Hi,

I can't get this working in overlay chain[1] but its working with syncrepl[2]. I'm missing something, please help.

# ldapsearch -x -b "" -LLL -s base supportedSASLMechanisms dn: supportedSASLMechanisms: PLAIN supportedSASLMechanisms: NTLM supportedSASLMechanisms: LOGIN supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: EXTERNAL

$ ldapwhoami -ZZ SASL/EXTERNAL authentication started SASL username: cn=replicator,ou=ou,o=o,l=l,st=s,c=c SASL SSF: 0 dn:cn=replicator,ou=dsa,dc=server,dc=group

slapd.conf: TLSCACertificateFile /etc/ssl/certs/mgoc-cacert.pem TLSCertificateFile /etc/ldap/ssl/server-cert.pem TLSCertificateKeyFile /etc/ldap/ssl/server-key.pem TLSVerifyClient try

authz-policy from authz-regexp "^cn=([^,]+),.*"         "cn=$1,ou=dsa,dc=moldex,dc=group"

[1] overlay chain chain-uri "ldaps://server.group" chain-rebind-as-user    TRUE chain-idassert-bind bindmethod=sasl         saslmech=EXTERNAL         binddn="cn=whatever"         tls_cert=/etc/ldap/ssl/replicator-cert.pem         tls_key=/etc/ldap/ssl/replicator-key.pem         tls_cacert=/etc/ssl/certs/mgoc-cacert.pem         tls_reqcert=demand         mode=self chain-idassert-authzFrom "*" chain-return-error         TRUE

[2] syncrepl rid=245         provider=ldap://server.group         type=refreshAndPersist         searchbase="dc=server,dc=group"         filter="(objectClass=*)"         scope=sub         schemachecking=off         bindmethod=sasl         saslmech=EXTERNAL         starttls=yes         tls_cert=/etc/ldap/ssl/replicator-cert.pem         tls_key=/etc/ldap/ssl/replicator-key.pem         tls_reqcert=allow         retry="10 20 60 +"         logbase="cn=accesslog"         logfilter="(&(objectClass=auditWriteObject)(reqResult=0))"         syncdata=accesslog

--

Greek Ordono

myppa: launchpad.net/~grexk/+archive/ppa