *mqtt = (mqtt_t *) on->on_bi.bi_private;
+	mqtt_notify_t *n, **pprev;
+	const char *text = NULL;
+	struct berval bv = BER_BVNULL, ndn = BER_BVNULL;
+	int rc, i;
+
+	switch (c->op) {
+	case SLAP_CONFIG_EMIT:
+		for (i = 0, n = mqtt->notify_map; n; n = n->next, i++) {
+			char *ptr = c->cr_msg, *end = &c->cr_msg[sizeof(c->cr_msg)-1];
+
+			ptr += snprintf(ptr, end-ptr, SLAP_X_ORDERED_FMT "%s", i, n->topic);
+			if (n->dn_group_str)
+				ptr += snprintf(ptr, end-ptr, " \"%s\"", n->dn_group_str);
+			if (n->oc_group_str)
+				ptr += snprintf(ptr, end-ptr, " \"%s\"", n->oc_group_str);
+			if (n->str_member)
+				ptr += snprintf(ptr, end-ptr, " \"%s\"", n->str_member);
+
+			bv.bv_val = c->cr_msg;
+			bv.bv_len = ptr - bv.bv_val;
+			value_add_one(&c->rvalue_vals, &bv);
+		}
+		return 0;
+	case LDAP_MOD_DELETE:
+		if (c->valx < 0) {
+			free_all_notifies(mqtt);
+		} else {
+			pprev = &mqtt->notify_map;
+			n = mqtt->notify_map;
+			for (i = 0; i < c->valx; i++) {
+				pprev = &n->next;
+				n = n->next;
+			}
+			*pprev = n->next;
+			free_notify(n);
+		}
+		return 0;
+	}
+
+	const char *groupdn = ca_arg(c, 2);
+	const char *oc_name = ca_arg(c, 3);
+	const char *ad_name = ca_arg(c, 4);
+	ObjectClass *oc = NULL;
+	AttributeDescription *ad = NULL;
+
+	if (groupdn) {
+		oc = oc_find(oc_name ?: SLAPD_GROUP_CLASS);
+		if (oc == NULL) {
+			Debug(LDAP_DEBUG_ANY, "mqtt_db_open: unable to find objectClass=\"%s\"\n",
+				oc_name, 0, 0);
+			return 1;
+		}
+
+		rc = slap_str2ad(ad_name ?: SLAPD_GROUP_ATTR, &ad, &text);
+		if (rc != LDAP_SUCCESS) {
+			Debug(LDAP_DEBUG_ANY, "mqtt_db_config_notify: unable to find attribute=\"%s\": %s (%d)\n",
+				ad_name, text, rc);
+			return rc;
+		}
+
+		ber_str2bv(groupdn, 0, 0, &bv);
+		rc = dnNormalize(0, NULL, NULL, &bv, &ndn, NULL);
+		if (rc != LDAP_SUCCESS) {
+			Debug(LDAP_DEBUG_ANY, "mqtt_db_config_notify: DN normalization failed for \"%s\": %d\n",
+				groupdn, rc, 0);
+			return rc;
+		}
+	}
+
+	n = ch_calloc(1, sizeof(*n));
+	n->topic = ch_strdup(c->argv[1]);
+	n->dn_group_str = groupdn ? ch_strdup(groupdn) : NULL;
+	n->oc_group_str = oc_name ? ch_strdup(oc_name) : NULL;
+	n->str_member   = ad_name ? ch_strdup(ad_name) : NULL;
+	n->ndn_group = ndn;
+	n->oc_group = oc;
+	n->ad_member = ad;
+
+	for (pprev = &mqtt->notify_map; *pprev; pprev = &(*pprev)->next);
+	*pprev = n;
+
+	return 0;
+}
+
+static void mqtt_send_notify(mqtt_t *mqtt, mqtt_notify_t *n)
+{
+	Debug(LDAP_DEBUG_TRACE, "mqtt_send_notify: pub on topic '%s'\n", n->topic, 0, 0);
+	n->notify_pending = mosquitto_publish(mqtt->mq, NULL, n->topic, 0, NULL, 1, true) == MOSQ_ERR_NO_CONN;
+}
+
+static void mqtt_on_connect(struct mosquitto *mq, void *obj, int rc)
+{
+	slap_overinst *on = (slap_overinst *) obj;
+	mqtt_t *mqtt = (mqtt_t *) on->on_bi.bi_private;
+	mqtt_notify_t *n;
+
+	Debug(LDAP_DEBUG_TRACE, "mqtt_on_connect: connected with status %d\n", rc, 0, 0);
+	if (rc != 0)
+		return;
+	
+	for (n = mqtt->notify_map; n; n = n->next)
+		if (n->notify_pending)
+			mqtt_send_notify(mqtt, n);
+}
+
+static int mqtt_db_init(BackendDB *be, ConfigReply *cr)
+{
+	slap_overinst *on = (slap_overinst *) be->bd_info;
+
+	Debug(LDAP_DEBUG_TRACE, "mqtt_db_init: initialize overlay\n", 0, 0, 0);
+	on->on_bi.bi_private = ch_calloc(1, sizeof(mqtt_t));
+
+	return 0;
+}
+
+static int mqtt_db_destroy(BackendDB *be, ConfigReply *cr)
+{
