Hello,

I am working on a use case when I want an openldap meta server to balance requests on multiple backends according to the bindDN of the incoming user.

I succeeded to do this with a meta + rwm configuration as showed below:

overlay rwm
rewriteEngine on

# In the context of a BIND operation
rewriteContext bindDN
# Store user who has logged in an internal variable named binddn (for other LDAP operations)
rwm-rewriteRule ".+" "${&&binddn($0)}$0" ":"
# If the LDAP operation is a bind, directly rewrite the binddn
# If binddn starts by dir1, rewrite suffix to directory1
rewriteRule "^uid=(dir1[^,]+)(.*),dc=domain,dc=com$" "uid=$1$2,dc=directory1,dc=domain,dc=com" ":@I"
# Else, rewrite suffix to directory2
rewriteRule "^([^,]+),dc=domain,dc=com$" "$1,dc=directory2,dc=domain,dc=com" ":@I"

# For SEARCH LDAP operations
rewriteContext searchDN
# Prefix the string to search by the binddn who has connected previously
rewriteRule "(.*)" "${**binddn}<>$1" ":I"
# If binddn starts by dir1, remove binddn prefix from string and rewrite suffix to directory1
rewriteRule "^uid=dir1[^,]+,[^<]+<>(.*)dc=domain,dc=com(.*)$" "$1dc=directory1,dc=domain,dc=com$2" ":@I"
# If binddn not found or does not start by dir1, remove binddn prefix from string and rewrite suffix to directory2
rewriteRule "^.*<>(.*)dc=domain,dc=com(.*)$" "$1dc=directory2,dc=domain,dc=com$2" ":@I"
rewriteRule "^.*<>(.*)$" "$1" ":@I"

database      meta
suffix        "dc=domain,dc=com"
uri           "ldap://127.0.0.1:3390/dc=directory1,dc=domain,dc=com"
uri           "ldap://127.0.0.1:3391/dc=directory2,dc=domain,dc=com"

This is working well, but all operations are returned with the real backend suffix, which can be disturbing for the client application.

I'd like the bind and search results to be rewritten with the virtual suffix (removing dc=directory1 or dc=directory2 part)

I have tried using these server->client rewrite contexts: searchEntryDN, searchAttrDN, matchedDN, or referralDN, but they don't seem to be called.

Does anyone know if it is possible to achieve this?

Thanks for any help!

David