Hi all,

I realized that the subtree-include directives I use in my meta backend are not converted at all to cn=config.
I cannot find them in cn=config tree.
The slapd version is 2.4.33 as patched after ITS#7525 (openldap-648d28f.tar.gz)
Here is my slapd.conf:

====================================================

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include                /usr/local/etc/openldap/schema/core.schema
include                /usr/local/etc/openldap/schema/cosine.schema
include                /usr/local/etc/openldap/schema/inetorgperson.schema
include                /usr/local/etc/openldap/schema/dyngroup.schema

attributetype ( 1.2.840.113556.1.4.221 NAME 'sAMAccountName'
        EQUALITY caseExactMatch
        SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )

attributetype ( 1.2.840.113556.1.4.35 NAME 'employeeID'
        EQUALITY caseExactMatch
        SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )

attributetype ( 1.2.840.113556.1.4.8 NAME 'userAccountControl'
        EQUALITY integerMatch
        SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )

attributetype ( 1.2.840.113556.1.4.656 NAME 'userPrincipalName'
        EQUALITY caseExactMatch
        SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' SINGLE-VALUE )


# Allow LDAPv2 client connections.  This is NOT the default.
allow bind_v2

pidfile                /var/run/slapd.pid

# ----------------------
backend                meta
backend                hdb
# ----------------------

# ----------------------
database        meta
# ----------------------
suffix                "dc=newco,dc=com"
readonly        on
rootdn                "cn=LdapBindUser,dc=newco,dc=com"
rootpw                secret1

# no anonymous bind
require authc
conn-ttl 25m

dncache-ttl disabled

access to *
 by * none

# first domain

uri "ldap://server1.it.domain1.com/dc=first,dc=newco,dc=com"
idassert-bind bindmethod=simple binddn="cn=LDAP User,ou=ITStaff,dc=it,dc=domain1,dc=com" credentials=secret2
chase-referrals no
rebind-as-user true
map objectclass groupOfNames *
map objectclass person *
suffixmassage "dc=first,dc=newco,dc=com" "dc=it,dc=domain1,dc=com"
subtree-include "ou=Applications,ou=Groups Shared,dc=first,dc=newco,dc=com"
subtree-include "ou=Users,ou=1st-location,dc=first,dc=newco,dc=com"
subtree-include "ou=Users,ou=2nd-location,dc=first,dc=newco,dc=com"
subtree-include "ou=Users,ou=3rd-location,dc=first,dc=newco,dc=com"

# map visible attributes to matching attributes on backend
map attribute distinguishedName *
map attribute givenName *
map attribute description *
map attribute sn *
map attribute cn *
map attribute mail *
map attribute samAccountName *
map attribute userAccountControl *
map attribute employeeID *
map attribute userPrincipalName *

# map everything else to null
map attribute *

# second domain

uri "ldap://server2.domain2.net/ou=organizationalUnit,dc=second,dc=newco,dc=com"
idassert-bind bindmethod=simple binddn="cn=ldap-2,cn=Users,dc=domain2,dc=net" credentials=secret3
chase-referrals no
rebind-as-user true
map objectclass groupOfNames *
map objectclass person *
suffixmassage "dc=second,dc=newco,dc=com" "dc=domain2,dc=net"
subtree-include "ou=Users,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com"
subtree-include "ou=My-ou,ou=1st-location,ou=organizationalUnit,dc=second,dc=newco,dc=com"
subtree-include "ou=Remote Sites,ou=organizationalUnit,dc=second,dc=newco,dc=com"

# map visible attributes to matching attributes on backend
map attribute distinguishedName *
map attribute givenName *
map attribute description *
map attribute sn *
map attribute cn *
map attribute mail *
map attribute samAccountName *
map attribute userAccountControl *
map attribute employeeID pager
map attribute userPrincipalName *

# map everything else to null
map attribute *

# ----------------------
database        hdb
# ----------------------
suffix                dc=domain-groups,dc=com"
rootdn                "cn=groupsRoot,dc=domain-groups,dc=com"
rootpw                secret4
overlay                dynlist

dynlist-attrset groupOfURLs memberURL member
directory        /usr/local/var/openldap-data

=============================================

Did anyone successfully use subtrees with cn=config?

Thanks,
Francesco Policastro