You're able to do queries with ldapsearch(1) using the rootdn= and rootpw= in your config? The same credentials fail for the migration script? What does slapd.log look like? ~BAS