Can cn=config have 2 lock levels? That fixes this ITS (my ldapwhoami hang) without introducing cn=config failures. The outer lock serializes cn=config ops including the indexer. Other ops do not lock it.  The inner lock blocks slapd like cn=config does now, and should only be held briefly.  Always hold the outer lock when taking the inner lock.

Also, the inner lock could be taken and released several times during a config op when feasible.  That might improve non-config op latency, for the price of slower config ops.