My apartment has a WiFi network (using an Airport base station) and a wired LAN with several servers and a few desktops. The Airport has it's own static IP address, on the same subnet as the desktops and servers. Hosts availing themselves of wireless connectivity, however, are assigned IP address on a different, local subnet (192.168.1.*), with the Airport doing NAT for all external connections.

This configuration presents some issues, however, when trying to discover and share services using Bonjour (a.k.a. mDNS), as multicast packets are not relayed across the subnets by the Airport base station.

Here is a simple hack for allowing sharing across the networks for two particular hosts:

1. Configure Airport to map tunnel and iTunes comm. ports:

   We will map port 10000 for the multicast tunnel and (the default) port 3689 for iTunes sharing.

   Using the Airport Admin Utility, open up the "Port Mapping" panel for your Airport base station, and, using the IP address of the "wireless" host (in this example 192.168.1.2), add the appropriate port mappings:
   

   

2. Download and install mTunnel on each host.

   mTunnel is a simple UDP unicast tunneler written in Java by Peter Parnes.

3. Start mTunnel on each host:

   • on the LAN host, pass in the static IP or hostname of the Airport base station and the port mapped for NAT pass through: mtunnel airport.hccp.org/10000

   • on the wireless host, pass in the static IP or hostname of the LAN host and the configured port: mtunnel lan-desktop.hccp.org/10000

4. Configure mtunnel:
   1. Point a browser to the wireless host at port 9000 to view the mTunnel web admin console.
   2. Create a new tunnel:

      

      

      

   3. Configure the tunnel:

      Set the group field to 224.0.0.251, the reserved multicast address for mDNS/Bonjour, and the baseport field to the UDP port of 5353¹

      Name and media fields can be set to whatever you prefer, as they have no effect on the behavior of our tunnel.

      

   4. Turn ON tunnelling by clicking on the Yes/No toggle link in the tunnel detail page. (it is OFF by default)

      

5. In short order, the iTunes applications will discover each other and you will be able to share music across the networks.

¹the TCP port for DNS is 53, natch

This is currently still at the proof of concept stage, and is lacking most of the features found in the official CardSpace selector from Microsoft. At present, only a single self-asserted card can be selected. The "selector" will currently pull the logged in account's personal information from the AddressBook application, and allow you to use that AddressBook entry as a self-asserted InfoCard with various RPs. It should work with existing installs of Safari, and with most relying parties.

The plug-in itself is a wrapper around Chuck Mortimore's Java implementation of an InfoCard token generator. For those of you out there using Firefox, check out Chuck's cross-platform Firefox InfoCard selector.

So download the Safari Plug-In below and give it a spin. Send me any feedback at igb at hccp.org

I'll post new releases here as features are added and bugs are fixed.

Downloads

Currently there are two versions, one for the new Intel-based Apple's, and one for the PowerPC-based machiines. At some point I'll figure out how to get XCode to generate a Universal Binary. (I suppose the PowerPC build might work on the Intel Macs, that's what Rosetta is all about right? But it hasn't been tested on the Intel arch, so YMMV.)

Intel version http://www.hccp.org/InfocardPlugin.bundle.zip

PowerPC version http://www.hccp.org/InfocardPluginPPC.bundle.zip

Installation

Installation is pretty simple. After downloading the ZIP file, extract the archive. You should now have a file called InfocardPlugin.bundle. Just copy that to the Library/Internet Plug-Ins directory under your home directory. restart Safari, and off you go.

Demo

9/12/2006

I was hacking around with WebKit plug-ins this weekend, and ran into a frustrating issue. Initially, I had gotten my plug-in working, with a single object (the plug-in) in the bundle. However, after adding a second object to the bundle, the plug-in stopped loading. All I the info I could get out of Safari/WebKit was the unhelpful dialog displayed below:

After some digging around, comparing my project to the example plug-ins that ship with XCode, I discovered I was missing the NSPrincipalClass key in my bundle's Info.plist. After adding the definition:

<key>NSPrincipalClass</key>
<string>MyPlugIn</string>

9/9/2006

Hey, Jeff and Mike finally updated the website!

And that's a good thing, as they have built up quite the portfolio over the years.

