My SASL authentication is working...

I am still confused on how to setup OpenLDAP to pass ALL attempts through to SASL.  The only method I've found is to create users in a local OpenLDAP database and set the userPassword attribute to {SASL}username@REALM.

What am I missing here?

> Date: Tue, 14 Oct 2014 16:23:26 -0700
> Subject: Re: OpenLDAP as proxy to Active Directory backend
> From:
> To:
> CC:
> Jeff,
> The basic functionality is there. You can tell OpenLDAP to use SASL
> for authentication, against any available SASL mechanism that's
> supported on your platform. Part of the story is here:
> authentication
> Pay very close attention to paragraph 14.5.1. That little SASL config
> file (not part of OpenLDAP) will stop the show if it's not right.
> I almost had it working, but I couldn't do it, because I still needed
> local LDAP password hashes in my use case. I couldn't get the "{SASL}"
> password value to work for some reason. Turning on SASL pass-through
> seemed to be an all or nothing choice in my case. You will probably
> have to do some work to get it up and running.
> Best,
> --Bruce
> On Tue, Oct 14, 2014 at 1:46 PM, Jeff Lebo <> wrote:
> > Goal: LDAP server in Internet facing DMZ to provide authentication for
> > externally hosted applications using internal AD credentials.
> >
> > I've done a LOT of reading and testing, and there is one thing I am still
> > not 100% clear on:
> >
> > Is it possible to do this WITHOUT having a local user database on the
> > OpenLDAP proxy? We will have thousands of users that will need to
> > authenticate, and I can't maintain another user database (adds, removes,
> > etc..). Is there a way to make OpenLDAP just act more like a reverse proxy
> > and forward anything that matches a specific domain on to the internal
> > LDAP/AD server for password verification?