openldap-devel

openldap-devel@openldap.org

1 participants
1425 discussions

Re: LDAP race condition with ldap_initialize API in OpenLDAP 2.6.7
by Ondřej Kuzník 09 Sep '25

09 Sep '25

On Fri, Sep 05, 2025 at 02:47:52PM +0530, venugopal chinnakotla wrote: > Hi Team, > > We are working on migration of nsldap C sdk to OpenLDAP C sdk for our > application client code. > > We are using OpenLDAP 2.6.7. > > As part of this migration activity,we used ldap_initialize() API for > initializing and getting LDAP Handle. Our application supports multi > threading. So, ldap_initialize() API will be called from multi threaded > code. For example, 2 threads will call ldap_initialize() at same > time/simultaneously. > > When 2 threads call ldap_initialize() at same time, sometimes observed a > race condition during this API call. Due to this, the next api calls > ldap_simple_bind_s or ldap_start_tls_s are getting failed for 2 threads and > it is not recovered automatically until restarts our applications. We > observed this race condition multiple times. > > Because of this issue, we are unable to start our application and it > becomes a blocker for us to proceed further. > > After checking ldap_initialze() API code from openldap source code, noticed > that race condition happened while initializing/setting global options. > > Are there any known issues with OpenLDAP when we use it in multi thread > supported applications? > > Could you please check and provide a solution. Hi Venugopal, libldap documentation[0] explicitly asks that libldap initialisation be done in a thread safe way (=not concurrently as you're doing). Ignoring that (at your peril), you should be calling ldap_get/set_option() first to give the library a chance to initialise itself **before** you call ldap_initialize() to set up a new session, again as the documentation suggests. [0]. Quoting from https://openldap.org/software/man.cgi?query=ldap_initialize Note: the first call into the LDAP library also initializes the global options for the library. As such the first call should be single- threaded or otherwise protected to insure that only one call is active. It is recommended that ldap_get_option() or ldap_set_option() be used in the program's main thread before any additional threads are created. See ldap_get_option(3). Regards, -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Re: Need information related to multi thread support in OpenLDAP c sdk client
by Ondřej Kuzník 09 Sep '25

09 Sep '25

On Fri, Sep 05, 2025 at 03:26:28PM +0530, venugopal chinnakotla wrote: > Hi Team, > > We are working on migration of nsldap C sdk to OpenLDAP c sdk for our > application client code. As part of this activity, replacing API one by one > and also looking for constant replacement. > > In NSLDAP C SDK: /* * Thread function callbacks (an API extension -- * > LDAP_API_FEATURE_X_THREAD_FUNCTIONS). */ #define LDAP_OPT_THREAD_FN_PTRS > 0x05 /* 5 - API extension */ > > Now, we are looking for similar functionality within OpenLDAP to use it in > our client program. I Went through OpenLDAP documents and source code, but > to my knowledge, did not get any equivalent one. > > Could you please provide more details on this to achieve equivalent > functionality of LDAP_OPT_THREAD_FN_PTRS with OpenLDAP? Hi Venugopal, in libldap, these functions are not runtime settable, the correct implementation is selected at compile time based on the target environment, usually PThreads or NT Threads. Regards, -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

ITS#6198 Authorization for extensions proposal
by Ondřej Kuzník 12 Aug '25

12 Aug '25

Hi all, being able to restrict extensions has been a long standing enhancement request. We now have a proposal[0] how the access control language could be extended to support this. If you ever had a need to restrict extops/controls to certain users/parts of their directory, this feature is for you: I would be grateful if you could think about your needs and see how you might be able to fulfill them with the new features. Any feedback on how well it does (not) feel like a good fit, showing use cases it doesn't seem to be able to cover or general usability suggestions, all of the above would be of great help. After initial round of feedback, we'd like to see if this work (or version of it) can become part of 2.7 as an experimental ACL syntax much like set ACLs are now. It would then be subject to stabilisation as we get more confident that the syntax is good enough for people. [0]. https://git.openldap.org/openldap/openldap/-/merge_requests/720 Thanks, -- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com Packaged, certified, and supported LDAP solutions powered by OpenLDAP

