OpenLDAP as a proxy for multiple LDAP servers not returning mapped attributes properly - openldap

Question

We want to use OpenLDAP to proxy multiple customer LDAP servers we have, e.g. normal LDAP in Linux and Windows AD etc. Since there are multiple LDAP servers proxied, we also needed one to many attribute mappings. So in the slapd.conf file, we defined the rwm overlay section as below.
overlay rwm
rwm-map attribute lastName sAMAccountName
overlay rwm
rwm-map attribute email emailAddress
rwm-map attribute mobileNumber mobile
rwm-map attribute lastName sn
rwm-map attribute uid uid
rwm-map attribute firstName givenName
rwm-map objectClass inetOrgPerson person
Note that how lastName maps to both sn and sAMAccountName. I understand entries like lastName or mobileNumber are not legitimate LDAP attributes with valid OIDs defined in a schema. That's why there is below warning when starting slapd. But let's just leave that as it is for now.
5a71c27c /etc/openldap/slapd.conf: line 125: warning, source attributeType 'lastName' should be defined in schema
The proxy itself works. We can use it to query a user and get all attributes that are available. And the mappings can also be successfully done.
But strangely if we specify mapped attributes in the ldapsearch call as below, those attributes won't be successfully retrieved.
ldapsearch -h localhost -x -b "dc=local,dc=foo,dc=bar,dc=com" "mail=someone#foo.bar.com" lastname firstname mobilenumber
Only the dn attribute is shown in the output. And if we add one more attribute that is default from the LDAP server. All of them can be successfully retrieved.
ldapsearch -h localhost -x -b "dc=local,dc=foo,dc=bar,dc=com" "mail=someone#foo.bar.com" lastname firstname mobilenumber notesemail
We don't know much about OpenLDAP. Just want to get this proxy work first. So wondering if above configuration is a valid tryout.

Answer 1

You are naming foreign attributes to the local server in your search filter. It doesn't know about them, because they have been mapped. You need to use the mapped name, e.g. givenName.

Answer 2

Eventually I found out that the trick is to NOT use the rwm overlay at all. Instead just using the map statement after the uri directive is sufficient enough. So in the database declaration section, instead of
database meta
suffix "dc=foo,dc=bar,dc=com"
rootdn "cn=admin,dc=foo,dc=bar,dc=com"
rootpw "p#ssw0rd"
uri "ldaps://tstbluepages.mkm.can.ibm.com:636/dc=foo,dc=bar,dc=com"
lastmod off
readonly yes
suffixmassage "dc=foo,dc=bar,dc=com" "ou=bluepages,o=ibm.com"
uri "ldaps://<AD_HOSTNAME>:636/dc=local,dc=foo,dc=bar,dc=com"
lastmod off
readonly yes
suffixmassage "dc=foo,dc=bar,dc=com" "dc=testad,dc=ibm,dc=com"
overlay rwm
rwm-map attribute lastName sAMAccountName
overlay rwm
rwm-map attribute email emailAddress
rwm-map attribute mobileNumber mobile
rwm-map attribute lastName sn
rwm-map attribute uid uid
rwm-map attribute firstName givenName
rwm-map objectClass inetOrgPerson person
now the slapd.conf file has below section.
database meta
suffix "dc=foo,dc=bar,dc=com"
rootdn "cn=admin,dc=foo,dc=bar,dc=com"
rootpw "p#ssw0rd"
uri "ldaps://tstbluepages.mkm.can.ibm.com:636/dc=foo,dc=bar,dc=com"
lastmod off
readonly yes
suffixmassage "dc=foo,dc=bar,dc=com" "ou=bluepages,o=ibm.com"
map attribute mobileNumber mobile
map attribute email emailAddress
map attribute lastName sn
map attribute firstName givenName
map objectClass inetOrgPerson person
uri "ldaps://<AD_HOSTNAME>:636/dc=foo,dc=bar,dc=com"
lastmod off
readonly yes
suffixmassage "dc=foo,dc=bar,dc=com" "dc=testad,dc=ibm,dc=com"
map attribute lastName sAMAccountName
I know that the slapd-ldap manpage says that the functionality of the map directive is delegated to the rwm overlay, but the slapd-meta manpage still has the map directive listed and it works.
This well served our original purpose of mapping different attributes from multiple back-end LDAP servers into a uniform one.