We use puppet here... for openldap, it's ONLY useful for initial config. For modifications of openldap config, there's no mechanism to enable that, and any mechanism that DID exist would have to be aware of the current state.
@ Zimbra we wrote our own state engine that queries the current cn=config values, and compares them to a set of variables that user can modify. If they differ, it updates cn=config to match the user variables. We don't use puppet at all however.
--Quanah -- Quanah Gibson-Mount Sr. Member of Technical Staff Zimbra, Inc A Division of VMware, Inc. -------------------- Zimbra :: the leader in open source messaging and collaboration