diff --git a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.c b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.c
index 35ecef228..9c6354e01 100644
--- a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.c
+++ b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.c
@@ -66,6 +66,8 @@ static int ipa_sidgen_close(Slapi_PBlock *pb)
     if (ret == 0) {
         free_ranges(&ctx->ranges);
         slapi_ch_free_string(&ctx->dom_sid);
+        slapi_ch_free_string(&ctx->base_dn);
+        free(ctx);
     } else {
         LOG_FATAL("Missing private plugin context.\n");
     }
@@ -202,7 +204,10 @@ static int ipa_sidgen_init_ctx(Slapi_PBlock *pb, struct ipa_sidgen_ctx **_ctx)
 
 done:
     if (ret != 0) {
-        free(ctx);
+        if (ctx) {
+            slapi_ch_free_string(&ctx->base_dn);
+            free(ctx);
+        }
     } else {
         *_ctx = ctx;
     }
@@ -235,6 +240,8 @@ int ipa_sidgen_init(Slapi_PBlock *pb)
                          (void *) ipa_sidgen_add_post_op) != 0 ||
         slapi_pblock_set(pb, SLAPI_PLUGIN_PRIVATE, ctx) != 0) {
         LOG_FATAL("failed to register plugin\n");
+        slapi_ch_free_string(&ctx->base_dn);
+        free(ctx);
         ret = EFAIL;
     }
 
diff --git a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.h b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.h
index aec862796..fbae87e4d 100644
--- a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.h
+++ b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.h
@@ -74,7 +74,7 @@ struct range_info {
 
 struct ipa_sidgen_ctx {
     Slapi_ComponentId *plugin_id;
-    const char *base_dn;
+    char *base_dn;
     char *dom_sid;
     struct range_info **ranges;
 };
diff --git a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c
index 13f4de541..b26c2df52 100644
--- a/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c
+++ b/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen_common.c
@@ -51,7 +51,7 @@ int get_dom_sid(Slapi_ComponentId *plugin_id, const char *base_dn, char **_sid)
     int search_result;
     Slapi_Entry **search_entries = NULL;
     int ret;
-    const char *sid;
+    char *sid = NULL;
 
     search_pb = slapi_pblock_new();
     if (search_pb == NULL) {
@@ -114,6 +114,7 @@ int get_dom_sid(Slapi_ComponentId *plugin_id, const char *base_dn, char **_sid)
     ret = 0;
 
 done:
+    slapi_ch_free_string(&sid);
     slapi_free_search_results_internal(search_pb);
     slapi_pblock_destroy(search_pb);