OpenLDAP Proxy - user authentification problem

[Martin Toth <snowmailer@gmail.com>]

Hi all,

I am trying to configure OpenLDAP proxy to proxy searches to my 2 (two) different AD servers. I am testing/trying to login as domain user to application that is configured to verify users against this proxy.

Context is :
	- allowed app users from AD1 will be placed to "AllowAPP group" on AD1 - i.e. - CN=AllowAPP,OU=Groups,OU=Something,DC=domain,DC=xy
	- allowed app users from AD2 will be placed to "AllowAPP group" on AD2 - i.e. -  CN=Allow,OU=App,OU=Group,DC=domain2,DC=local
	- these two groups are be placed in different OUs on both ADs (Active Directories) so special rewriting have to be done on both URIs

Problem is that I don't know how to correctly authentificate users. App configuration is that it will allow login only to user which is member of CN=AllowAPP,OU=Groups,DC=grouped,DC=all "virtual” group.
All working fine when I am searching group membership of users with ldapsearch. I can find members of both groups by searching virtual group mentioned upper.

I suspect there is problem with passing user credentials to one of AD servers that I am proxying to. I am using sAMAccountName as user login.

This is debug search base when I am trying to login from app :
	SRCH base="dc=grouped,dc=all" scope=2 deref=2 filter="(?SAMACCOUNTNAME=test.user)”

This is error produced while I am trying to login as user :
	meta_back_search[0] match="" err=1 (Operations error) text="000004DC: LdapErr: DSID-0C09075A, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1".

Am I doing something wrong? Can you advise? I am probably missing something that refers to validating users credentials..

Thanks, BR,
Martin

This is my configuration so far :

database		meta
suffix		"dc=grouped,dc=all”
rootdn		"cn=admin,dc=grouped,dc=all”
rootpw		"password”
readonly		yes
lastmod		off

uri ldap://AD1/dc=grouped,dc=all
suffixmassage	"dc=grouped,dc=all" "dc=domain,dc=xy"
idassert-bind bindmethod=simple
	binddn="CN=bind,CN=Users,dc=domain,dc=xy"
	credentials="password"
	mode=none
	flags=non-prescriptive

rewriteEngine on
chase-referrals yes
rewriteContext	default
rewriteContext searchBase
rewriteRule "CN=AllowAPP,OU=Groups,DC=grouped,DC=all$" "CN=AllowAPP,OU=Groups,OU=Something,DC=domain,DC=xy" "@"

uri ldap://AD2/dc=grouped,dc=all
suffixmassage "dc=grouped,dc=all" "dc=domain2,dc=local" 
idassert-bind bindmethod=simple
	binddn="CN=binduser,CN=Users,dc=domain2,dc=local"
	credentials=“password"
	mode=none
	flags=non-prescriptive

rewriteEngine on
chase-referrals yes
rewriteContext	default
rewriteContext searchBase
rewriteRule "CN=AllowAPP,OU=Groups,DC=grouped,DC=all$" "CN=Allow,OU=App,OU=Group,DC=domain2,DC=local" "@"