I am trying to "extend" a corporate Active Directory with application-specific user attributes by running a local OpenLDAP (2.4.34) with back-ldap and the translucent overlay. I can add local attributes associated with remote entries, and I can see these local attributes when searching on a remote attribute. But I cannot modify local attributes, and searching on a local attribute returns no results. For example, after

ldapadd -x -H ldaps://localhost -D "cn=admin,dc=example,dc=com" -W -f addLocalUser.ldif

where "cn=admin,dc=example,dc=com" is the local rootdn and addLocalUser.ldif contains

dn: cn=John Doe,ou=myOrg,dc=example,dc=com objectclass: organizationalPerson objectclass: myPerson myAttribute: somevalue

the search

ldapsearch -x -H ldaps://localhost -LLL -b dc=example,dc=com \ -D "cn=remoteuser,cn=Users,dc=example,dc=com" -W \ '(mail=john.doe@example.com)' cn manager myattribute

(where remoteuser has read access on the remote directory and read/write access on the local directory) returns one entry with the expected cn, manager, and myattribute values. But the search

ldapsearch -x -H ldaps://localhost -LLL -b dc=example,dc=com \ -D "cn=admin,cn=Users,dc=example,dc=com" -W \ '(myattribute=somevalue)' cn manager myattribute

returns nothing. And the modify commands

ldapmodify -x -H ldaps://localhost \ -D "cn=admin,dc=example,dc=com" -W -f modUser.ldif ldapmodify -x -H ldaps://localhost \ -D "cn=remoteuser,cn=Users,dc=example,dc=com" -W -f modUser.ldif

where modUser.ldif contains

dn: cn=John Doe,ou=myOrg,dc=example,dc=com changetype: modify replace: myAttribute myAttribute: anothervalue

both result in

ldapmodify: No such object (32) additional info: attempt to modify nonexistent local record

I've read the relevant parts of the Admin Guide and the relevant man pages numerous times, along with everything I found via google. I've also studied the translucent overlay test cases. It looks like what I'm trying to do is a mainstream use case, so obviously I'm missing some crucial aspects of configuration. Here are the slapd.conf backend configs that I'm using (with name changes to match the examples above):

database mdb suffix "dc=example,dc=com" rootdn "cn=admin,dc=example,dc=com" rootpw {SSHA}blahblah directory /opt/openldap-2.4/var/local-data index objectClass eq,pres index myAttribute eq,pres,sub

overlay translucent uri "ldaps://ldap.example.com/" acl-bind bindmethod=simple binddn=cn=remoteuser,cn=Users,dc=example,dc=com credentials={SSHA}blahblah tls_reqcert=demand idassert-bind bindmethod=simple binddn=cn=remoteuser,cn=Users,dc=example,dc=com credentials={SSHA}blahblah mode=none tls_reqcert=demand idassert-authzFrom dn.regex:.* rebind-as-user chase-referrals yes translucent_local cn,myAttribute translucent_remote cn,mail

Are there glaring mistakes here? Thanks for reading this far :-)

Steve