Turbo- I believe I ran into this same problem a while ago, in 2.2.15. I had to remove the sasl_ssf requirement for my syncrepl updateDN. Since the update happens local (ie, the provider is not pushing from outside, but rather syncrepl is simply changing contect to the updateDN with no authentication, or something like that), there is no kerberos authenticaion happening, therefore sasl_ssf!=56.
--Quanah
-- Quanah Gibson-Mount Principal Software Developer ITSS/Shared Services Stanford University GnuPG Public Key: http://www.stanford.edu/~quanah/pgp.html
"These censorship operations against schools and libraries are stronger than ever in the present religio-political climate. They often focus on fantasy and sf books, which foster that deadly enemy to bigotry and blind faith, the imagination." -- Ursula K. Le Guin