we're using openldap 2.3.35 as ldap proxy to support anonymous binds and searches to a restricted ldap server.
We're now trying to rewrite existing cn's with old suffix to new cn's with new suffix of the restricted ldap server.
So far almost everything is working with rwm-suffixmassage and overlay rwm except rewriting AVA's from ldapcompare.
I'm still not sure if this is actually possible with overlay rwm or if i'm misunderstanding the manpage of slapo-rwm.
Rewriting the cn's in searches, searchresults, bindDN and compareDN works, but the AVA from the compared
attribute (here: cn) is not changed from rewriteContext compareAttrDN.
"man slapo-rwm" says that the rewriteContext compareAttrDN rewrites compare AVA, but whatever i try it's not
changing anything in the ldapcompare.
What format of the rwm-rewriteRules for rewriteContext compareAttrDN is expected for rewriting to succeed?
Or is this actually impossible what i'm thinking of?
Here my shortened (removed a lot of rewriteRules, but still working) slapd.conf:
The basic idea from this simple setup is to rewrite a cn=99854 to cn=s001x854 and back whereever possible.
I'm trying with
ldapcompare -x -D "" -H ldap://testproxy cn=99854,o=sskm cn:99854
this fails and produces the following logs
packet capturing shows that the value is not rewritten when sent to the ldap server.
Using the value which i was trying to rewrite to
ldapcompare -x -D "" -H ldap://testproxy cn=99854,o=sskm cn:s001x854
succeeds