<suffix> invalid DN 21 (Invalid syntax) openldap

Question

Actually based on http://www.openldap.org/doc/admin24/slapdconf2.html said that i can converting slapd.conf to cn=config format.

So for this purpose i try to make slapd.conf file on server which have role provider like bellow:

database bdb
suffix dc=mydomain,dc=org
rootdn cn=admin,dc=mydomain,dc=org
directory /var/lib/ldap/db
index objectclass,entryCSN,entryUUID eq

overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 100

database config
rootpw mypassword

Then i try to convert that file using slaptest command, but i got error message like bellow :

$ slaptest -f slapd.conf -v
slapd.conf: line 2: <suffix> invalid DN 21 (Invalid syntax)
slaptest: bad configuration file

Actually my suffix is absolutely right, but why always "invalid DN"

How to solve this error ?

Answer 1

You probably have solved it by now, but for the benefit of the googles out there...

Your suffix is not absolutely right because it uses the domainComponent attribute "dc=" but you haven't added the schema that defines it. So until that is done the distinguished name is an unknown and "invalid DN".

Explanation: In the core.schema file (typically in /etc/openldap/schemas/, at least for RedHat/CentOS RPMs) you can find this (and much more that is needed):

# RFC 1274 + RFC 2247
attributetype ( 0.9.2342.19200300.100.1.25
        NAME ( 'dc' 'domainComponent' )
        DESC 'RFC1274/2247: domain component'
        EQUALITY caseIgnoreIA5Match
        SUBSTR caseIgnoreIA5SubstringsMatch
        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )

What you have to do it to include this schema file to your configuration by adding this to the beginning (assuming the file is at this path, adjust as needed):

include         /etc/openldap/schema/core.schema

You probably also need other schema files, but this will solve this error.