Hi, After series of trial and error I finally get it working. The following configuration works for openldap-2.4.16: overlay chain chain-uri "ldap://server.group" #chain-uri "ldaps:///server.group" - not working at all[1]? chain-idassert-bind bindmethod=sasl         saslmech=EXTERNAL         binddn="cn=whatever"         #starttls=yes/critical - even this?         tls_cert=/etc/ldap/ssl/replicator-cert.pem         tls_key=/etc/ldap/ssl/replicator-key.pem         tls_cacert=/etc/ssl/certs/mgoc-cacert.pem         tls_reqcert=demand         mode=self chain-tls start chain-idassert-authzFrom "*" chain-return-error         TRUE $ ldappasswd -x -D 'uid=guest,ou=users,dc=server,dc=group' -w1234 -sguest from the master you may something like this one: Jul 18 11:45:44 server slapd[1275]: conn=1 op=6 PROXYAUTHZ dn="uid=guest,ou=users,dc=server,dc=group" Jul 18 11:45:44 server slapd[1275]: conn=1 op=6 EXT oid=1.3.6.1.4.1.4203.1.11.1 Jul 18 11:45:44 server slapd[1275]: conn=1 op=6 PASSMOD new Jul 18 11:45:44 server slapd[1275]: conn=1 op=6 RESULT oid= err=0 text= on the slave: Jul 18 11:47:30 slave slapd[8915]: conn=0 op=0 BIND dn="uid=guest,ou=users,dc=server,dc=group" method=128 Jul 18 11:47:30 slave slapd[8915]: conn=0 op=0 BIND dn="uid=guest,ou=Users,dc=server,dc=group" mech=SIMPLE ssf=0 Jul 18 11:47:30 slave slapd[8915]: conn=0 op=0 RESULT tag=97 err=0 text= Jul 18 11:47:30 slave slapd[8915]: conn=0 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.1 Jul 18 11:47:30 slave slapd[8915]: conn=0 op=1 PASSMOD new Jul 18 11:47:30 slave slapd[8915]: conn=0 op=1 RESULT oid= err=0 text= Thanks for all the people that tried to help me. [1] http://www.openldap.org/lists/openldap-software/200808/msg00012.html -- Greek Ordono myppa: launchpad.net/~grexk/+archive/ppa --- On Sat, 7/18/09, Quanah Gibson-Mount <quanah(a)zimbra.com&gt; wrote: From: Quanah Gibson-Mount <quanah(a)zimbra.com&gt; Subject: Re: saslmech=EXTERNAL To: "Greek Ordono" <grexk(a)yahoo.com&gt;, ghenry(a)suretecsystems.com Cc: openldap-software(a)openldap.org Date: Saturday, July 18, 2009, 7:26 AM --On Friday, July 17, 2009 5:44 PM -0700 Greek Ordono <grexk(a)yahoo.com&gt; wrote: As I said, by using the "-x" mechanism, you are completely disabling SASL. Thus no SASL/EXTERNAL method is going to work. --Quanah -- Quanah Gibson-Mount Principal Software Engineer Zimbra, Inc -------------------- Zimbra ::  the leader in open source messaging and collaboration