cheimes@redhat.com wrote:

Full_Name: Christian Heimes Version: 2.4.45 OS: Fedora URL: ftp://ftp.openldap.org/incoming/ Submission from: (NULL) (2001:16b8:601e:1c00:18cd:bce4:2531:fe3)

SASL_MECH is documented as "This is a user-only option" in man ldap.conf, https://www.openldap.org/software/man.cgi?query=ldap.conf . User-only options are documented as "Such options are ignored if present in the ldap.conf". Contrary to the documentation, libldap loads SASL_MECH from global ldap.conf. We discussed the issue in https://github.com/freeipa/freeipa/pull/1470#issuecomment-372602434

Is this a documentation bug or an implementation bug?

It appears the doc is stale. The user-only attribute was removed from SASL_MECH in ITS#4327 (commit 86d10729) and apparently the docs weren't updated then.