I'd like to learn how to configure OpenLDAP (2.4), with the objective to deploy it on an Ubuntu 10.04 LTS system.
Since slapd.conf usage is deprecated, I'm trying to understand better how to use the cn=config format. Unfortunately, I find the cn=config model quite confusing.
What I'm specifically concerned about is the ability to comment (plain English) and group options, as well as comment out options that I'm trying out.
I've already managed to set up some OpenLDAP options successfully (e.g. SSL/TLS usage), but I've initially relied on slaptest -f ... -F ... to do the conversion. This is fine, but what I find hard to figure out is which part of the initial slapd.conf file produces which part of the cn=config directory, and what matters when combining various options in the final configuration.
The other related problem is the ability to revert a wrongly configured option by commenting it out. Maybe it's a bad habit, but I find it convenient to have the ability to try out an option and then disable it if it wasn't quite right. Experimenting with slaptest is fine for small individual tests, but I'm concerned about the ability to roll back and alter the configuration once it's made it into the live cn=config.
For example, even on a production server, if I get a config option (e.g. Alias entry) in Apache Httpd wrong, I can quickly go back into the configuration file, edit it, reload, and the overall existing configuration doesn't fall apart. So far, I've found that digging back into cn=config to fix something was somewhat more tedious. This is particularly relevant if I need to tweak ACLs, not necessarily after mistakes, but because some of the requirements will have changed.
How should OpenLDAP options (using cn=config) be organized/commented so as to be human-understandable (equivalent to plain comments) and what are the usual methods of reverting incorrect attempts (equivalent to commenting out)?
You can't comment out entries in
cn=config, just deleting/reinserting them, at least not via LDAP operations. But, if for some reason you added a configuration option that renders the server inaccessible, it is usually enough to stopslapd, go into/etc/ldap/slapd.d/cn=configand edit out the error in one of the LDIF files below that directory because that's all thatcn=configreally is: A collection of LDIF files with some meta-information.In theory, you could also do this to comment out entries, but I would consider that very bad practice, but I use the fact that it's only text files and add them to a
hgrepository. In case of an error, I can just go back to a working revision (whileslapdis stopped, of course).While the normal config file syntax is deprecated, I don't think it's a bad idea to work with one until you have finished your config work and convert it into
cn=configonly afterwards.If you get used to it, the new method is invaluable, because it allows for very quick config changes without any downtime for a service restart.
As for the layout of the
cn=configtree, I would suggest to read the documentation on the topic.