openldap-bugs

openldap-bugs@openldap.org

1 participants
21509 discussions

[Issue 8070] test023 failures
by openldap-its＠openldap.org 06 Jan '26

06 Jan '26

https://bugs.openldap.org/show_bug.cgi?id=8070 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution|--- |SUSPENDED --- Comment #11 from Quanah Gibson-Mount <quanah(a)openldap.org> --- depends on migration to python test suite -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 7347] Exclusive bit masks for: ACL_WADD, ACL_WDEL, and ACL_WRITE
by openldap-its＠openldap.org 06 Jan '26

06 Jan '26

https://bugs.openldap.org/show_bug.cgi?id=7347 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #11 from Quanah Gibson-Mount <quanah(a)openldap.org> --- commit 93d7b9ef7af5747859b82f4326661728106b0149 Author: Ondřej Kuzník <ondra(a)mistotebe.net> Date: Wed Dec 10 12:07:18 2025 +0000 ITS#7347 Allow subtractive -a/z/i to work as expected -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 7347] Exclusive bit masks for: ACL_WADD, ACL_WDEL, and ACL_WRITE
by openldap-its＠openldap.org 06 Jan '26

06 Jan '26

https://bugs.openldap.org/show_bug.cgi?id=7347 Ondřej Kuzník <ondra(a)mistotebe.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Ever confirmed|0 |1 Status|UNCONFIRMED |IN_PROGRESS --- Comment #10 from Ondřej Kuzník <ondra(a)mistotebe.net> --- https://git.openldap.org/openldap/openldap/-/merge_requests/814 -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10417] New: Objects not receivable anymore after schema attribute name /alias change
by openldap-its＠openldap.org 06 Jan '26

06 Jan '26

https://bugs.openldap.org/show_bug.cgi?id=10417 Issue ID: 10417 Summary: Objects not receivable anymore after schema attribute name /alias change Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: slapd Assignee: bugs(a)openldap.org Reporter: best(a)univention.de Target Milestone: --- Created attachment 1100 --> https://bugs.openldap.org/attachment.cgi?id=1100&action=edit ITS10417.txt We have objects in the directory which cannot be received anymore after we change the schema. The objects are returned in a search but using the DN as search base yields NO SUCH OBJECT error code. The schema change: Add another NAME for the existing attribute and put it into the first (canonical) position. The attribute is used as RDN component for objects. Schema change as (unified) diff: ```diff -attributetype ( 1.3.6.1.4.1.10176.4221.1.10 NAME 'univentionRecycleBinOriginalUniventionObjectIdentifier' +attributetype ( 1.3.6.1.4.1.10176.4221.1.10 + NAME ('univentionRecycleBinID' 'univentionRecycleBinOriginalUniventionObjectIdentifier') DESC 'Original univentionObjectIdentifier of the deleted object' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) objectclass ( 1.3.6.1.4.1.10176.4221.2.2 NAME 'univentionRecycleBinObject' DESC 'Object stored in the Recycle Bin' SUP top STRUCTURAL MUST ( univentionRecycleBinOriginalDN $ univentionRecycleBinDeleteAt $ - univentionRecycleBinOriginalUniventionObjectIdentifier $ + univentionRecycleBinID $ univentionRecycleBinOriginalObjectClass $ univentionRecycleBinDeletionDate $ univentionRecycleBinOriginalEntryUUID $ univentionRecycleBinOriginalType ) MAY ( univentionObjectIdentifier $ univentionObjectType $ univentionRecycleBinReference ) ) ``` Now the proof script: It searches for a certain example object. And get its DN. (stored in a variable with correct LDAP DN escape sequences). Then it searches for that object. → no result Then it searches for a modified DN so that its RDN uses a new name → no result Then it searches for a modified DN so that its RDN uses the OID → no result ```bash start="$(date '+%Y-%m-%d %H:%M:%S')" sleep 1 ldaps () { ldapsearch -o ldif-wrap=no -ZZ -D cn=master,cn=dc,cn=computers,dc=ucs,dc=test -y /etc/machine.secret -LLL "$@" } DN=$(ldaps -LLLb 'cn=recyclebin,cn=internal' univentionRecycleBinID=785c156b-bc84-4cb2-b34d-e10d78065a57 1.1 | sed -ne 's/^dn: //p') echo "$DN" ldaps -b "$DN" 1.1 ldaps -b "$(echo "$DN" | sed 's/univentionRecycleBinOriginalUniventionObjectIdentifier/univentionRecycleBinID/g')" 1.1 ldaps -b "$(echo "$DN" | sed 's/univentionRecycleBinOriginalUniventionObjectIdentifier/1.3.6.1.4.1.10176.4221.1.10/g; s/univentionRecycleBinOriginalDN/1.3.6.1.4.1.10176.4221.1.5/')" 1.1 sleep 1 end="$(date '+%Y-%m-%d %H:%M:%S')" journalctl --since="$start" --until="$end" ``` The command output and logs are attached, with stripped date prefix. The logs show, that OL normalizes the DN internally. So the search by OID, or alias is not a problem. I don't know yet, (but i would suspect it), if OL backends store object DNs internally by storing AVA-lists with OIDs: [[(OID, value, AVA_TYPE), …], …] --- Background of our schema change reasoning: We have very long RDN components now and reach some MDB limits. I don't know if the limit only affect RDN values or as well the RDN attribute-names. But also for user-friendly-ness we want to shorten the DN name. ldap.OTHER: {'msgtype': 105, 'msgid': 3, 'result': 80, 'desc': 'Other (e.g., implementation specific) error', 'ctrls': []} slapd[28205]: => mdb_dn2id_add 0x3fb: "univentionRecycleBinOriginalDN=uid\3Dumc_test_user_xvju2bhb6t\2Ccn\3Dintermediate_test_container\2Ccn\3Dbase_test_container\2Cdc\3Dautotest092\2Cdc\3Daaaa+univentionRecycleBinOriginalUniventionObjectIdentifier=675f8041-87d9-4483-9c46-e558f9f58c7f,cn=recyclebin,cn=internal" slapd[28205]: <= mdb_dn2id_add 0x3fb: -30781 slapd[28205]: mdb_add: dn2id_add failed: MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED size (-30781) So we want to change: univentionRecycleBinOriginalDN = {DN} + univentionRecycleBinOriginalUniventionObjectIdentifier = {UUID} , cn = recyclebin , cn = internal to: univentionRecycleBinID = {UUID} , parent(DN) , cn = recyclebin , cn = internal But we must be backward compatible to a certain degree for old productive systems. -- You are receiving this mail because: You are on the CC list for the issue.