9/1/2006

SOA/BlueTitan Senior Software Engineers Sadhana Jain and Anil Eddakkuni demonstrating their awesome presentation kung-fu.

8/31/2006

> date -u  "+%Y-%m-%dT%H:%M:%SZ"
2006-08-17T06:28:58Z

2006-08-17T06:28:58Z

An interesting post appeared on Kim Cameron's IdentityBlog yesterday afternoon. Rohan Pinto apparently circumvented the security on the blog (which runs on WordPress), and vaguely implied that the exploit was enabled by Kim's use of InfoCard/Cardspaces:

It isn't immediately clear to me that the hack was particular to InfoCard/Cardspaces for a couple of reasons:

1. Rohan seems to have been correctly identified by the site as "Rohan Pinto" in both the original post as well as the follow up comment. (i.e. He wasn't able to post as "Kim Cameron" or some other user's identity)
   
   
2. The "hack" seems to be an exploit around entitlements or permissions within the application. Unless the asserted identity contained falsified credentials that allowed the user to assume an admin role (vs. a naiive trust of unqualified or unsigned attributes), then the exploit would not seem to be specific to the protocols that comprise InfoCard/Cardspaces.

Based on these observations, I suspect that the exploit is particular to either Kim's PHP InfoCard implementation, or an issue with his WordPress configuration.

Kim or Rohan, any details you are able to share regarding this would be appreciated, as if there is an exploit that is common across InfoCard/Cardspace implementations, then I'm sure the community would be interested in hearing about it.

Rohan, while I can understand your reluctance to share the techincal details of your exploit, perhaps you could disclose any occurrences of this vulnerability in other public RP implementations ( Ping Identity, xmldap.org ). Is the attack feasible against all InfoCard enabled sites?

[UPDATE] Rohan has confirmed here that, indeed, the exploit was unrelated to InfoCard, and was simply a WordPress specific exploit.

Kim has since removed Rohan's post, so I've included a screenshot below, and a copy of the item can be found here.

[UPDATE] Rohan called and asked me to remove my link to a search for the term "Rohan Pinto", as he feels he has been the victim of a "google bombing" campaign by other parties in a dispute over copyright infringement. I have obliged Rohan, and am now linking directly to his blog.

8/16/2006

For a recent project, I created a simple web service, with a one-way operation using a simple, reasonably-typed^TM message. Rather than inline the XML schema for the message types, I chose to import the externally defined schema, using a relative path on my local filesystem. Here is the WSDL:

<?xml version="1.0" encoding="utf-8"?>
<wsdl:definitions
    xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" 
    xmlns:tns="http://ws.hccp.org/cc-build" 
    xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" 
    xmlns:xs="http://www.w3.org/2001/XMLSchema" 
    targetNamespace="http://ws.hccp.org/cc-build">
    <wsdl:types>
        <xs:import namespace="http://ws.hccp.org/cc-build" schemaLocation="../schema/build-notification.xsd"/>
    </wsdl:types>
    <wsdl:message name="buildNotificationMessage">
        <wsdl:part name="message" element="tns:build-notification"/>
    </wsdl:message>
    <wsdl:portType name="buildNotificationPortType">
        <wsdl:operation name="buildNotificationOperation">
            <wsdl:input message="tns:buildNotificationMessage"/>
        </wsdl:operation>
    </wsdl:portType>
    <wsdl:binding name="buildNotificationBinding" type="tns:buildNotificationPortType">
        <soap:binding transport="http://schemas.xmlsoap.org/soap/http" style="document"/>
        <wsdl:operation name="buildNotificationOperation">
            <soap:operation style="document" soapAction="buildNotification"/>
            <wsdl:input>
                <soap:body use="literal"/>
            </wsdl:input>
        </wsdl:operation>
    </wsdl:binding>
</wsdl:definitions>

While the use of the {http://www.w3.org/2001/XMLSchema}import element allows me a certain amount of flexibility during development, it is a solution that is less than acceptable from a deployment perspective. In many cases, deployment of services can occur in environments and server configurations in which externally defined schemata are not accessible. So, rather than hardcode the schema definition in the original WSDL, I'd like to automatically replace the reference with the actual schema during the build or deployment of the service, thereby retaining the indirection and normalization of my schema definitions and service descriptions.

A solution can be provided through the creation of a simple XSLT. First, let's start with a simple identity transformation. This stylesheet will output, for any XML document, a copy of the input document. The identity transform is the basic building block for many transformations:

<xsl:stylesheet 
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
    version="1.0">
    <xsl:output method="xml"/>
    <xsl:template match="node() | @*">
        <xsl:copy>
            <xsl:apply-templates select="node() | @*"/>
        </xsl:copy>
    </xsl:template>
</xsl:stylesheet>

Running the above transformation will, as expected, return the original WSDL, unchanged. Now, with a simple addition of a template matching the {http://www.w3.org/2001/XMLSchema}import element, we can extract the value of the schemaLocation attribute and use the document function retrieve the referenced schema. We then continue to apply the identity transformation template to the schema document:

<xsl:stylesheet
    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
    xmlns:xs="http://www.w3.org/2001/XMLSchema"
    version="1.0">
    <xsl:output method="xml" indent="no"/>
    <xsl:template match="node() | @*">
        <xsl:copy>
            <xsl:apply-templates select="node() | @*"/>
        </xsl:copy>
    </xsl:template>    
    <xsl:template match="xs:import">
        <xsl:variable name="schema" select="@schemaLocation"/>
        <xsl:apply-templates select="document($schema)"/>
    </xsl:template>
</xsl:stylesheet>

Now, if we run the above transformation, we get output like this:

<?xml version="1.0" encoding="utf-8"?>
<wsdl:definitions xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
    xmlns:tns="http://ws.hccp.org/cc-build" 
    xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"
    xmlns:xs="http://www.w3.org/2001/XMLSchema"
    targetNamespace="http://ws.hccp.org/cc-build">
    <wsdl:types>
        <xs:schema xmlns:hccp="http://ws.hccp.org/build-notification"
            xmlns="http://ws.hccp.org/cc-build" elementFormDefault="qualified"
            targetNamespace="http://ws.hccp.org/cc-build">
            <xs:element name="build-notification" type="hccp:build-notification"/>
            <xs:complexType name="build-notification">
                <xs:sequence>
                    <xs:element name="status" maxOccurs="1" minOccurs="1" type="hccp:build-status"/>
                </xs:sequence>
            </xs:complexType>
            <xs:simpleType name="build-status">
                <xs:restriction base="xs:string">
                    <xs:enumeration value="PASS"/>
                    <xs:enumeration value="FAIL"/>
                </xs:restriction>
            </xs:simpleType>
        </xs:schema>
    </wsdl:types>
    <wsdl:message name="buildNotificationMessage">
        <wsdl:part name="message" element="tns:build-notification"/>
    </wsdl:message>
    <wsdl:portType name="buildNotificationPortType">
        <wsdl:operation name="buildNotificationOperation">
            <wsdl:input message="tns:buildNotificationMessage"/>
        </wsdl:operation>
    </wsdl:portType>
    <wsdl:binding name="buildNotificationBinding" type="tns:buildNotificationPortType">
        <soap:binding transport="http://schemas.xmlsoap.org/soap/http" style="document"/>
        <wsdl:operation name="buildNotificationOperation">
            <soap:operation style="document" soapAction="buildNotification"/>
            <wsdl:input>
                <soap:body use="literal"/>
            </wsdl:input>
        </wsdl:operation>
    </wsdl:binding>
</wsdl:definitions>

So now we have a simple set of steps for creating a deployable WSDL. Plus it's trivial to add the above steps to an Ant task:

<project...>
    <target...>
    ... 
        <xslt in="${wsdl.src.dir}/build-notification-endpoint.wsdl"
              out="${build.dir}/build-notification-endpoint.wsdl"
              style="${xslt.src.dir}/import-schema.xsl"/>
    ...
    </target>
</project>    

8/13/2006

Oh yeah, we are totally hardcore.

8/7/2006

There is no local independent coffee house within striking distance of the BlueTitan/SOA HQ. Therefore, my colleagues and I must resort to patronizing the nearby Starbucks. Since Starbucks processes drink orders asynchronously, the customer must provide a name to the dispatching barista in order to be notified of drink delivery.

Problems often occur during the transmission of names when the provided identifier is unfamiliar, or of foreign origin, to the receiving barista. For instance, if the barista is an American-educated¹ English speaker, the name Srinivasa Ramanujan stands little chance of being retransmitted with acceptable fidelity.

All of my San Francisco-based colleagues at BlueTitan/SOA have similarly barista-unfriendly names, and have each adopted Starbucks-specific "handles" that are provided in lieu of their actual names in order to facilitate the exchange of money and caffeine.

Here are a few examples:

Name	Handle
Sadhana Jain	"Jane"
Anil Edakkunni	"Neal", "Ed", or "Ed O'Neal"
Eberhard Hummel	"Abe"
Fabrice Medio	"Vijay Nahasapeemapetilon"

Perhaps Starbucks should think of applying some technology to handle the identifier issue:

¹No comment on the current state of American education and the ability of American-educated students to compete in a job market that is increasingly non-US centric.

8/6/2006

by Jorge Luis Borges

"There seemed a certainty in degradation." - T. E. Lawrence, Seven Pillars of Wisdom

In Asia Minor or in Alexandria, in the second century of our faith (when Basilides was announcing that the cosmos was a rash and malevolent improvisation engineered by defective angels), Nils Runeberg might have directed, with a singular intellectual passion, one of the Gnostic conventicles. Dante would have destined him, perhaps, for a fiery sepulcher; his name might have augmented the catalogues of heresiarchs, between Satornibus and Carpocrates; some fragment of his preaching, embellished with invective, might have been preserved in the apocryphal Liber adversus omnes haereses or might have perished when the firing of a monastic library consumed the last example of the Syntagma. Instead, God assigned him to the twentieth century, and to the university city of Lund. There, in 1904, he published the first edition of Kristus och Judas; there, in 1909, his masterpiece Dem hemlige Frälsaren appeared. (Of this last mentioned work there exists a German version, called Der heimliche Heiland, executed in 1912 by Emil Schering.)

Before undertaking an examination of the foregoing works, it is necessary to repeat that Nils Runeberg, a member of the National Evangelical Union, was deeply religious. In some salon in Paris, or even in Buenos Aires, a literary person might well rediscover Runeberg's theses; but these arguments, presented in such a setting, would seem like frivolous and idle exercises in irrelevance or blasphemy. To Runeberg they were the key with which to decipher a central mystery of theology; they were a matter of meditation and analysis, of historic and philologic controversy, of loftiness, of jubilation, and of terror. They justified, and destroyed, his life. Whoever peruses this essay should know that it states only Runeberg's conclusions, not his dialectic or his proof. Someone may observe that no doubt the conclusion preceded the "proofs" For who gives himself up to looking for proofs of something he does not believe in or the predication of which he does not care about?

The first edition of Kristus och Judas bears the following categorical epigraph, whose meaning, some years later, Nils Runeberg himself would monstrously dilate: Not one thing, but everything tradition attributes to Judas Iscariot is false. (De Quincey, 1857.) Preceded in his speculation by some German thinker, De Quincey opined that Judas had betrayed Jesus Christ in order to force him to declare his divinity and thus set off a vast rebellion against the yoke of Rome; Runeberg offers a metaphysical vindication. Skillfully, he begins by pointing out how superfluous was the act of Judas. He observes (as did Robertson) that in order to identify a master who daily preached in the synagogue and who performed miracles before gatherings of thousands, the treachery of an apostle is not necessary. This, nevertheless, occurred. To suppose an error in Scripture is intolerable; no less intolerable is it to admit that there was a single haphazard act in the most precious drama in the history of the world. Ergo, the treachery of Judas was not accidental; it was a predestined deed which has its mysterious place in the economy of the Redemption. Runeberg continues: The Word, when It was made flesh, passed from ubiquity into space, from eternity into history, from blessedness without limit to mutation and death; in order to correspond to such a sacrifice it was necessary that a man, as representative of all men, make a suitable sacrifice. Judas Iscariot was that man. Judas, alone among the apostles, intuited the secret divinity and the terrible purpose of Jesus. The Word had lowered Himself to be mortal; Judas, the disciple of the Word, could lower himself to the role of informer (the worst transgression dishonor abides), and welcome the fire which can not be extinguished. The lower order is a mirror of the superior order, the forms of the earth correspond to the forms of the heavens; the stains on the skin are a map of the incorruptible constellations; Judas in some way reflects Jesus. Thus the thirty pieces of silver and the kiss; thus deliberate self-destruction, in order to deserve damnation all the more. In this manner did Nils Runeberg elucidate the enigma of Judas.

