diff --git a/configure b/configure
index 7dcca506f8..1242e310b4 100755
--- a/configure
+++ b/configure
@@ -708,6 +708,7 @@ with_uuid
 with_systemd
 with_selinux
 with_openssl
+with_ldap
 krb_srvtab
 with_python
 with_perl
@@ -5925,6 +5926,7 @@ fi
 $as_echo "$with_ldap" >&6; }
 
 
+
 #
 # Bonjour
 #
diff --git a/configure.in b/configure.in
index 4d26034579..aee3ab0867 100644
--- a/configure.in
+++ b/configure.in
@@ -682,6 +682,7 @@ PGAC_ARG_BOOL(with, ldap, no,
               [build with LDAP support],
               [AC_DEFINE([USE_LDAP], 1, [Define to 1 to build with LDAP support. (--with-ldap)])])
 AC_MSG_RESULT([$with_ldap])
+AC_SUBST(with_ldap)
 
 
 #
diff --git a/doc/src/sgml/regress.sgml b/doc/src/sgml/regress.sgml
index ca2716a6d7..3c448dc5bc 100644
--- a/doc/src/sgml/regress.sgml
+++ b/doc/src/sgml/regress.sgml
@@ -211,6 +211,44 @@ make installcheck-world
    option <option>--enable-tap-tests</option>.  This is recommended for
    development, but can be omitted if there is no suitable Perl installation.
   </para>
+
+  <para>
+   Some test suites are not run by default, either because they are not secure
+   to run on a multiuser system or because they require special software.  You
+   can decide which test suites to run additionally by setting the
+   <command>make</command> or environment variable
+   <varname>PG_TEST_EXTRA</varname> to a whitespace-separated list, for
+   example:
+<programlisting>
+make check-world PG_TEST_EXTRA='ldap ssl'
+</programlisting>
+   The following values are currently supported:
+   <variablelist>
+    <varlistentry>
+     <term><literal>ldap</literal></term>
+     <listitem>
+      <para>
+       Runs the test suite under <filename>src/test/ldap</filename>.  This
+       requires an <productname>OpenLDAP</productname> installation and opens
+       TCP/IP listen sockets.
+      </para>
+     </listitem>
+    </varlistentry>
+
+    <varlistentry>
+     <term><literal>ssl</literal></term>
+     <listitem>
+      <para>
+       Runs the test suite under <filename>src/test/ssl</filename>.  This opens TCP/IP listen sockets.
+      </para>
+     </listitem>
+    </varlistentry>
+   </variablelist>
+
+   Tests for features that are not supported by the current build
+   configuration are not run even if they are mentioned in
+   <varname>PG_TEST_EXTRA</varname>.
+  </para>
   </sect2>
 
   <sect2>
diff --git a/src/Makefile.global.in b/src/Makefile.global.in
index d980f81046..dcb8dc5d90 100644
--- a/src/Makefile.global.in
+++ b/src/Makefile.global.in
@@ -186,6 +186,7 @@ with_tcl	= @with_tcl@
 with_openssl	= @with_openssl@
 with_selinux	= @with_selinux@
 with_systemd	= @with_systemd@
+with_ldap	= @with_ldap@
 with_libxml	= @with_libxml@
 with_libxslt	= @with_libxslt@
 with_system_tzdata = @with_system_tzdata@
diff --git a/src/test/Makefile b/src/test/Makefile
index 73abf163f1..3de9428299 100644
--- a/src/test/Makefile
+++ b/src/test/Makefile
@@ -14,11 +14,25 @@ include $(top_builddir)/src/Makefile.global
 
 SUBDIRS = perl regress isolation modules authentication recovery subscription
 
-# We don't build or execute examples/, locale/, or thread/ by default,
-# but we do want "make clean" etc to recurse into them.  Likewise for
-# ldap/ and ssl/, because these test suites are not secure to run on a
-# multi-user system.
-ALWAYS_SUBDIRS = examples ldap locale thread ssl
+# Test suites that are not safe by default but can be run if selected
+# by the user via the whitespace-separated list in variable
+# PG_TEST_EXTRA:
+ifeq ($(with_ldap),yes)
+ifneq (,$(filter ldap,$(PG_TEST_EXTRA)))
+SUBDIRS += ldap
+endif
+endif
+ifeq ($(with_openssl),yes)
+ifneq (,$(filter ssl,$(PG_TEST_EXTRA)))
+SUBDIRS += ssl
+endif
+endif
+
+# We don't build or execute these by default, but we do want "make
+# clean" etc to recurse into them.  (We must filter out those that we
+# have conditionally included into SUBDIRS above, else there will be
+# make confusion.)
+ALWAYS_SUBDIRS = $(filter-out $(SUBDIRS),examples ldap locale thread ssl)
 
 # We want to recurse to all subdirs for all standard targets, except that
 # installcheck and install should not recurse into the subdirectory "modules".