Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to set up an LDAP "tunnel" to work around an application that requires a configuration slightly different to my environment.

I need to be able to bind as USER1 to an LDAP server & retrieve data that the user does not have access to, but a second user (USER2) does. Effectively authentication should be USER1 but then data retrieval done using USER2 for authorization.

So far I've looked in to using OpenLDAP's 'meta' backend to set up a kind-of tunnel but can't seem to get the configuration right. Here's my config running on the meta server attempting to tunnel to SERVER1 (the real server).

database        meta
suffix          o=me
uri             "ldap://SERVER1/o=me"

And I've tried different variations around this bit but can't get anything that works. USER1 is the original low-priv user and USER2 is the escalated user.

idassert-bind   bindmethod=simple binddn="cn=USER2,o=me" credentials="secret" mode=none 
idassert-authzFrom "dn.exact:cn=USER1,o=me"

The 'test' case is this:

 ldapsearch -h METASERVER -D "cn=USER1,o=me" -W -x -b "ou=what,o=me" cn=somethinghidden
share|improve this question

To have the server use a specified authentication identity for a request, use Proxied Authentication.

see also

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.