Is the new cn=config interface in OpenLDAP ready for production?

Question

I recently began learning Samba and OpenLDAP, and have become increasingly frustrated with the apparent disconnect between the old configuration (using slapd.conf) and the new one using the cn=config directory.

I can see the benefits of the new system, however so much documentation has yet to be updated that I am considering abandoning this approach in favor of the well known slapd.conf.

Do you think that this new method of configuration (cn=config) is ready for production or should most users stick to slapd.conf?

Answer 1

This is a highly debatable question, but I can provide one data point in that I've been using the cn=config approach for well over a year without issue, and haven't looked back. Yes, the new approach took a little bit of effort to get comfortable with at first, but once you understand the approach, it really doesn't require much thought on how to read something in the slapd.conf format and translate it to the cn=config format. The cn=config format does provide for easy configuration changes at runtime, centralized management of both the directory and its configuration, and does seem to match how several popular LDAP servers now configure themselves as well.

Answer 2

We have been using cn=config with slapd 2.4.21 on Ubuntu 9.10 and 10.04 for over a year now and are very happy with it. I'd say it is quite ready for production, especially if you run a current version of slapd (2.4.21 is pretty old by OpenLDAP project standards).

A great feature of cn=config is that every change made to the server configuration (i.e. the cn=config database) is checked for correct syntax and consistency with schema definitions. With slapd.conf a typo would prevent correct startup of the server; this can't happen with cn=config. And of course there is no need for restarting the server at all when editing the configuration. This comes very much in handy when the actual directory holds ten thousands of objects.

As far as I can tell, cn=config is the future and slapd.conf is going to go away, probably sooner than later. Also, the documentation is pretty comprehensive, what do you find missing?