+	slap_overinst *on = (slap_overinst *) be->bd_info;
+	mqtt_t *mqtt = on->on_bi.bi_private;
+
+	Debug(LDAP_DEBUG_TRACE, "mqtt_db_destroy: destroy overlay\n", 0, 0, 0);
+	free_all_notifies(mqtt);
+	ch_free(mqtt);
+
+	return 0;
+}
+
+static int mqtt_db_open(BackendDB *be, ConfigReply *cr)
+{
+	slap_overinst *on = (slap_overinst *) be->bd_info;
+	mqtt_t *mqtt = (mqtt_t *) on->on_bi.bi_private;
+	struct mosquitto *mq;
+	char id[256];
+	int n;
+
+	n = snprintf(id, sizeof(id), "openldap-mqtt/%d/", getpid());
+	gethostname(&id[n], sizeof(id) - n);
+
+	Debug(LDAP_DEBUG_TRACE, "mqtt_db_open, id='%s'\n", id, 0, 0);
+	mqtt->mq = mq = mosquitto_new(id, true, on);
+	if (!mq) return 1;
+
+	if (mqtt->username && mqtt->password)
+		mosquitto_username_pw_set(mq, mqtt->username, mqtt->password);
+
+	mosquitto_connect_callback_set(mq, mqtt_on_connect);
+	mosquitto_connect_async(mq, mqtt->hostname ?: "127.0.0.1", mqtt->port ?: 1883, 60);
+	mosquitto_loop_start(mq);
+
+	return 0;
+}
+
+static int mqtt_db_close(BackendDB *be, ConfigReply *cr)
+{
+	slap_overinst *on = (slap_overinst *) be->bd_info;
+	mqtt_t *mqtt = (mqtt_t *) on->on_bi.bi_private;
+
+	Debug(LDAP_DEBUG_TRACE, "mqtt_db_close\n", 0, 0, 0);
+	mosquitto_disconnect(mqtt->mq);
+	mosquitto_loop_stop(mqtt->mq, false);
+	mosquitto_destroy(mqtt->mq);
+
+	free(mqtt->hostname); mqtt->hostname = NULL;
+	free(mqtt->username); mqtt->username = NULL;
+	free(mqtt->password); mqtt->password = NULL;
+
+	return 0;
+}
+
+static int mqtt_response(Operation *op, SlapReply *rs)
+{
+	slap_overinst *on = (slap_overinst *) op->o_bd->bd_info;
+	mqtt_t *mqtt = (mqtt_t *) on->on_bi.bi_private;
+	Attribute *a;
+	Modifications *m;
+	bool change = false;
+
+	switch (op->o_tag) {
+	case LDAP_REQ_ADD:
+		for (a = op->ora_e->e_attrs; a; a = a->a_next) {
+			if (a->a_desc == slap_schema.si_ad_userPassword) {
+				change = true;
+				break;
+			}
+		}
+		break;
+	case LDAP_REQ_MODIFY:
+		for (m = op->orm_modlist; m; m = m->sml_next) {
+			if (m->sml_desc == slap_schema.si_ad_userPassword) {
+				change = true;
+				break;
+			}
+		}
+		break;
+	case LDAP_REQ_EXTENDED:
+		if (ber_bvcmp(&slap_EXOP_MODIFY_PASSWD, &op->ore_reqoid) == 0)
+			change = true;
+		break;
+	}
+
+	if (change) {
+		mqtt_notify_t *n;
+		int r, cache;
+
+		for (n = mqtt->notify_map; n; n = n->next) {
+			if (n->oc_group) {
+				cache = op->o_do_not_cache;
+				op->o_do_not_cache = 1;
+				r = backend_group(op, NULL, &n->ndn_group, &op->o_req_ndn, n->oc_group, n->ad_member);
+				op->o_do_not_cache = cache;
+			} else {
+				r = 0;
+			}
+
+			Debug(LDAP_DEBUG_TRACE, "tested o_req_ndn='%s' in ndn_group='%s' r=%d\n",
+				op->o_req_ndn.bv_val, n->ndn_group.bv_val, r);
+
+			if (r == 0)
+				mqtt_send_notify(mqtt, n);
+		}
+	}
+
+	return SLAP_CB_CONTINUE;
+}
+
+static int mqtt_init_overlay() 
+{
+	static slap_overinst ov;
+	int rc;
+
+	ov.on_bi.bi_type = "mqtt";
+	ov.on_bi.bi_init = mqtt_init;
+	ov.on_bi.bi_destroy = mqtt_destroy;
+	ov.on_bi.bi_db_init = mqtt_db_init;
+	ov.on_bi.bi_db_destroy = mqtt_db_destroy;
+	ov.on_bi.bi_db_open = mqtt_db_open;
+	ov.on_bi.bi_db_close = mqtt_db_close;
+	ov.on_bi.bi_cf_ocs = mqttocs;
+	ov.on_response = mqtt_response;
+
+	rc = config_register_schema(mqttcfg, mqttocs);
+	if (rc) return rc;
+
+	return overlay_register(&ov);
+}
+
+int init_module(int argc, char *argv[]) 
+{
+	return mqtt_init_overlay();
+}