Could be relevant or not, don't know. But if I *don't* have /etc/openldap/slapd.d, then the write to cn=config succeeds (but is only in ram obviously, i.e., I loose it after the restart). I double-checked the permissions in /etc/openldap/slapd.d and the ldap user and group own everything.