translucent overlay with local-only entries

[Sven Ulland <sveniu@ifi.uio.no>]

I'm trying to extend an ldap directory using the translucent overlay,
like many before me:

http://www.openldap.org/lists/openldap-software/200802/msg00128.html
http://www.openldap.org/lists/openldap-software/200802/msg00267.html
http://www.openldap.org/lists/openldap-software/200511/msg00216.html
http://www.openldap.org/lists/openldap-software/200707/msg00471.html

Before version 2.4.8, this wasn't possible. Howard Chu seems to have
fixed this in rev 1.40 (before release 2.4.8) of translucent.c:
http://www.openldap.org/devel/cvsweb.cgi/servers/slapd/overlays/translucent.c
(http://www.openldap.org/lists/openldap-bugs/200712/msg00109.html)

Although it seems to have been fixed, I cannot get it to work on my
setup. I use the packaged v2.4.10 in Debian testing. My config:

# Config start
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args
loglevel        none

modulepath      /usr/lib/ldap
moduleload      back_hdb
moduleload      back_ldap
moduleload      translucent

sizelimit 500
tool-threads 1

backend         hdb
backend         ldap

database hdb
directory /var/lib/ldap/translucent
suffix "dc=example,dc=com"
rootdn "cn=admin,dc=mybranch,dc=example,dc=com"
rootpw "admin"

overlay translucent
uri "ldap://172.27.27.37";
idassert-bind
 bindmethod=simple
 binddn="cn=admin,dc=example,dc=com"
 credentials="admin"
 mode=none
idassert-authzFrom "dn.subtree:dc=example,dc=com"
# Config end

This works perfectly fine for searches where the entry is remote.
Changing entries works fine well, with the results stored in the local
translucent db. Adding new entries works, but they are not returned on
searches. I check this by running slapcat.

So, it boils down to these questions:
* Does Howard's patch not fully implement the searching?
* Is my config wrong?
* There is probably other ways to do this, perhaps using a meta
 ldap backend. With multiple backends, what determines where writes
 go? Probably where the object is based, but what about new objects?
* Is it cleaner to keep my "branch" of the tree under a subdomain,
 such as mybranch.example.com using rwm, or should they all be on the
 main example.com domain?
* Examples for exotic overlays are very scarce. It would be very
 helpful if anyone could provide their configuration file.

sven