We have problems when we introduce a back-ldap proxy server between a delta-syncrepl server and a mirror configuration of two servers.

The modifications through the replica server (with chaining configuration) over the first mirror server are made without problems. The problem appears when we introduce a back-ldap proxy between replica and the two servers in mirror mode.

I've already fixed the bit of this issue related to not being able to process ordered attributes in proxies (ITS#6516). This is required to retrieve attributes authzFrom and authzTo, used by the proxy authorization process.

The rest of your issue is related to the fact that the slave uses proxyAuthz to propagate the modify request to the updateref server. When this is a proxy, it needs to add proxyAuthz itself to correctly proxy the operation to the master. But two proxyAuthz controls are not allowed.

You'd need to use distributed procedures, which are not implemented in OpenLDAP. A distributed operation would then consist in an extended operation that wraps the original one into a new request, with its own controls. At this point, proxyAuthz could apply incrementally at each layer.

I'd treat your ITS as yet another request to implement distributed procedures.

p.