Hi,

we deploy all our servers with a configuration like this:

uri ldap://127.0.0.1
uri ldaps://ldap1.domain.de/
uri ldaps://ldap2.domain.de/

usually there is no local LDAP daemon running, so it will just fail over
to ldap1, but for important systems like gateways we just deploy a local
replica which is automatically used.

Due to a local configuration error we had a new slapd deployed on a
server that requires authentication (our normal servers don't, yet). nslcd
tried to connect to the server (which was unwilling to perform) but did not
fail over to the other servers.

Sep 14 10:37:18 hostname nslcd[24702]: [8b4567] <passwd="username"> ldap_result() failed: Server is unwilling to perform: authentication required

I think "unwilling to perform" can has other causes as well and should
trigger a failover to another server.

Bernhard

nslcd only fails over for errors that indicate a problem connecting to
the server. The "unwilling to perform" error only shows up after the
search operation was already started (e.g. BIND was successful) and
when getting the results.

This can be fixed by adding LDAP_UNWILLING_TO_PERFORM to end of the
 myldap_get_entry() function in myldap.c. I will see if this can be
added in a portable way (I'm not 100% sure that it is available on all
supported platforms).

Also, there could be some cases where retry-ing this would hide real
configuration errors.

Thanks,