Question: Convert secret from ${HOME}/.goggle-authenticator to OpenLDAP slapo-otp format

Hello,

at our site, we have been using OpenLDAP authentication for quite a time; some weeks ago, we added ${HOME}/.goggle-authenticato as a second factor. This week, I read that OpenLDAP 2.5 itself supports google-authenticator-like TOTP secrets, so that a user's secret can be stored in LDAP instead of on disk.

I made this work with a 20 bytes secret created by openssl, but I was not able to transfer an already existing 16 bytes secret from ${HOME}/.goggle-authenticator to OpenLDAP. I generated the OpenLDAP TOTP secret like this, using the base32 binary from goggle-authenticator-libpam:

base32 -D \ | base64

This worked without error, but after creating a correspondig ldif and using it with ldapmodify, I could not login on one of the LDAP clients ...

Can anyone help?

Regards
Christoph