March 2024 - openldap-technical

Multiple memberOf overlays
by John C. Pfeifer 05 Aug '25

05 Aug '25

I am in the process of converting an existing LDAP infrastructure to OpenLDAP. I have a case where it would be convenient for two different objectClasses to map into the memberOf attribute. Is it possible to define two overlay configs or will they end up fighting each other over the memberOf attribute? For instance: dn: olcOverlay={5}memberofA,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {5}memberofA olcMemberOfDangling: error olcMemberOfRefInt: FALSE olcMemberOfGroupOC: objectClassA olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf dn: olcOverlay={6}memberofB,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcMemberOf olcOverlay: {6}memberofB olcMemberOfDangling: error olcMemberOfRefInt: FALSE olcMemberOfGroupOC: objectClassB olcMemberOfMemberAD: member olcMemberOfMemberOfAD: memberOf // John Pfeifer Division of Information Technology University of Maryland, College Park

4 3

olcPPolicyForwardUpdates not working
by Benjamin Renard 18 Jun '25

18 Jun '25

Hello, I have problem with the olcPPolicyForwardUpdates option that seem not working : On master and slave, I configured Ppolicy with pwdLockout. When I try to connect on master with a bad password, the pwdFailureTime attribute of the entry is successfully updated, but not if I do the same on the slave. On slave, my ppolicy configuration is exactly the same as on master but I add olcPPolicyForwardUpdates=TRUE. I also configured the chain overlay and the updateref parameter on the database. Extract of my slave configuration : olcDatabase={1}mdb,cn=config [...] olcSyncrepl: [...] olcUpdateRef: ldaps://ldap-master olcOverlay={0}chain,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcChainConfig objectClass: top olcOverlay: {0}chain olcChainReturnError: TRUE olcDatabase={0}ldap,olcOverlay={0}chain,olcDatabase={1}mdb,cn=config objectClass: olcLDAPConfig objectClass: olcChainDatabase objectClass: top olcDatabase: {0}ldap olcDbURI: ldaps://ldap-master olcDbIDAssertBind: bindmethod=simple binddn="[same user used in olcSyncrepl of the database]" credentials="secret" mode=self olcDbRebindAsUser: TRUE olcOverlay={1}ppolicy,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcPPolicyConfig objectClass: top olcOverlay: {1}ppolicy olcPPolicyHashCleartext: TRUE olcPPolicyUseLockout: TRUE olcPPolicyForwardUpdates: TRUE Do you have any idea of what I doing wrong ? Thanks, -- Benjamin Renard - Easter-eggs 44-46 rue de l'Ouest - 75014 Paris - France - Métro Gaité Phone: +33 (0) 1 43 35 00 37 - mailto:brenard@easter-eggs.com

3 20

openldap TLSv1.0 is enabled
by Andre Rodier 16 May '25

16 May '25

Hello, I have configured OpenLDAP using SSL certificate, but I have a few issues. Here the TLS configuration, especially "olcTLSProtocolMin: 3.3" > # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify. > # CRC32 c70363a6 > dn: cn=config > objectClass: olcGlobal > cn: config > olcArgsFile: /var/run/slapd/slapd.args > olcLogLevel: none > olcPidFile: /var/run/slapd/slapd.pid > olcToolThreads: 1 > structuralObjectClass: olcGlobal > entryUUID: 40ee991a-0efe-103d-855a-11ff3a5638b4 > creatorsName: cn=config > createTimestamp: 20221213065102Z > olcPasswordCryptSaltFormat: $6$%.16s > olcTLSCACertificateFile: /etc/ldap/certs/ldap.homebox.world.issuer.crt > olcTLSCertificateKeyFile: /etc/ldap/certs/ldap.homebox.world.key > olcTLSCertificateFile: /etc/ldap/certs/ldap.homebox.world.crt > olcTLSProtocolMin: 3.3 > entryCSN: 20221214054517.926245Z#000000#000#000000 > modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth > modifyTimestamp: 20221214054517Z But if I try sslscan: I see TLSv1.0, TLSv1.1 and TLSv1.2 enabled. Why ? > root@main:/etc/ldap/changes# sslscan ldap.homebox.world:636 > Version: 2.0.7 > OpenSSL 1.1.1n 15 Mar 2022 > > Connected to 2001:19f0:7402:86e:5400:4ff:fe38:b9b4 > > Testing SSL server ldap.homebox.world on port 636 using SNI name ldap.homebox.world > > SSL/TLS Protocols: > SSLv2 disabled > SSLv3 disabled > TLSv1.0 enabled > TLSv1.1 enabled > TLSv1.2 enabled > TLSv1.3 enabled > > TLS Fallback SCSV: > Server supports TLS Fallback SCSV > > TLS renegotiation: > Secure session renegotiation supported > > TLS Compression: > OpenSSL version does not support compression > Rebuild with zlib1g-dev package for zlib support > > Heartbleed: > TLSv1.3 not vulnerable to heartbleed > TLSv1.2 not vulnerable to heartbleed > TLSv1.1 not vulnerable to heartbleed > TLSv1.0 not vulnerable to heartbleed > > Supported Server Cipher(s): > Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253 > Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253 > Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253 > Accepted TLSv1.3 128 bits TLS_AES_128_CCM_SHA256 Curve 25519 DHE 253 > Preferred TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits ECDHE-RSA-CHACHA20-POLY1305 Curve 25519 DHE 253 > Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.2 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.2 256 bits AES256-GCM-SHA384 > Accepted TLSv1.2 256 bits AES256-CCM > Accepted TLSv1.2 128 bits AES128-GCM-SHA256 > Accepted TLSv1.2 128 bits AES128-CCM > Accepted TLSv1.2 256 bits AES256-SHA > Accepted TLSv1.2 128 bits AES128-SHA > Preferred TLSv1.1 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.1 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.1 256 bits AES256-SHA > Accepted TLSv1.1 128 bits AES128-SHA > Preferred TLSv1.0 256 bits ECDHE-RSA-AES256-SHA Curve 25519 DHE 253 > Accepted TLSv1.0 128 bits ECDHE-RSA-AES128-SHA Curve 25519 DHE 253 > Accepted TLSv1.0 256 bits AES256-SHA > Accepted TLSv1.0 128 bits AES128-SHA > > Server Key Exchange Group(s): > TLSv1.3 128 bits secp256r1 (NIST P-256) > TLSv1.3 192 bits secp384r1 (NIST P-384) > TLSv1.3 260 bits secp521r1 (NIST P-521) > TLSv1.3 128 bits x25519 > TLSv1.3 224 bits x448 > TLSv1.3 112 bits ffdhe2048 > TLSv1.3 128 bits ffdhe3072 > TLSv1.3 150 bits ffdhe4096 > TLSv1.3 175 bits ffdhe6144 > TLSv1.3 192 bits ffdhe8192 > TLSv1.2 128 bits secp256r1 (NIST P-256) > TLSv1.2 192 bits secp384r1 (NIST P-384) > TLSv1.2 260 bits secp521r1 (NIST P-521) > TLSv1.2 128 bits x25519 > TLSv1.2 224 bits x448 > > SSL Certificate: > Signature Algorithm: sha256WithRSAEncryption > RSA Key Strength: 2048 > > Subject: ldap.homebox.world > Altnames: DNS:ldap.homebox.world > Issuer: (STAGING) Artificial Apricot R3 > > Not valid before: Dec 13 05:34:29 2022 GMT > Not valid after: Mar 13 05:34:28 2023 GMT Thanks for your insights. Andre

6 13

Re: Replication issue during performance test with MMR configuration and LastBind enabled
by Falgon 16 Oct '24

16 Oct '24

Hello, I'm working on the same project as Meheni. Thanks for your answer, we'll try version 2.6 OpenLDAP using the lastbind-precision. However we have several questions for the current version we're using. Is this a known problem and referenced somewhere? (we haven't found it) Is it normal to find no replication error logs even in stats + sync mode? We ran some tests in sequential mode (300,000 accounts one after the other) and managed to reproduce the problem. -Denis Le mer. 11 oct. 2023 à 14:11, Quanah Gibson-Mount <quanah(a)fast-mail.org> a écrit : > > > --On Tuesday, October 10, 2023 9:30 PM +0200 Ziani Meheni > <mehani06(a)gmail.com> wrote: > > > > > > > Hello, we are working on a project and we've come across a problem with > > the replication after performance testing : > > You need to use OpenLDAP 2.6 and then set the: > > lastbind-precision > > value. I use 5 minutes. > > --Quanah >