1 2

[Issue 10418] New: Typo in man page for slapcat
by openldap-its＠openldap.org 06 Jan '26

06 Jan '26

https://bugs.openldap.org/show_bug.cgi?id=10418 Issue ID: 10418 Summary: Typo in man page for slapcat Product: OpenLDAP Version: 2.6.10 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: documentation Assignee: bugs(a)openldap.org Reporter: hanspeter.dekoning(a)dekonsult.com Target Milestone: --- In the slapcat man page, in the description of option -o under "Possible generic options/values are:" the following option is misspelled: ldif_wrap={no|<n>} the underscore should be a hyphen, like so: ldif\-wrap={no|<n>} Location is line 152 in: https://git.openldap.org/openldap/openldap/-/blob/master/doc/man/man8/slapc… Correction tested and confirmed with slapcat in v2.6.10 on Linux / Ubuntu v24.04. -- You are receiving this mail because: You are on the CC list for the issue.

1 4

[Issue 5808] jldap library connect timeout doesn't work
by openldap-its＠openldap.org 18 Dec '25

18 Dec '25

https://bugs.openldap.org/show_bug.cgi?id=5808 --- Comment #5 from Norbert Klasen <klasen(a)gmx.net> --- The link for "SocketFactory does not support a connect timeout" should have been https://bugs.openjdk.org/browse/JDK-4414843 -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 8988] Undefined Behavior in slapadd
by openldap-its＠openldap.org 16 Dec '25

16 Dec '25

https://bugs.openldap.org/show_bug.cgi?id=8988 Howard Chu <hyc(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |TEST Target Milestone|0.9.34 |1.0.0 Status|CONFIRMED |RESOLVED --- Comment #28 from Howard Chu <hyc(a)openldap.org> --- Fixed in 8ba07ad71138d7735df9225638f436dc060266b0 in mdb.master3 Note that this is an incompatible DB format change, DBs must be dumped and reloaded. -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 10412] New: slapadd stops if the ldif files starts with 'version:'
by openldap-its＠openldap.org 16 Dec '25

16 Dec '25

https://bugs.openldap.org/show_bug.cgi?id=10412 Issue ID: 10412 Summary: slapadd stops if the ldif files starts with 'version:' Product: OpenLDAP Version: 2.6.10 Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: client tools Assignee: bugs(a)openldap.org Reporter: elecharny(a)apache.org Target Milestone: --- Injecting data with slapadd fails if the file starts with 'version: 1', with such a message: str2entry: entry -1 has no dn slapadd: could not parse entry (line=1) A LDIF file starting with 'version: 1' is a valid LDIF file per RFC 2849: ldif-file = ldif-content / ldif-changes ldif-content = version-spec 1*(1*SEP ldif-attrval-record) version-spec = "version:" FILL version-number version-number = 1*DIGIT ; version-number MUST be "1" for the ; LDIF format described in this document. -- You are receiving this mail because: You are on the CC list for the issue.

1 3

[Issue 7441] cn=config filters ignore {number}
by openldap-its＠openldap.org 15 Dec '25

15 Dec '25

https://bugs.openldap.org/show_bug.cgi?id=7441 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |TEST Status|IN_PROGRESS |RESOLVED --- Comment #4 from Quanah Gibson-Mount <quanah(a)openldap.org> --- • 3d94d11c by Ondřej Kuzník at 2025-12-08T18:52:59+00:00 ITS#7441 Consider both parts of an X-ORDERED value -- You are receiving this mail because: You are on the CC list for the issue.

1 0

[Issue 6151] Update cosine.schema to RFC 4524
by openldap-its＠openldap.org 15 Dec '25

15 Dec '25

https://bugs.openldap.org/show_bug.cgi?id=6151 Quanah Gibson-Mount <quanah(a)openldap.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |TEST Status|CONFIRMED |RESOLVED Keywords|has_patch, IPR_OK | --- Comment #22 from Quanah Gibson-Mount <quanah(a)openldap.org> --- head: • e6f666a1 by Ondřej Kuzník at 2025-12-04T18:26:33+00:00 ITS#6151 Update cosine.schema for RFC 4524 - adds a new substring match omitted previously (uniqueIdentifier) - removes streetAddress duplication in domain objectclass - prefers short names for MUST/MAY attributes - long definitions (for 'co', 'drink', ...) are NOT removed here - attributes/objectclasses removed by RFC 4524 are NOT removed here Chooses not to remove DESC tags removed in RFC1274 in the interests of keeping the diff small. • aa3e8f34 by Ondřej Kuzník at 2025-12-04T18:26:33+00:00 ITS#6151 Regenerate cosine.ldif -- You are receiving this mail because: You are on the CC list for the issue.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-bugs