Problems with authentication against OpenlDAP

[<francesco.policastro@selex-es.com>]

Hi all,

I have two OpenLDAP servers (2.4.34)
used by some applications to authenticate.
Both servers use the meta backend, that
is the frontend to two AD domains in separate forests.
Ldapsearch correctly finds the users
in both servers, while authentication works for one only.
I must say that I had to exclude some
portions of the trees in order to avoid duplicate names. My "correct"
users are in 15 subtrees.

In the working server I configured 15
URI's, one for each subtree, specifying for each of them the credentials,
the attribute mappings and the suffixmassage. The bad news is that slapd.conf
is 580 lines and its maintenance is error prone.
That's why I configured the second server
with two URI's only and with ACL's to limit the access to the 15 subtrees
only. The resulting slapd.conf is much more readable and easy to maintain,
but it does not work.
The ACL's are all of this type:

access to dn.subtree="ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com"
read
  by dn.exact="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
read

There are no other ACL's, but I already
tried adding something like "access to * by * read" with no success.

As said before ldapsearch works fine,
while authentication does not. Please look at the excerpt from the log
files, for both servers, when I try to authenticate.
Both servers start the same sequence,
but one stops just after reading the same search result.

 conn=1033 fd=10 ACCEPT from IP=10.31.222.106:38492
(IP=0.0.0.0:389)
 conn=1033 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
method=128
 conn=1033 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
mech=SIMPLE ssf=0
 conn=1033 op=0 RESULT tag=97 err=0
text=
 conn=1033 op=1 SRCH base="dc=Company,dc=com"
scope=2 deref=0 filter="(sAMAccountName=policastro)"
 conn=1033 op=1 SRCH attr=sAMAccountName
 conn=1033 op=1 SEARCH RESULT tag=101
err=0 nentries=1 text=
 conn=1033 op=2 UNBIND
 conn=1033 fd=10 closed
===========================
 conn=4960 fd=373 ACCEPT from IP=10.31.221.162:40893
(IP=0.0.0.0:389)
 conn=4960 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
method=128
 conn=4960 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
mech=SIMPLE ssf=0
 conn=4960 op=0 RESULT tag=97 err=0
text=
 conn=4960 op=1 SRCH base="dc=Company,dc=com"
scope=2 deref=0 filter="(sAMAccountName=policastro)"
 conn=4960 op=1 SRCH attr=sAMAccountName
 conn=4960 op=1 SEARCH RESULT tag=101
err=0 nentries=1 text=
 conn=4960 op=2 BIND anonymous
mech=implicit ssf=0
 conn=4960 op=2 BIND dn="cn=Policastro
Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com"
method=128
 conn=4960 op=2 BIND dn="cn=Policastro
Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com"
mech=SIMPLE ssf=0
 conn=4960 op=2 RESULT tag=97 err=0
text=
 conn=4960 op=3 UNBIND
 conn=4960 fd=373 closed
 conn=4961 fd=373 ACCEPT from IP=10.31.221.162:40894
(IP=0.0.0.0:389)
 conn=4961 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
method=128
 conn=4961 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
mech=SIMPLE ssf=0
 conn=4961 op=0 RESULT tag=97 err=0
text=
 conn=4961 op=1 SRCH base="dc=Company,dc=com"
scope=2 deref=0 filter="(&(!(?employeeID=-*))(employeeID=*)(mail=*)(givenName=*)(sn=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(sAMAccountName=policastro))"
 conn=4961 op=1 SRCH attr=sAMAccountName
 conn=4961 op=1 SEARCH RESULT tag=101
err=0 nentries=1 text=
 conn=4961 op=2 SRCH base="cn=Policastro
Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com"
scope=0 deref=0 filter="(&(!(?employeeID=-*))(employeeID=*)(mail=*)(givenName=*)(sn=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"
 conn=4961 op=2 SRCH attr=givenName
sn mail employeeID sAMAccountName
 conn=4961 op=2 SEARCH RESULT tag=101
err=0 nentries=1 text=
 conn=4961 op=3 UNBIND
 conn=4961 fd=373 closed
 conn=4962 fd=373 ACCEPT from IP=10.31.221.162:40895
(IP=0.0.0.0:389)
 conn=4962 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
method=128
 conn=4962 op=0 BIND dn="cn=LdapSnooper,ou=people,dc=ExtraDomain,dc=com"
mech=SIMPLE ssf=0
 conn=4962 op=0 RESULT tag=97 err=0
text=
 conn=4962 op=1 SRCH base="dc=Company,dc=com"
scope=2 deref=0 filter="(sAMAccountName=policastro)"
 conn=4962 op=1 SRCH attr=sAMAccountName
 conn=4962 op=1 SEARCH RESULT tag=101
err=0 nentries=1 text=
 conn=4962 op=2 SRCH base="cn=Policastro
Francesco,ou=Users,ou=MySite,dc=FirstSubdomain,dc=Company,dc=com"
scope=0 deref=0 filter="(objectClass=*)"
 conn=4962 op=2 SRCH attr=shadowExpire
 conn=4962 op=2 SEARCH RESULT tag=101
err=0 nentries=1 text=
 conn=4962 op=3 UNBIND

Can anyone explain me what happens and
how to let the ACL version work?

Thanks, Francesco