The most common way of integrating your existing Identity Management system with Documentum is to offer SSO (Single Sign-On) via the LDAP Synchronization job.
This requires that you set a Base DN for Documentum to search through, but it is not uncommon when dealing with real-world LDAP servers to have LDAP referrals in that search space. This is transparent, but it can cause performance issues, and even cause the job to timeout if the forwarded DNS name is not resolvable from the Content Server host.
If you do not need to follow these referrals to resolve user identity, you can instruct the LDAP Synch job to ignore referrals with the following iapi commands.
API>retrieve,c,dm_job where object_name='dm_LDAPSynchronization' API>append,c,l,method_arguments SET>-referral ignore API>save,c,l