Re-investigating ppolicy + chain issues on a consumer: chain configuration

[Siddhartha Jain <sjain@silverspringnet.com>]

I am still stuck at the same place where a chained consumer allows a client to auth with a bad password. Remove chaining and bad passwords are no longer accepted.

To troubleshoot from scratch, I am curious about how chaining should be configured in the new ldif-based configuration scheme?

Initially, I created a slapd.conf with the appropriate chaining statements and converted that file to "slapd.d". The conversion places all the chaining config under the "frontend" database. 

: [0115] root@ldaps01:olcDatabase={-1}frontend # ; ls -lR
.:
total 8
drwxr-x--- 2 ldap ldap 4096 Jun 24 00:30 olcOverlay={0}chain
-rw------- 1 ldap ldap  433 Jun 22 23:00 olcOverlay={0}chain.ldif

./olcOverlay={0}chain:
total 8
-rw------- 1 ldap ldap 591 Jun 23 23:53 olcDatabase={0}ldap.ldif
-rw------- 1 ldap ldap 893 Jun 24 00:30 olcDatabase={1}ldap.ldif     


Interestingly, it creates two "ldap" databases for a single "chain" overlay. Can someone please explain why/how is this so? Why does chaining go to "frontend" db instead of being under the database that is chained? I tried to create the "ldap" databases under a "bdb" database but OpenLDAP won't allow that.


Thanks,

Siddhartha