1 0

Website issues
by Howard Chu 09 Jul '25

09 Jul '25

While static page serving has gone on uninterrupted, the CGI for bugzilla and manpages was timing out due to some kind of spam attack. I've tweaked the fail2ban config to catch more of the offending requests, and increased the bantime for these requests to 72 hours, up from the default of 10 minutes. Bugzilla appears to be running normally now. Considering increasing the bantime further, we'll see. Reply to this thread if you notice any other problems in the next few days. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

OpenSSL in the Wild survey (fwd)
by Quanah Gibson-Mount 01 Jul '25

01 Jul '25

Howard do you want to fill out this survey? Not sure if they're taking feedback. ;) --Quanah ------------ Forwarded Message ------------ Date: Wednesday, June 18, 2025 6:33 PM -0700 From: Jon Ericson <jone(a)openssl.org> To: openssl-users <openssl-users(a)openssl.org> Subject: OpenSSL in the Wild survey Hi all, I'm the communities manager for the OpenSSL Foundation and I could use your help. We'd like to know who uses OpenSSL and how it's used. To that end, we're asking everyone to complete this short, one-page survey: https://secure.lglforms.com/form_engine/s/85lymH2pkvzm26KyuxafBQ Not only will it help us understand the people who use the library, we also know it will surface some interesting stories. When you're done with the survey, why not send it to other people who use OpenSSL in their work? Thanks, Jon -- You received this message because you are subscribed to the Google Groups "openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to openssl-users+unsubscribe(a)openssl.org. To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-users/CAK9c5VYUnfA5 Yab6jk8bRkL4NcxV6QqhDatfYYdj_t3m%3DmZz1Q%40mail.gmail.com. ---------- End Forwarded Message ----------

1 0

Re: Please authorise my Git Lab account
by Arran Cudbard-Bell 24 Jun '25

24 Jun '25

Hello openldap-devel, Could you please approve my gitlab account. uid: arr2036, email: a.cudbardb(a)freeradius.org. Many Thanks, -Arran

2 1

Referral chasing, ITS#10356
by Howard Chu 12 Jun '25

12 Jun '25

I note that there is a default REFHOPLIMIT defined in ldap-int.h and a refhoplimit field in the ldap options structure. But there is no option defined to change it via ldap_set_option(). Seems like a 26 year oversight. Should that be added for 2.7? -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

2 1

ITS#10160 + gitlab account validation
by Alexandre Jousset 07 Feb '25

07 Feb '25

Hi 🖖, I commented on ITS#10160 about "adding negset and negurl for slapo-constraint" that was left unanswered for about one year. I'd like to have my account on the gitlab instance (username "mid") validated so I can submit an MR, please 🙂 Thanks! -- -- \^/ -- -- -/ O \------------------------------------ -- -- | |/ \| Alexandre (Mid') Jousset | -- -- -|___|------------------------------------ --

2 2

ITS#9739 + gitlab account validation
by Zhixu Liu 06 Feb '25

06 Feb '25

Hi, I commented on ITS#9739 about "Undefined reference to ber_sockbuf_io_udp" please approve the account request on gitlab from this email address, thanks. -- Z. Liu

2 1

ldap_get_values() called on binary data - does this return an error, or garbage data?
by Graham Leggett 03 Apr '24

03 Apr '24

Hi all, Looking back in time to the definitions of ldap_get_values() and ldap_get_values_len(), we are told that "If the attribute values are binary in nature, and thus not suitable to be returned as an array of char *'s, the ldap_get_values_len() routine can be used instead." This has been historically vague - first off, what happens if an attempt is made to call ldap_get_values() on binary data, do you get an error, or garbage data? The source isn't giving me a clear answer. Second question is how do you know which of ldap_get_values() or ldap_get_values_len() to call? Obviously you can manually know this, but I'm interested in automated behaviour. What is the canonical way to discover that if you queried a jpegPhoto (for example) that the result would be binary? To be clear, the end goal it to patch the following documentation to make this clear: https://www.openldap.org/software/man.cgi?query=ldap_get_values&apropos=0&s… Regards, Graham --

4 6

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

openldap-devel