caching authentication proxy

["pkoelle@gmail.com" <pkoelle@gmail.com>]

Hi list,

I need to replicate information from a remote LDAP server, however the 
target server populates the userPassword field with '*********' and 
stores credentials in a custom SASL backend to auth SASL binds and 
simple binds.

What I need is:

a) enable clients to do simple binds to my openldap server

b) the openldap server should continue to work when the network
   link/remote server is down.


The solution to point a) would be using back-ldap with 
rebind-as-user=yes as all identities exist on the remote server (no 
idassert necessary right?). Point b) seems trickier however. The 
proxycache overlay might provide some redundancy when the remote server 
is down but this is far from ideal since high values for cache ttl will 
prevent changes on the remote server to be visible. What I don't know is 
whether proxy-cache caches bind information. If it doesn't, this setup 
is a nogo ;(

Ideally, slapd would try to authenticate the client locally and if that 
fails ask the remote server and update the local entry on success. But 
this smells like it needs an overlay.

I apologize if the description is a bit vague, or my assumptions are 
wrong. I haven't explored all possibilities yet but would like to avoid 
errors early in the design.


thanks
 Paul