With 2.4.21, I'm trying to use SASL EXTERNAL authentication with a back-ldap instance pointed to another ldap server listening on the same host -- ldapi:///. Here is the config: database ldap suffix o=llnw uri ldapi:/// rebind-as-user true idassert-bind bindmethod=sasl saslmech=EXTERNAL This doesn't seem to work, it just results in a plain anonymous bind over ldapi: Mar 16 14:01:30 ed1-dev slapd[28774]: conn=1140 fd=22 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi) Mar 16 14:01:30 ed1-dev slapd[28774]: conn=1140 op=0 BIND dn="" method=128 Mar 16 14:01:30 ed1-dev slapd[28774]: conn=1140 op=0 RESULT tag=97 err=0 text= [...] I've tried the various mode= arguments and even tried setting authcId/authzId, but ran into various errors. What I'm looking for is to have all incoming anonymous connections be mapped to the equivalent of this ldapsearch command: ldapsearch -H ldapi:/// -Y EXTERNAL <...> Which shows up in the slapd log like so: Mar 16 14:04:44 ed1-dev slapd[28774]: conn=1143 fd=62 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi) Mar 16 14:04:44 ed1-dev slapd[28774]: conn=1143 op=0 BIND dn="" method=163 Mar 16 14:04:44 ed1-dev slapd[28774]: conn=1143 op=0 BIND authcid=&quot;gidNumber=389+uidNumber=389,cn=peercred,cn=external,cn=auth(a)LLNW.COM&quot; authzid=&quot;gidNumber=389+uidNumber=389,cn=peercred,cn=external,cn=auth(a)LLNW.COM&quot; Mar 16 14:04:44 ed1-dev slapd[28774]: conn=1143 op=0 BIND dn="gidNumber=389+uidNumber=389,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=112 Thanks, -Kartik