thanks a lot this was exactly the problem!
When disabling the dynlist overlay valsort works flawlessly. It seems like valsort
can't cope with attribute-value pairs "created" by dynlist.
Although valsort is not mission critical (at least for us) I'll file an ITS anyways,
because in some cases it's still a more than nice to have feature ;)
It is not valsort, it is probabely your design of dynlist.
You either specify in slapd.conf a dynlist-attrset with group-oc
URL-at and member-at, and no attribut in the URL string of memberURL,
or you specify no member-at in slapd.conf but an attribute in the URL
string. Otherwise slapd runs in an endless loop comparing member-at
At least that is, what I experienced.
Dieter Klünter | Systemberatung
GPG Key ID:8EF7B6C6