Hi Quanah, Thanks for reply. I didn't find a clear step to setup the rootpw/rootdn for cn=config and the steps to enable SASL/EXTERNAL in doc of 2.6. When I use rpm/yum to install openldap-2.4.44 , the SASL/EXTERNAL was enabled by default so I don't have problem. But now I compiler install the version of 2.6.1 and cannot find a correct way to setup permission for cn=config.