How to configure nss_ldap to perform SASL/EXTERNAL ?

Hi everyone,

Is there anything new or undocumented about nss_ldap to support SASL/EXTERNAL, so that pam and nss LDAP queries are identified by certificate and there is no need of binddn/rootbinddn, etc.. anymore ?

I couldn't find any answer except that nss_ldap supports only SASL/GSSAPI mechanism (from old posts).

Thank you in advance for any answer.
Sincerely yours, Mathieu MILLET.