Note that pam-session logging requires a rootdn

diff --git a/contrib/slapd-modules/nssov/slapo-nssov.5 b/contrib/slapd-modules/nssov/slapo-nssov.5
index d91ad4628f424eebb12c521b57944c2a0677f0a3..855647d967a060b33ee60da69dd3ec322b56107c 100644 (file)
--- a/contrib/slapd-modules/nssov/slapo-nssov.5
+++ b/contrib/slapd-modules/nssov/slapo-nssov.5
@@ -247,7 +247,9 @@ of the form
 .RE
 Upon logout the corresponding value will be deleted. This feature allows
 a single LDAP Search to be used to check which users are logged in across
-all the hosts of a network. By default no services are configured.
+all the hosts of a network. The rootdn of the database is used to perform
+the updates of the loginStatus attribute, so a rootdn must already be
+configured for this feature to work. By default no services are configured.
 .LP
 The PAM functions support LDAP Password Policy as well. If the password
 policy overlay is in use (see