The theologians of all the confessions refuted him. Lars Peter Engström accused him of ignoring, or of confining to the past, the hypostatic union of the Divine Trinity; Axel Borelius charged him with renewing the heresy of the Docetists, who denied the humanity of Jesus; the sharpedged bishop of Lund denounced him for contradicting the third verse of chapter twenty-two of the Gospel of St. Luke.

These various anathemas influenced Runeberg, who partially rewrote the disapproved book and modified his doctrine. He abandoned the terrain of theology to his adversaries and postulated oblique arguments of a moral order. He admitted that Jesus, "who could count on the considerable resources which Omnipotence offers," did not need to make use of a man to redeem all men. Later, he refuted those who affirm that we know nothing of the inexplicable traitor; we know, he said, that he was one of the apostles, one of those chosen to announce the Kingdom of Heaven, to cure the sick, to cleanse the leprous, to resurrect the dead, and to cast out demons (Matthew 10:7-8; Luke 9:1). A man whom the Redeemer has thus distinguished deserves from us the best interpretations of his deeds. To impute his crime to cupidity (as some have done, citing John 12:6) is to resign oneself to the most torpid motive force. Nils Runeberg proposes an opposite moving force: an extravagant and even limitless asceticism. The ascetic, for the greater glory of God, degrades and mortifies the flesh; Judas did the same with the spirit. He renounced honor, good, peace, the Kingdom of Heaven, as others, less heroically, renounced pleasure.¹ With a terrible lucidity he premeditated his offense.

In adultery, there is usually tenderness and self-sacrifice; in murder, courage; in profanation and blasphemy, a certain satanic splendor. Judas elected those offenses unvisited by any virtues: abuse of confidence (John 12 :6) and informing. He labored with gigantic humility; he thought himself unworthy to be good. Paul has written: Whoever glorifieth himself, let him glorify himself in God (I Corinthians 1:31); Judas sought Hell because the felicity of the Lord sufficed him. He thought that happiness, like good, is a divine attribute and not to be usurped by men.²

Many have discovered post factum that in the justifiable beginnings of Runeberg lies his extravagant end and that Dem hemlige Frälsaren is a mere perversion or exacerbation of Kristus och Judas. Toward the end of 1907, Runeberg finished and revised the manuscript text; almost two years passed without his handing it to the printer. In October of 1909, the book appeared with a prologue (tepid to the point of being enigmatic) by the Danish Hebraist Erik Erfjord and bearing this perfidious epigraph: In the world he was, and the world was made by him, and the world knew him not (John 1:10). The general argument is not complex, even if the conclusion is monstrous. God, argues Nils Runeberg, lowered himself to be a man for the redemption of the human race; it is reasonable to assume that the sacrifice offered by him was perfect, not invalidated or attenuated by any omission. To limit all that happened to the agony of one afternoon on the cross is blasphemous.³ To affirm that he was a man and that he was incapable of sin contains a contradiction; the attributes of impeccabilitas and of humanitas are not compatible. Kemnitz admits that the Redeemer could feel fatigue, cold, confusion, hunger and thirst; it is reasonable to admit that he could also sin and be damned. The famous text "He will sprout like a root in a dry soil; there is not good mien to him, nor beauty; despised of men and the least of them; a man of sorrow, and experienced in heartbreaks" (Isaiah 53:2-3) is for many people a forecast of the Crucified in the hour of his death; for some (as for instance, Hans Lassen Martensen), it is a refutation of the beauty which the vulgar consensus attributes to Christ; for Runeberg, it is a precise prophecy, not of one moment, but of all the atrocious future, in time and eternity, of the Word made flesh. God became a man completely, a man to the point of infamy, a man to the point of being reprehensible - all the way to the abyss. In order to save us, He could have chosen any of the destinies which together weave the uncertain web of history; He could have been Alexander, or Pythagoras, or Rurik, or Jesus; He chose an infamous destiny: He was Judas.

