On Fri, Sep 05, 2025 at 02:47:52PM +0530, venugopal chinnakotla wrote:

Hi Team,

We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code.

We are using OpenLDAP 2.6.7.

As part of this migration activity,we used ldap_initialize() API for initializing and getting LDAP Handle. Our application supports multi threading. So, ldap_initialize() API will be called from multi threaded code. For example, 2 threads will call ldap_initialize() at same time/simultaneously.

When 2 threads call ldap_initialize() at same time, sometimes observed a race condition during this API call. Due to this, the next api calls ldap_simple_bind_s or ldap_start_tls_s are getting failed for 2 threads and it is not recovered automatically until restarts our applications. We observed this race condition multiple times.

Because of this issue, we are unable to start our application and it becomes a blocker for us to proceed further.

After checking ldap_initialze() API code from openldap source code, noticed that race condition happened while initializing/setting global options.

Are there any known issues with OpenLDAP when we use it in multi thread supported applications?

Could you please check and provide a solution.

Hi Venugopal, libldap documentation[0] explicitly asks that libldap initialisation be done in a thread safe way (=not concurrently as you're doing). Ignoring that (at your peril), you should be calling ldap_get/set_option() first to give the library a chance to initialise itself **before** you call ldap_initialize() to set up a new session, again as the documentation suggests.

[0]. Quoting from https://openldap.org/software/man.cgi?query=ldap_initialize Note: the first call into the LDAP library also initializes the global options for the library. As such the first call should be single- threaded or otherwise protected to insure that only one call is active. It is recommended that ldap_get_option() or ldap_set_option() be used in the program's main thread before any additional threads are created. See ldap_get_option(3).

Regards,