Annoying changes in syntax between versions of OpenLDAP that I didn’t pick up consumed my time at work today. I was beating my head against the wall trying to work out why the
slapd config wasn’t being parsed correctly.
Setting the slaptest debug level to -1 reveals all, however:
slapd.conf: line 78: expecting <what> got "attribute" <access clause> ::= access to <what> [ by <who> <access> [ <control> ] ]+ <what> ::= * | [dn[.<dnstyle>]=<dn>] [filter=<filter>] [attrs=<attrlist>] <attrlist> ::= <attr> [val[.<style>]=<value>] | <attr> , <attrlist> <attr> ::= <attrname> | entry | children
Under newer versions of OpenLDAP, when defining access controls the
attribute definition has been renamed to
attrs. This means that your config will mystically stop working and
slapd will die in a horrible flaming mess.