Yes indeed! When i said it's a pita, i mostly meant that LDAP is a pita (needlessly complex spec with complicated query language and the whole schema extension

Yes indeed! When i said it's a pita, i mostly meant that LDAP is a pita (needlessly complex spec with complicated query language and the whole schema extension zoo). openldap is pretty fine as far as it can be. Personally i'm using lldap, which is a neat no-footgun ldap daemon for small/personal deployments.