openldap-devel December 2025

openldap-devel@openldap.org

5 participants
4 discussions

searching dynamic values
by Emmanuel Dreyfus 07 Jan '26

07 Jan '26

Hello I am working on a overlay (the same as last time with the internal search question) that produce dynamic values depending on multiple attributes. The model was slapo-dynlist. I added an on_response method and I was able to produce everything needed when handling a search request. That works like a charm. But now I would like to use the generated values in a filter when searching. In some cases, I can modify the filter on the fly in bi_op_search so that it works, but that is not always possible. I thought of two alterantives: 1) In supann_op_add and supann_op_modify, perform an internal modify operation, so that the generated values are actualy added to the entry. But There is a problem: I exit that two methods without knowing if the add or modify operation succeded or not. The dynamic values should not be added if the add/modify operation failed. 2) I could steal some ideas from slapo-dds to update entries in the whole directory on a regular basis. That seems to do a lot of useless activity, and changes will always lag a bit. For now it seems to be the best option. Is there another was of doing it? -- Emmanuel Dreyfus manu(a)netbsd.org

3 7

Timeouts with ldap_search_ext_s and other APIS
by venugopal chinnakotla 10 Dec '25

10 Dec '25

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code. We are using OpenLDAP 2.6.7. As part of this migration, we are facing one issue related to timeouts, that we set LDAP Handle using ldap_set_option and calling an API ldap_search_ext_s. With Mozilla NSLDAP, setting PRLDAP_OPT_IO_MAX_TIMEOUT value to zero in LDAP Handle and making ldap_search_ext_s function call. Also passing timeout value (for Ex: 30 seconds) explicitly as one on the argument. This search call is giving an error: "Timeout error." With OpenLDAP, setting LDAP_OPT_TIMEOUT value to zero in LDAP Handle and making ldap_search_ext_s function call. Also passing timeout value (Same value: 30 seconds) explicitly as one of the arguments. This search call is giving a successful result instead of Timeout error. *Note:* With OpenLDAP, setting LDAP_OPT_TIMEOUT value to zero in LDAP Handle (0 sec, 1 microseconds) and making ldap_search_ext_s function call. Also passing timeout value 30 seconds explicitly as one of the arguments. This search call is giving a successful result instead of Timeout error. *Even tried this: *With OpenLDAP, setting LDAP_OPT_NETWORK_TIMEOUT value to zero in LDAP Handle (0 sec, 1 microseconds) and making ldap_search_ext_s function call. Also passing timeout value 30 seconds explicitly as one of the arguments. This search call is giving a successful result instead of Timeout error. --Here, I think LDAP_OPT_NETWORK_TIMEOUT is applicable only for connection calls. As per our application expected behaviour, with OpenLDAP, search call should give a timeout error, but it is giving a successful result. 1. What is the difference between the implementation of nsldap and OpenLDAP for timeouts? 2. If we want to get a Timeout error in the above use case (setting LDAP_OPT_TIMEOUT to zero) , what should we change with usage of OpenLDAP timeouts and APIs? 3. Also provide me some details on how timeouts are applied for each operation like connect/bind/search calls? 4. Which timeout will take the precedence/consideration when we have different timeouts, one is in LDAP Handle LDAP_OPT_TIMEOUT and another timeout value that we pass explicitly to ldap_searh_ext_s API? a. What happens when we have LDAP_OPT_TIMEOUT (ldo_tm_api in LDAP Handle) has less value than the timeout value specified in ldap_search_ext_s API argument explicitly? b. What happens when we have LDAP_OPT_TIMEOUT (ldo_tm_api in LDAP Handle) has greater value than the timeout value specified in ldap_search_ext_s API argument explicitly? 5. How do these timeouts apply to other API calls ldap_smple_bind_s? 6. Also, can you provide an equivalent timeout in OpenLDAP for Mozilla NSLDAP timeouts? LDAP_X_OPT_CONNECT_TIMEOUT - ( We mapped LDAP_OPT_NETWORK_TIMEOUT in OpenLDA) PRLDAP_OPT_IO_MAX_TIMEOUT - (We mapped LDAP_OPT_TIMEOUT in OpenLDAP) -- Thanks, *c.venugopal*

1 0

patch review
by Wall, Stephen 04 Dec '25

04 Dec '25

I’ve submitted a patch to OpenLDAP, but it doesn’t look like any action has been taken on it. Could a developer look at it and suggest changes, or commit it to the OpenLDAP repository? https://bugs.openldap.org/show_bug.cgi?id=10403 Thank you. -- Stephen Wall Senior Staff Software Engineer 585.924.7550 [cid:image001.png@01DC522C.BEE7E760] REDCOM Laboratories, Inc.<https://www.redcom.com/> Research, Engineering, & Development in Communications One Redcom Center, Victor, NY 14564-0995 https://bugs.openldap.org/show_bug.cgi?id=10403

2 3

Internal search
by Emmanuel Dreyfus 01 Dec '25

01 Dec '25

Hello I am working on a slapd overlay where I need to perform an internal search to validate a modify operation. It is roughtly the same situation as slapo-constraint with an url constraint type. In .bi_op_modify(), I piggy back on Operation with the code below. It works, my callback gets the entry, but when op2.o_bd->be_search() is called, the ldapmodify command gets this: ldap_modify: msgtype: expected 103 got 101 That is, LDAP_RES_SEARCH_RESULT instead of LDAP_RES_MODIFY: the search is not just insternal, its results are sent to the client. What did I do wrong? char filterstr[] = "(objectClass=*)"; Operation op2 = *op; SlapReply rs2 = { REP_RESULT }; (...) op2.ors_filterstr.bv_len = sizeof(filterstr); op2.ors_filterstr.bv_val = op->o_tmpalloc(op2.ors_filterstr.bv_len + 1, op->o_tmpmemctx); strcpy(op2.ors_filterstr.bv_val, filterstr); op2.o_dn = op->o_bd->be_rootdn; op2.o_ndn = op->o_bd->be_rootndn; op2.o_req_dn = op->o_req_dn; op2.o_req_ndn = op->o_req_ndn; op2.o_bd = select_backend(&op2.o_req_ndn, 1 ); op2.o_do_not_cache = 1; op2.o_tag = LDAP_REQ_SEARCH; op2.o_callback = NULL; op2.ors_limit = NULL; op2.ors_slimit = SLAP_NO_LIMIT;; op2.ors_tlimit = SLAP_NO_LIMIT; op2.ors_attrs = slap_anlist_no_attrs; op2.ors_attrsonly = 0; op2.ors_deref = LDAP_DEREF_NEVER; op2.ors_scope = LDAP_SCOPE_BASE; op2.ors_filter = str2filter_x( op, op2.ors_filterstr.bv_val ); cb.sc_response = supann_internal_search_cb; cb.sc_private = op; op2.o_callback = &cb; rc = op2.o_bd->be_search(&op2, &rs2); -- Emmanuel Dreyfus manu(a)netbsd.org

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel December 2025