Pat Riehecky writes:
localSSF 0
This says ldapi:/// connections receive security factor 0. You need localSSF 128 or better, to match your highest ssf:
sasl-secprops noplain,noanonymous,minssf=112 security ssf=112 update_ssf=128 simple_bind=112 tls=112