I'd like to learn how to configure OpenLDAP (2.4), with the objective to deploy it on an Ubuntu 10.04 LTS system.
slapd.conf usage is deprecated, I'm trying to understand better how to use the
cn=config format. Unfortunately, I find the
cn=config model quite confusing.
What I'm specifically concerned about is the ability to comment (plain English) and group options, as well as comment out options that I'm trying out.
I've already managed to set up some OpenLDAP options successfully (e.g. SSL/TLS usage), but I've initially relied on
slaptest -f ... -F ... to do the conversion. This is fine, but what I find hard to figure out is which part of the initial
slapd.conf file produces which part of the
cn=config directory, and what matters when combining various options in the final configuration.
The other related problem is the ability to revert a wrongly configured option by commenting it out. Maybe it's a bad habit, but I find it convenient to have the ability to try out an option and then disable it if it wasn't quite right. Experimenting with
slaptest is fine for small individual tests, but I'm concerned about the ability to roll back and alter the configuration once it's made it into the live
For example, even on a production server, if I get a config option (e.g.
Alias entry) in Apache Httpd wrong, I can quickly go back into the configuration file, edit it, reload, and the overall existing configuration doesn't fall apart. So far, I've found that digging back into
cn=config to fix something was somewhat more tedious. This is particularly relevant if I need to tweak ACLs, not necessarily after mistakes, but because some of the requirements will have changed.
How should OpenLDAP options (using
cn=config) be organized/commented so as to be human-understandable (equivalent to plain comments) and what are the usual methods of reverting incorrect attempts (equivalent to commenting out)?