mjhjmtu

I am trying to get a local LDAP proxy cache running. The idea is this:

• Currently a computer (A) is sending all ldap requests to a remote ldap server (L)
  


• Instead of that, there should be a proxy cache "server" running on A to act as an intermediate between A and L. The cache would store all queries and all their attributes (until it is filled up and then it starts "recycling").

OpenLDAP's Proxy Cache Engine looks pretty good, but there is not much information about how to set it up. There is an example config file, but I cannot get it to work.

As this is supposed to only be a proxy cache, I shouldn't need to set up a local database. So the config file looks like this:

include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema

moduleload pcache.la

database ldap
suffix "dc=int,dc=somedomain,dc=com"
rootdn "dc=int,dc=somedomain,dc=com"
uri ldap://dc-04.int.somedomain.com:389

overlay pcache
pcache hdb 100000 1 1000 100
pcacheAttrset 0 *
pcacheTemplate (sn=) 0 3600

cachesize 20
directory /var/lib/ldap
index objectClass eq
index cn eq,sub

Now I would expect that any request to ldap://localhost would mirror to the remote LDAP, if not in the cache.

I use this command to test the auth on the remote server:

ldapwhoami -vvv -h dc-04.int.somedomain.com -p 389 -D melka@somedomain.com -x -w <passwd>

Which works well, I get the auth.

However, when I try to run the same command on localhost:

ldapwhoami -vvv -h localhost -p 389 -D melka@somedomain.com -x -w <passwd>

It fails, saying

ldap_initialize( ldap://localhost:389 )
ldap_bind: Invalid DN syntax (34)
 additional info: invalid DN

Slapd is listening on localhost, netstat contains this line:

tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 10352/slapd

Is there something I am missing?
Thanks

ldap_bind: Invalid DN syntax (34)
additional info: invalid DN

This means that an invalid distinguished name was used. Note that using something like melka@somedomain.com as bind DN in a simple bind request only works for MS Active Directory and no other LDAP server. Therefore your local LDAP proxy denies this request without doing something else.