Let's say I'm running two OpenLDAP servers which I can use independently for authentication: ldap.example.com (a production site) and ldap.example.io (a testing site).
Is it possible to configure ldap.example.io so that if a user is not found, instead of failing authentication, an attempt is made using ldap.example.com? This way an application using the OpenLDAP server for authentication only needs to be aware of a single LDAP resource.
I imagine there are complications to consider (e.g. duplicate usernames, where do new users get added, should the grafted tree be read-only) but for now I just want to find out if such a mechanism even exists.
Yes, the process is called "referral" and is a pretty standard LDAP operation mode, see http://www.openldap.org/doc/admin24/referrals.html
An alternative would be chaining: http://www.openldap.org/doc/admin24/overlays.html#Chaining