Nick Urbanik wrote:

Dear Team,

I love your work.

in man(5) slapo-ppolicy we see: "In general, authentication attempts on a replica server only affect the copy of the operational attributes on that replica and will not affect any attributes for a user's entry on the provider."

I would prefer to have the replica send the changes to the provider. Is the chain overlay the right approach for this?

Read the manpage again. In particular, the very first configuration keyword in the Configuration section.