back-ldap: using sasl external authentication with ldapi:///

[Kartik Subbarao <subbarao@computer.org>]

With 2.4.21, I'm trying to use SASL EXTERNAL authentication with a 
back-ldap instance pointed to another ldap server listening on the same 
host -- ldapi:///. Here is the config:

database ldap
suffix o=llnw
uri ldapi:///
rebind-as-user true
idassert-bind bindmethod=sasl saslmech=EXTERNAL

This doesn't seem to work, it just results in a plain anonymous bind 
over ldapi:

Mar 16 14:01:30 ed1-dev slapd[28774]: conn=1140 fd=22 ACCEPT from 
PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
Mar 16 14:01:30 ed1-dev slapd[28774]: conn=1140 op=0 BIND dn="" method=128
Mar 16 14:01:30 ed1-dev slapd[28774]: conn=1140 op=0 RESULT tag=97 err=0 
text=
[...]

I've tried the various mode= arguments and even tried setting 
authcId/authzId, but ran into various errors. What I'm looking for is to 
have all incoming anonymous connections be mapped to the equivalent of 
this ldapsearch command:

ldapsearch -H ldapi:/// -Y EXTERNAL <...>

Which shows up in the slapd log like so:

Mar 16 14:04:44 ed1-dev slapd[28774]: conn=1143 fd=62 ACCEPT from 
PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
Mar 16 14:04:44 ed1-dev slapd[28774]: conn=1143 op=0 BIND dn="" method=163
Mar 16 14:04:44 ed1-dev slapd[28774]: conn=1143 op=0 BIND 
authcid="gidNumber=389+uidNumber=389,cn=peercred,cn=external,cn=auth@LLNW.COM" 
authzid="gidNumber=389+uidNumber=389,cn=peercred,cn=external,cn=auth@LLNW.COM"
Mar 16 14:04:44 ed1-dev slapd[28774]: conn=1143 op=0 BIND 
dn="gidNumber=389+uidNumber=389,cn=peercred,cn=external,cn=auth" 
mech=EXTERNAL sasl_ssf=0 ssf=112

Thanks,

	-Kartik