Ah ha. I think you've pointed me to the root cause - the compat plugin has 2 priority
attributes!
Which is correct - 40 or 49?
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <cn=config> with scope subtree
# filter: (nsslapd-pluginprecedence=*)
# requesting: cn nsslapd-pluginprecedence
#
# IPA MODRDN, plugins, config
dn: cn=IPA MODRDN,cn=plugins,cn=config
cn: IPA MODRDN
nsslapd-pluginprecedence: 60
# ipa-winsync, plugins, config
dn: cn=ipa-winsync,cn=plugins,cn=config
cn: ipa-winsync
nsslapd-pluginprecedence: 60
# ipa_pwd_extop, plugins, config
dn: cn=ipa_pwd_extop,cn=plugins,cn=config
cn: ipa_pwd_extop
nsslapd-pluginprecedence: 49
# Posix Winsync API, plugins, config
dn: cn=Posix Winsync API,cn=plugins,cn=config
cn: Posix Winsync API
nsslapd-pluginprecedence: 25
# referential integrity postoperation, plugins, config
dn: cn=referential integrity postoperation,cn=plugins,cn=config
cn: referential integrity postoperation
nsslapd-pluginprecedence: 40
# Retro Changelog Plugin, plugins, config
dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
cn: Retro Changelog Plugin
nsslapd-pluginprecedence: 25
# Schema Compatibility, plugins, config
dn: cn=Schema Compatibility,cn=plugins,cn=config
cn: Schema Compatibility
nsslapd-pluginprecedence: 49
nsslapd-pluginprecedence: 40
# AES, Password Storage Schemes, plugins, config
dn: cn=AES,cn=Password Storage Schemes,cn=plugins,cn=config
cn: AES
nsslapd-pluginprecedence: 1
# search result
search: 2
result: 0 Success
# numResponses: 9
# numEntries: 8