OpenLDAP as a Proxy cache only, no local database

Question

I am trying to get a local LDAP proxy cache running. The idea is this:

• Currently a computer (A) is sending all ldap requests to a remote ldap server (L)
• Instead of that, there should be a proxy cache "server" running on A to act as an intermediate between A and L. The cache would store all queries and all their attributes (until it is filled up and then it starts "recycling").

OpenLDAP's Proxy Cache Engine looks pretty good, but there is not much information about how to set it up. There is an example config file, but I cannot get it to work.

As this is supposed to only be a proxy cache, I shouldn't need to set up a local database. So the config file looks like this:

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema

moduleload pcache.la

database        ldap
suffix          "dc=int,dc=somedomain,dc=com"
rootdn          "dc=int,dc=somedomain,dc=com"
uri             ldap://dc-04.int.somedomain.com:389

overlay pcache
pcache         hdb 100000 1 1000 100
pcacheAttrset  0 *
pcacheTemplate (sn=) 0 3600

cachesize 20
directory /var/lib/ldap
index       objectClass eq
index       cn eq,sub

Now I would expect that any request to ldap://localhost would mirror to the remote LDAP, if not in the cache.

I use this command to test the auth on the remote server:

ldapwhoami -vvv -h dc-04.int.somedomain.com -p 389 -D [email protected] -x -w <passwd>

Which works well, I get the auth.

However, when I try to run the same command on localhost:

ldapwhoami -vvv -h localhost -p 389 -D [email protected] -x -w <passwd>

It fails, saying

ldap_initialize( ldap://localhost:389 )
ldap_bind: Invalid DN syntax (34)
    additional info: invalid DN

Slapd is listening on localhost, netstat contains this line:

tcp        0      0 0.0.0.0:389                 0.0.0.0:*                   LISTEN      10352/slapd

Is there something I am missing? Thanks

Answer 1

ldap_bind: Invalid DN syntax (34) additional info: invalid DN

This means that an invalid distinguished name was used. Note that using something like [email protected] as bind DN in a simple bind request only works for MS Active Directory and no other LDAP server. Therefore your local LDAP proxy denies this request without doing something else.