I'm running openldap 2.4.39 on centos 7, using the translucent overlay and moznss for connections to the backend Active Directory server. When I issue a search request for users in the backend directory I get no results and a "server not available" error - see the debug output below.
The same slapd.conf configuration, but on centos 5.10 and using OpenSSL, works correctly. So, I imagine it's related to moznss.
I've verified (firewall logs) that openldap successfully connects to the backend on startup, but not when the search request is submitted. It looks like it's trying to use client-authenticated TLS, even though the backend is not set up for that??
===============================================================================================
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/we_person_and_npe.schema
pidfile /var/run/openldap/slapd.pid
loglevel stats
#loglevel -1
#loglevel trace conns filter stats
# Path to dynamic modules:
modulepath /usr/lib64/openldap
moduleload back_mdb
moduleload back_ldap
moduleload translucent
moduleload accesslog
moduleload auditlog
moduleload valsort
moduleload ppolicy
moduleload memberof
# TLS server certs (TLS client config is in ldap.conf)
#TLSCACertificateFile /opt/acme/global/certs/ca/ca.pem
#TLSCertificateFile /opt/acme/global/certs/server-cert.pem
#TLSCertificateKeyFile /opt/acme/global/certs/server-key.pem
# not working in our docker container since openldap is linked against NSS and not OpenSSL
#TLSCipherSuite TLSv1.2+FIPS:kRSA+FIPS:!eNULL:!aNULL:!SSLv2
# path of the directory containing the NSS certificate and key database files
TLSCACertificatePath /opt/acme/local/certs/nssdb/
# specifies the name of the certificate to use
TLSCertificateFile server
# name of a file that contains the password for the key for the certificate specified with TLSCertificateFile
TLSCertificateKeyFile /opt/acme/local/certs/.nss_tmp_pwd (contains clear text pasword for keystore and server cert private key)
access to dn.base="" by * read
access to dn.base="cn=Subschema" by * read
access to attrs=clearance,citizenship,sciControl
by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write
by dn="cn=npe-sts,ou=NPEs,ou=Native,dc=acme,dc=com" read
access to attrs=gimmeeOrg,gimmeeRegion,gimmeeTopic,gimmeeIsAICP,gimmeeGroup,gimmeeProject,gimmeeProjectGroup
by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write
by dn="cn=npe-sts,ou=NPEs,ou=Native,dc=acme,dc=com" read
access to attrs=UUID
by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write
by users read
access to attrs=userPassword
by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write
by self write
by anonymous auth
access to attrs=currentLoginDate,lastLoginDate,lastFailedLoginDate,currentLoginIpAddr,lastLoginIpAddr,lastFailedLoginIpAddr
by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write
by dn="cn=npe-openid,ou=NPEs,ou=Native,dc=acme,dc=com" write
by users read
access to *
by dn="cn=npe-user-mgmt,ou=NPEs,ou=Native,dc=acme,dc=com" write
by users read
by anonymous auth
#######################################################################
# Database for Native accounts (NPEs and users)
#######################################################################
database mdb
suffix "ou=Native,dc=acme,dc=com"
rootdn "cn=weAdmin,dc=acme,dc=com"
directory "/opt/acme/global/data/openldap/db/native-user-db"
subordinate
index objectClass eq,pres
index ou,cn,mail,surname eq,pres,sub
index clearance,scicontrol eq,pres,sub
index citizenship eq,pres,sub
password-hash {SSHA}
# Apply password policy overlay to Native accounts, with a default policy.
overlay ppolicy
ppolicy_default "cn=default,ou=Policies,ou=Native,dc=acme,dc=com"
ppolicy_use_lockout
ppolicy_hash_cleartext
#######################################################################
# Database for additional attributes for enterprise accounts.
#######################################################################
database mdb
suffix "dc=acme,dc=com"
rootdn "cn=weAdmin,dc=acme,dc=com"
rootpw {SSHA}73M5MnfH97O8KAN8anAbneD2wf0C6VSg
directory "/opt/acme/global/data/openldap/db/enterprise-user-db"
index objectClass eq,pres
index ou,cn,mail,surname eq,pres,sub
index clearance,scicontrol eq,pres,sub
index citizenship eq,pres,sub
#######################################################################
# Translucent LDAP proxy to Active Directory
#######################################################################
overlay translucent
chase-referrals no
idassert-bind bindmethod=simple
binddn="cn=devadmin,ou=Users,ou=System Accounts,ou=Acme,dc=acme,dc=com"
credentials="******"
mode=none
tls_cacert=/opt/acme/global/certs/ca/gd-class2-root-2.pem
tls_reqcert=demand
# Attributes to be searched for in local database. Only the classes that
# apply to proxied accounts are candidates for translucent_local:
# local wePerson attributes:
translucent_local objectClass
translucent_local UUID,accountStatus
translucent_local rank,grade,position,command,agency
translucent_local DSN
translucent_local weGrp,weOrg
translucent_local clearance,citizenship,scicontrol
# wePerson attributes pulled from remote directory:
translucent_remote objectClass
translucent_remote cn,givenName,sn,mail,o,mobile
translucent_remote displayName,sAMAccountName,userPrincipalName