fix: ldapi:// URI requires percent-encoded socket path in host field

ldap3 extracts the socket path from the URL **host**, not the path
component — so ldapi:/// (empty host) raises EmptyUnixPath. The correct
form is ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi.

- Fix Mode B block in examples/oposs-openldap.toml
- Fix ldapi:// description in server-auth.md docs
- Fix Unix domain socket example in server-auth.md
- Add examples/ds-carbo-feh.toml: ready-to-use config for the
  carbo-link.com directory (46 POSIX users, posixGroup only, no Samba)

Verified live: edaptor check connects and reports 93 objectClasses.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: oetiker

docs/src/configuration/server-auth.md

@@ -17,11 +17,10 @@ timeout_secs = 10                             # bound the TCP connect so an unre
 - **`uri`** — the directory URL:
   - `ldap://` — plaintext TCP, usually combined with `start_tls = true`.
   - `ldaps://` — implicit TLS on the LDAPS port (636).
-  - `ldapi:///` — Unix domain socket on the local host (OpenLDAP only). Connects
-    to the default slapd socket at `/var/run/slapd/ldapi`. The socket path can be
-    URL-encoded into the URI if it differs from the default, e.g.
-    `ldapi://%2Ftmp%2Fslapd.sock`. Use with `auth.method = "external"` for
-    password-free root access.
+  - `ldapi://` — Unix domain socket on the local host (OpenLDAP only). The socket
+    path goes in the **host** field, percent-encoded. For example, to connect to
+    `/var/run/slapd/ldapi` use `ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi`. Use with
+    `auth.method = "external"` for password-free root access.
 - **`base_dn`** — the root of the subtree eDAPtor loads and browses.
 - **`start_tls`** — when `true`, an `ldap://` connection is upgraded to TLS with
   StartTLS after connecting. **Do not combine `start_tls = true` with an
@@ -96,7 +95,7 @@ and passwords entirely:
 
 ```toml
 [server]
-uri     = "ldapi:///"
+uri     = "ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi"   # /var/run/slapd/ldapi, percent-encoded
 base_dn = "dc=example,dc=com"
 
 [auth]

examples/ds-carbo-feh.toml

@@ -0,0 +1,77 @@
+# edaptor config — ds-carbo-feh (carbo-link.com directory)
+#
+# Run on the slapd host as root (or an olcAuthzRegexp-mapped admin user).
+# Connects via Unix domain socket — no TLS, no password required.
+
+[server]
+uri     = "ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi"
+base_dn = "dc=carbo-link,dc=com"
+
+[auth]
+method = "external"
+
+# ---------------------------------------------------------------------------
+# Profile: user
+# 46 POSIX accounts in ou=people. No Samba, no mailAccount on this host.
+# ---------------------------------------------------------------------------
+[[profile]]
+name           = "user"
+object_classes = ["inetOrgPerson", "posixAccount", "shadowAccount"]
+rdn_attr       = "uid"
+search_base    = "ou=people,dc=carbo-link,dc=com"
+show           = ["uid", "cn", "sn", "givenName", "displayName",
+                  "mail", "gecos", "uidNumber", "gidNumber",
+                  "homeDirectory", "loginShell"]
+search_attrs   = ["cn", "uid", "mail", "sn", "givenName"]
+label          = "{cn} ({uid})"
+
+[profile.defaults]
+homeDirectory = "/home/{uid}"
+loginShell    = "/bin/bash"
+uidNumber     = "{next:1000-9999}"
+gidNumber     = "{next:1000-9999}"
+
+[profile.widget.userPassword]
+kind  = "password"
+samba = false
+
+[profile.widget.loginShell]
+kind   = "choice"
+select = "single"
+format = "plain"
+options = [
+  { value = "/bin/bash",     label = "Bash" },
+  { value = "/bin/sh",       label = "POSIX sh" },
+  { value = "/bin/zsh",      label = "Zsh" },
+  { value = "/sbin/nologin", label = "No login" },
+  { value = "/bin/false",    label = "Disabled" },
+]
+
+# Primary group: resolves a posixGroup entry and stores its gidNumber scalar.
+[profile.widget.gidNumber]
+kind      = "picker"
+candidate = "posixgroup"
+store     = "gidNumber"
+select    = "single"
+
+# ---------------------------------------------------------------------------
+# Profile: posixgroup
+# UID-based groups (posixGroup) in ou=groups — read by NSS/PAM via nssclient.
+# Personal groups (cn = uid) and shared groups (e.g. cl-admins) coexist here.
+# ---------------------------------------------------------------------------
+[[profile]]
+name           = "posixgroup"
+object_classes = ["posixGroup"]
+rdn_attr       = "cn"
+search_base    = "ou=groups,dc=carbo-link,dc=com"
+show           = ["cn", "gidNumber", "memberUid", "description"]
+label          = "{cn}"
+
+[profile.defaults]
+gidNumber = "{next:1000-9999}"
+
+# memberUid: stores each picked user's uid scalar (not the DN).
+[profile.widget.memberUid]
+kind      = "picker"
+candidate = "user"
+store     = "uid"

examples/oposs-openldap.toml

@@ -47,8 +47,8 @@ password_source = "prompt"
 # Uncomment this block and comment out Mode A above.
 # ---------------------------------------------------------------------------
 # [server]
-# uri       = "ldapi:///"           # connects to /var/run/slapd/ldapi (the default)
-# base_dn   = "dc=example,dc=com"   # oposs_openldap.base_dn
+# uri       = "ldapi://%2Fvar%2Frun%2Fslapd%2Fldapi"   # /var/run/slapd/ldapi, percent-encoded
+# base_dn   = "dc=example,dc=com"                        # oposs_openldap.base_dn
 # read_only = false
 #
 # [auth]