LDAP proxy

[FOREST Laurent <lforest@toronto.sema.slb.com>]

Hello,

I am looking for an LDAP proxy that could:
- authenticate LDAP clients (simple bind with encrypted username & password)
- re-direct requests to an LDAP server (e.g. iPlanet Directory Server)
- restrict the allowed operations to search requests
- limit the number of returned entries for each search request to a
configurable value
- allow attribute renaming (nice-to-have feature, but not mandatory)

I saw many discussions in the mailing list about LDAP proxy and back-ldap,
but I am totally confused at the moment.

Is there a decent documentation about implementation of LDAP proxy with
OpenLDAP (I looked at the OpenLDAP administration guide but found nothing
about back-ldap or proxy)? I also spotted a FAQ "how do I use the LDAP
backend" but it is not really helpful as a starting point.

Could someone tell me in a few words
- WHAT are back-<xxx> (e.g. back-ldap, back-shell)?
	. are they the modules between the LDAP interface and the backend
databases?
	. if yes, where are these modules' APIs documented?
- what are their main features?
- what is "suffixmassage"?

Any hints or tips would be much appreciated.

Thank you
Laurent