I appreciate the quick feedback. Yes, clicking updates shows "Cache configuration updated" at the top.
Running ldapsearch with port 389 works. And yes from same box as gluu-server. Version 2.3.3-1 on Ubuntu Server 14.04.
I don't see oxtrust-ldap.log, but I tailed wrapper.log as Aliaksandr suggested and got:
INFO | jvm 1 | 2015/08/28 22:14:32 | 2015-08-28 22:14:32,304 ERROR [org.gluu.site.ldap.LDAPConnectionProvider] Failed to create connection pool
INFO | jvm 1 | 2015/08/28 22:14:32 | LDAPException(resultCode=91 (connect error), errorMessage='An error occurred while attempting to connect to server devldap01.consolo.lan:389: java.io.IOException: Unable to establish a connection to server devldap01.consolo.lan/69._._.*:389 within the configured timeout of 100000 milliseconds.')
That IP should be resolving to a 10.* address, and it _is_ when I just ssh into the server. But when I'm inside "sudo service gluu-server login" it resolves to one of our public IPs instead. /etc/resolv.conf in the chroot is different from the system's, so I copied the system's, restarted gluu, and that seems to have fixed it. I think there was a question about copying resolv.conf during the setup, but I think it defaulted to No. Guess I should have answered Yes?
I don't think it's copying the attributes under "Attributes mapping", but I'll open a separate issue if I can't figure that out next week.