Update:
I reordered directives in slapd.conf and now slaptest recognizes the file, but with an
error I haven't been able to resolve:
Given:
overlay chain
chain-uri
ldap://chained-server.domain.com
chain-idassert-bind bindmethod="simple"
binddn="cn=admin,dc=domain,dc=com"
credentials="<password>"
mode="self"
chain-tls start
chain-return-error TRUE
sudo slaptest -f /etc/openldap/slapd.conf
56279f1f invalid bind config value binddn=cn=admin,dc=domain,dc=com
56279f1f /etc/openldap/slapd.conf: line 33: "idassert-bind <args>": unable
to parse field "binddn=cn=admin,dc=domain,dc=com".
slaptest: bad configuration file!
Any assistance would be appreciated.
________________________________
From: Peter Heinemann
Sent: Tuesday, October 13, 2015 11:43 AM
To: openldap-technical(a)openldap.org
Subject: openldap chain overlay: does not seem to be functioning/referenced
openldap 2.4-39
RHEL 6.5
I'm trying to get one ldap server configured to chain queries to a second server when
specific OUs that are on the 2nd server (but not the 1st) are referenced in a
query/ldapsearch. Note that these are read-only consumers, so I am not dealing with
modifications, only searches. Both servers share the top level suffix.
An ldapsearch against the first server involving an OU that is on the second server
returns "no such Object"; and the logfile on the first server (loglevel 1)
shows no reference to the chain-uri or attempt to search outside the first server.
overlay chain
chain-uri
ldap://chained-server.domain.com
chain-idassert-bind bindmethod="simple"
binddn="cn=admin,dc=domain,dc=com"
credentials="<password>"
mode="self"
chain-tls start
chain-return-error TRUE
slapd.conf is valid per slaptest, and starts successfully.
However, an ldapsearch against the initial target server simply returns "No such
object", because it appears the chain is never followed or these directives are
inactive. In the local4.log with loglevel set to 1, there's never any
attempt/reference to the chain-uri, and no subsequent entry in the log file for the second
server.
- should there be logfile entries on the first server referencing the chain-uri (or on the
client ldapsearch with -d1)?
- is there a missing directive or incorrect configuration?
Thanks for any assistance.
Peter