Is there any way to use the idassert feature ONLY for anonymous connections,
while allowing all other binddns to be directly proxied as themselves?

I ask because we have root LDAP servers that have ACL configurations that work
for our purposes, and we don't want to change them. We also do not allow
anonymous binds to our root servers.  To be clear, we do not want to change
anything whatsoever on our root servers.

however, some clients do need to be able to bind anonymously.  We're ok with
this, as long as anonymous is allowed against LDAP proxies only, and not on our
root LDAP servers.  This way, we can control what anonymous user sees.

I am trying to make the proxy behave in the following ways:

  * authenticated non-admin Users may bind as themselves, they can see groups,
etc., (anything non-confidential) but can only see their own account (we have
this one working, but is an essential element of the larger picture)
  * anonymous users see all of the same non-sensitive material, but no user
accounts whatsoever
  * there are proxybind users in our DIT, one for read-ops and one for
write-ops.  The writer-proxybind user typically is needed for changing a users'
password, etc.  The read user is the one that performs lookups for strictly
read-only operations.  He can see all users.

If I set the idassert-bind to the read-only user, then no one can do writes.  If
i set it to the write-user, then everyone (even those who shouldn't) can do
writes (except anonymous, which is good).  The understanding I have is that we
should be setting the proxy user in slapd's proxy config to be the
highest-privileged user that we're ok with being "asserted".  For example, we're
not asserting to the rootdn or anything, rather we assert to a bind user that is
designed to read the very information that the proxy is designed to lookup.  

Here is our running config, though its been hacked up so much you should
understand its probably not perfect around the edges. Also ignore the comments
as they haven't been updated with the rest of the real parameters.

PS - I tried to upload as anonymous to your ftp and got this:

local: j-gropefruit-100114.txt remote: j-gropefruit-100114.txt
229 Entering Extended Passive Mode (|||60518|)
553 j-gropefruit-100114.txt: Permission denied.

So you'll just have to read it here: