Typo in certs dir.
Typo: extra dc= in ldap_search_base.  Remove duplicate id_provider.
Add domain parameter and deliver idmapd.conf.  Ensure /etc/pam_ldap.conf, /etc/openldap/ldap.conf and /etc/ldap.conf all have the same content as different tools look for them in different places.