Mac OS X Server: LDAP temporarily unavailable after updating to 10.3.9

After updating to Mac OS X Server 10.3.9, network users won't be able to authenticate, home directories won't mount, and you won't be able to complete any operation that requires access to LDAP data.

This happens because Mac OS X Server 10.3.9 includes a new schema for Open Directory that requires the database to be reindexed. This occurs on the first restart after the update, and it can take several minutes (the more users you have, the longer it will take).

Verifying the process

During the reindexing, the LDAP database is offline. To verify that indexing is in progress, open Activity Monitor and set it to show all processes. Look for a process named slapconfig. Another option is to use ps -ax | grep slapconfig in Terminal.

slapconfig must finish

The slapconfig process needs to finish to completely index the database. In the event that indexing has been interrupted (crashed), you should manually restart the indexing process by executing the Terminal commands listed below. Please note that this process also takes the LDAP server offline and can take several minutes, depending on the size of the LDAP database.

Note: You should only do this if the crash is evidenced by presence of the log file, /Library/Logs/CrashReporter/slapindex.crash.log.

1. sudo SystemStarter stop LDAP
2. sudo slapindex
3. sudo SystemStarter start LDAP

Checking your search path

After slapconfig has finished, verify the search path is set to include the /LDAPv3/127.0.0.1 node.

1. Launch the Directory Access utility.
2. If necessary, click the lock to authenticate.
3. Click the Authentication tab.

If the Search pop-up menu is not set to Custom Path and the "/LDAPv3/127.0.0.1" node is not in the Directory Domains list, do the following.

1. Select Custom Path from the Search pop-up menu.
2. Click Add
3. Select "/LDAPv3/127.0.0.1" in the list.
4. Click Add.
5. Click Apply.