The code looks good to me. Just couple of questions: how are the ldapi mapped entries created ? If it maps with 'cn=directory manager' does that mean that 'root' is running dscreate ?

The code looks good to me. Just couple of questions: how are the ldapi mapped entries created ? If it maps with 'cn=directory manager' does that mean that 'root' is running dscreate ?

You would need to run as root for it to use LDAPI and cn=directory manager. So this is an interesting point, I'm not sure what happens in a prefix build when root is not creating the instance. IU'm not sure lib389 is smart enough to detect it and skip over it. The function "can_autobind()" might need to check if the user is root.

The patch does work on prefix builds!

It's worth noting @tbordaz that any member of the user/group that DS is running as, or root, gain cn=Directory Manager. So if you as tbordaz on your laptop did:

tbordaz# ns-slapd -d 1 ... 

Then your account would imply cn=Directory Manager via LDAPI as well.

If we are using ldapi we won't need the temp root password then?

Beside that one comment, looks really good to me. I think I always had the intent of doing this rather than just the temp DM password if my past comments in the file are anythinng to go by.

If we are using ldapi we won't need the temp root password then?

I thought about removing it actually, but if ldapi is not available (for whatever reason) then it's there to fall back on.

yep fair. :) Ack from me, but may want to wait to check that @tbordaz's concerns are answered :)

Regarding use of this patch in prefix install, @mreynolds did the magic and it works in prefix deployment.
I had no concern, just wondering if the use of 'cn=directory manager' (via ldapi) was limited to 'root'. The patch is looking good to me but the real expert here is @firstyear

The patch does work on prefix builds!

389-ds-base is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in 389-ds-base's github repository.

This pull request has been cloned to Github as issue and is available here:
- https://github.com/389ds/389-ds-base/issues/4307

If you want to continue to work on the PR, please navigate to the github issue,
download the patch from the attachments and file a new pull request.

Thank you for understanding. We apologize for all inconvenience.