How to block bind requests on openLDAP proxy, after number of failed authentication requests?

Question

I am looking for a solution to temporarily block bind attempts on an openLdap proxy after a number of consecutive failed authentication requests, without changing the remote servers configuration (change password policy on remote servers) or the use of a privileged user (proxy authorization).

It more or less should be a standalone feature working with the client request and remote server response only.

Is there a working solution, i.e. somehow using a password policy overlay or writing a custom overlay to run on an openLdap proxy?

Answer 1

The way to implement this is via the pwdMaxFailure and pwdLockout features of the password policy overlay in your proxy.