Control: tag -1 upstream Hi Christoph,
I'm sorry to hear the documentation caused you some frustration here. On Wed, Mar 27, 2019 at 12:17:18PM +0100, Christoph Biedl wrote:
the slapo-constraint(5) manpage still refers to /etc/ldap/slapd.conf for configuration, a configuration method that has been abandoned ... many years ago. It took hours of searching and eventually using strace to confirm it's completely ignored.
Sort of. It's soft-deprecated but also still supported. But slapd runs in cn=config mode (-F) OR slapd.conf mode (-f) ... it sounds like you had slapd running in cn=config mode (Debian's default) but tried to add some configuration in a slapd.conf file, which indeed would be ignored.
So *please* update the documentation and the examples of usage.
ACK. There is not really an active documentation contributor upstream at the moment, and some documentation is still not updated for cn=config, as you found. So I'm sorry there is indeed a long tail of older bits and not much progress being made.
The Administrator's Guide has something about this (12.4.2), and I had to read the openldap sources to learn the appropriate keywords like olcConstraintAttribute to find that one.
Maybe too late to help you now, but you can introspect the schema on your running slapd instance by making searches under the 'cn=Subschema' base. This is the recommended way of finding, for example, what configuration classes/attributes are actually available on your specific instance.
And while you're on it, it really shouldn't hurt to mention the constraint module needs to be loaded before it's possible to use it. This is mentioned in slapd.overlay(5), but that's another piece of information you'd only find when you already know what you are looking for.
Others have asked for this before and upstream are resistant to repeat this information in every overlay's man page when it can just be written once in a central place. (Can you tell we're talking about programmers here?) But this bites enough new users and I do tend to agree we should have even a breadcrumb in each man page that lets people know what they should be looking for...
Better luck on your next try, Ryan
