https://bugs.openldap.org/show_bug.cgi?id=10065
--- Comment #5 from sean@teletech.com.au --- (In reply to Howard Chu from comment #4)
The LDAP clients would expect the "PLAIN" and "EXTERNAL" mechanisms to be available after authenticating with TLS to the LDAP proxy.
LDAP clients do not use SASL/PLAIN. See RFC4513 section 5.2.1.
"typically not used" is a long way from "SHALL NOT". For what it's worth, slapd DOES return PLAIN in the supportedSASLMechanisms when it is available.
In either case, I personally am more interested in EXTERNAL.