Having an issue with SSF

[Pat Riehecky <prieheck@iwu.edu>]

I am trying to take advantage of the localSSF option in OpenLDAP 2.4.
This system will only allow one user to login and I like to leave a door
for me to get back in if I forget the admin password.

My goal is to get the local socket running with no security and require
anyone using a TCP connection to use TLS with at least a 3DES cypher.  I
would prefer updates happen over a higher grade encyption, but eh....

In doing so I have put the following in my slapd.conf

.....

localSSF 0
sasl-secprops noplain,noanonymous,minssf=112
security ssf=112 update_ssf=128 simple_bind=112 tls=112

#######################################################################
# Specific Backend Directives for hdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend         hdb

......

It seems I have done something a great deal wrong.  The system is now
enforcing strong authentication over ldapi:/// this is the exact
opposite of my plan.

What on earth did I do wrong?

Pat

Debian Etch, packages from sid.