COmanage Users List

[Scott Koranda <>]

> I believe SSSD[1] allows for fall-through authN.
> If a user is not found in one LDAP it will try another LDAP.
> Might work..
> 
> 
> [1] https://docs.pagure.org/SSSD.sssd/#
> 

+1

I think the SSSD approach will provide everything you need.

But if not, another approach is to use the meta backend for slapd
(OpenLDAP). From 'man slapd-meta':

"The  meta backend to slapd(8) performs basic LDAP proxying with respect
to a set of remote LDAP servers,  called  "targets".   The  information
contained  in  these  servers can be presented as belonging to a single
Directory Information Tree (DIT)."

I have used this backend to make multiple LDAP directories appear to be
a single virtual directory for clients and it has worked well, especially
when combined with the powerful Rewrite/Remap overlay (man slapo-rwm).

The biggest issue with the meta backend is that the documentation for using
it has not been updated for the OLC (cn=config) approach. So you either
have to make clever guesses or create an old style slapd.conf and then convert
it using the "slaptest technique".

Scott K