When is ldapi:// -Y EXTERNAL needed? Apparently, cosine.ldif breaks without it
You use ldapadd -H ldapi:/// -Y EXTERNAL ... when you want to modify cn=config - the LDAP config itself. LDAP schema is a part of cn=config.
-
-H ldapi:///- use UNIX-domain socket (/var/run/ldapi) -
-Y EXTERNAL- use EXTERNAL mechanism for SASL
I'm not an expert in SASL mechanisms but in this case authentication will succeed if user has UID and GID equal to 0 - is a root.