In vain did the bookstores of Stockholm and Lund offer this revelation. The incredulous considered it, a priori, an insipid and laborious theological game; the theologians disdained it. Runeberg intuited from this universal indifference an almost miraculous confirmation. God had commanded this indifference; God did not wish His terrible secret propagated in the world. Runeberg understood that the hour had not yet come. He sensed ancient and divine curses converging upon him, he remembered Elijah and Moses, who covered their faces on the mountain top so as not to see God; he remembered Isaiah, who prostrated himself when his eyes saw That One whose glory fills the earth; Saul who was blinded on the road to Damascus; the rabbi Simon ben Azai, who saw Paradise and died; the famous soothsayer John of Viterbo, who went mad when he was able to see the Trinity; the Midrashim, abominating the impious who pronounce the Shem Hamephorash, the secret name of God. Wasn't he, perchance, guilty of this dark crime? Might not this be the blasphemy against the Spirit, the sin which will not be pardoned (Matthew 12:3)? Valerius Soranus died for having revealed the occult name of Rome; what infinite punishment would be his for having discovered and divulged the terrible name of God?

Intoxicated with insomnia and with vertiginous dialectic, Nils Runeberg wandered through the streets of Malmö, praying aloud that he be given the grace to share Hell with the Redeemer.

He died of the rupture of an aneurysm, the first day of March 1912. The writers on heresy, the heresiologists, will no doubt remember him; he added to the concept of the Son, which seemed exhausted, the complexities of calamity and evil.

¹ Borelius mockingly interrogates: Why did he not renounce to renounce? Why not renounce renouncing?

² Euclydes da Cunha, in a book ignored by Runeberg, notes that for the heresiarch of Canudos, Antonio Conselheiro, virtue was "a kind of impiety almost." An Argentine reader could recall analogous passages in the work of Almafuerte. Runeberg published, in the symbolist sheet Sju insegel, an assiduously descriptive poem, "The Secret Water": the first stanzas narrate the events of one tumultuous day; the last, the finding of a glacial pool; the poet suggests that the eternalness of this silent water checks our useless violence, and in some way allows and absolves it. The poem concludes in this way: The water of the forest is still and felicitous, And we, we can be vicious and full of pain.

³ Maurice Abramowicz observes: "Jesus, d'apres ce scandinave, a toujours le beau role; ses deboires, grace a la science des typographes, jouissent d'une reputation polyglotte; sa residence de trente-trois ans parmis les humains ne fut, en somne, qu'une villegiature." Erfjord, in the third appendix to the Christelige Dogmatik, refutes this passage. He writes that the crucifying of God has not ceased, for anything which has happened once in time is repeated ceaselessly through all eternity. Judas, now, continues to receive the pieces of silver; he continues to hurl the pieces of silver in the temple; he continues to knot the hangman's noose on the field of blood. (Erfjord, to justify this affirmation, invokes the last chapter of the first volume of the Vindication of Eternity, by Jaromir Hladlk.)

Reproduced without permission of the author (who's dead) or publisher. It's a really good book. Go buy a copy.

5/30/2006

The PDSA loop of W. Edwards Deming and Walter Shewhart.

1. Plan: determine scope of project as well as interval of initial iteration

2. Do: execute - small steps in controlled circumstances

3. Study: gather empirical evidence, involve the customer if possible

4. Act: take action to improve or standardize the plan or process

3/26/2006

OpenLDAP is installed by default on Tiger (and earlier versions of OS X). In order to get it into a useful state, however, you will need to make a few changes:

1. Locate the OpenLDAP configuration files in /etc/openldap/

2. cp slapd.conf.default slapd.conf

3. Edit slapd.conf:

   • Remove the folowing lines:

     database        netinfo
     suffix          ""
     flags           DSENGINE_FLAGS_NATIVE_AUTHORIZATION
     datasource      /var/db/netinfo/network.nidb
     include         /etc/openldap/schema/netinfo.schema
     

   • And add the following:

     database        bdb
     directory      /var/db/openldap/openldap-data/
     suffix          "dc=hccp,dc=org"
     rootdn          "cn=Directory Manager,dc=hccp,dc=org"
     rootpw          secret
     

   (optionally use slappasswd to avoid plaintext password in slapd.conf)

4. Make sure that /var/db/openldap/openldap-data/ exists, creating it if it does not.

5. Run slapd: sudo /usr/libexec/slapd