You didn't read my original mail. Let me clearify again.

The point was that why I have to make a separate conf file to feed it to slaptest to generate ldif whereas with slapd.conf you can just use include. And another problem with cn=config is that if you wanna add a schema, you have to either rebuild the entire schema attributes or handcraft ldif with proper starting {} index(ldapadd will not do this for you).

cn=config: 1 text editor, 2 tools, 2 files involved
slapd.conf: 1 text editor involved

to achieve the same goal.

If you don't see a problem here, just stay out of it.


On 5 April 2022 12:21:37 am AWST, Quanah Gibson-Mount <quanah@fast-mail.org> wrote:


--On Tuesday, April 5, 2022 12:24 AM +0800 David Timber <dxdt@dev.snart.me> 
wrote:

 https://www.openldap.org/doc/admin26/slapdconf2.html#cn=config

 I don't see olcInclude in the doc.

 https://lists.openldap.org/hyperkitty/list/openldap-commit@openldap.org/m
 essage/EBTNZ6QPDTU3YJUT4LSU3FDIOICVKZ2T/

 This is an undocumented feature. I'm not writing/using any script. I'm
 not using slaptest to convert schema to ldif.

It's include, not olcInclude, if you're using slapadd.  Example:

<https://gist.github.com/quanah/4c6e477c9946442889b9f84de2091fbf#file-gistfile1-txt-L16>


 This is incorrect.  You can use ldapadd to import schema to an
 existing cn=config database.  Just like you add entries to any other
 database. It's generally clear the person who wrote the "tool" you are
 referring to is utterly clueless in how to use OpenLDAP.

 Regards,
 Quanah


 https://www.linuxquestions.org/questions/linux-server-73/how-to-add-a-new
 -schema-to-openldap-2-4-11-a-700452/

 This is all I can find. I'm not doing that. Are you saying I can just use
 ldapadd? Care to elaborate?

As long as the schema file being imported is in cn=config format, you can 
use ldapadd to add it.  All schema shipped with OpenLDAP are provided in 
both slapd.conf ("x.schema") and cn=config ("x.ldif") formats.  If you are 
using a pre cn=config "x.schema" file, you need to convert it to cn=config 
format first.  The "slaptest" utility explicitly allows one to do this.

So assuming you have a cn=config formatted ldif file:

ldapadd .... -f inetorgperson.ldif


Regards,
Quanah