Authenticated replication with TLS

[Jani Patokallio <jpatokal@iki.fi>]

Greetings,

Despite quite a bit of searching on the Web, I've been unable to
figure out exactly how I'm supposed to do authenticated replication
through SASL EXTERNAL and TLS.  The OpenLDAP part of the server's
configuration seems clear enough...

replica bindmethod=sasl
        mech=EXTERNAL
        authcid=[myID]

...but how do I tell SASL where to find the server's key, certificates, etc?
Could somebody with a working setup share their config files?

FWIW, I'm using OpenLDAP 2.1.8 with Cyrus SASL 1.5.4, and have managed to
get TLS and client-server authentication running quite happily.

Cheers,
--
Jani Patokallio >0._, unction of my function. urge. urging of my purging.
jpatokal@iki.fi  `..' nip. nip of my snip. now. now. now of my enow. NOW.