4 8

Help debugging slave slapd issues
by BECOT Jérôme 04 Apr '24

04 Apr '24

Hello, On all different OpenLDAP 2.4 and 2.5 slaves of 2.4 servers, we see a lot of deferring errors: slapd[37277]: connection_input: conn=32974 deferring operation: too many executing or slapd[37277]: connection_input: conn=32974 deferring operation: pending operations Can you give any hints about way to debug what causes these messages ? (which log level should I aim for and witch system settings should I check) I can provide more details then. Regards Jerome

6 9

Permissive Modify and mdb
by lesignor＠cirad.fr 02 Apr '24

02 Apr '24

Hi, I try to modify an entry with permissive modify control. The response is protocole error : permissiveModify control value not absent. I check with wireshark the request, and there was no value with the control, but the control was marked as critical. The problem appears with openldap 2.5.x and 2.6.x with mdb database. It is ok with openldap 2.4.x with bdb database. So is the permissive modify control supported with mdb database in openldap >= 2.5.x ? Thank for your help

2 2

Strange search result in logs
by Frédéric Goudal 27 Mar '24

27 Mar '24

Hello, I’m trying to analyse the requests done to my ldapserver from a nas. While browsing the logs I found the following entries : Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 fd=38 ACCEPT from IP=10.220.18.3:47000 (IP=0.0.0.0:636) Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 fd=38 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.2 tls_cipher=ECDHE-RSA-AES256-GCM-SHA384 Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 op=0 BIND dn="" method=128 Mar 27 09:35:45 ldapd2021 slapd[3670819]: conn=2910400 op=0 RESULT tag=97 err=0 qtime=0.000014 etime=0.000110 text= ….. Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SRCH base="ou=people,dc=ipb,dc=fr" scope=1 deref=0 filter="(&(objectClass=posixAccount)(gidNumber=*)) Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SRCH attr=gidNumber Mar 27 09:37:43 ldapd2021 slapd[3670819]: conn=2910400 op=720 SEARCH RESULT tag=101 err=4 qtime=0.000007 etime=0.000224 nentries=1 text= But if I do the same seach : Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 fd=31 ACCEPT from IP=127.0.0.1:56536 (IP=0.0.0.0:636) Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 fd=31 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=0 BIND dn="" method=128 Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=0 RESULT tag=97 err=0 qtime=0.000008 etime=0.000040 text= Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SRCH base="ou=people,dc=ipb,dc=fr" scope=1 deref=0 filter="(&(objectClass=posixAccount)(gidNumber=*))" Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SRCH attr=gidNumber Mar 27 09:58:34 ldapd2021 slapd[3670819]: conn=2911004 op=1 SEARCH RESULT tag=101 err=0 qtime=0.000011 etime=0.054003 nentries=5206 text= I have no specific ACL on the ip quering. What I see is that in the first case I have err=4, from what I have found it means size limit exceeded. Do you have an explanation of the first anwser ? Is there any param that can be in the request to cause the err=4 ? Maybe I should rise the logLevel to find the difference between the two requests ? Thanks in advance for any hint... — Frédéric Goudal Ingénieur Système, DSI Bordeaux-INP +33 556 84 23 11

3 3

how to migrate an openldap server to a new linux server
by xpzhang1971＠gmail.com 27 Mar '24

27 Mar '24

I have an openldap server I want to clone it to another linux server. However, I can't access it by login but can just run ldapsearch because this source openldap server only open port 389. Now I installed openldap-servers package to target linux server, then what? I appreciate if anybody can instruct me or direct me to useful documents.

5 14

etensibleObject vs. creating a new schema
by Uwe Sauter 26 Mar '24

26 Mar '24

Hi all, I was wondering if there is any best practice when to use extensibleObject in contrast to creating new objectClasses within a local schema. E.g. I have the need to filter the visibility of posixGroups depending on some attribute when sssd is accessing the directory. What I could do is to use an extra objectClass: extensibleObject to allow all defined attributes (e.g. host) to be used within my object. I could also create a new objectClass ( 2.25.$UUID.1.2.1 NAME 'myGroup' DESC 'Group with host attribute' SUP posixGroup AUXILIARY MAY host ) As far as I can tell using extensibleObject has the disadvantage to more or less disable the checks for correct attribute usage. Are there more positive or negative aspects to extensibleObject? I'd like to hear your thought on this. Thanks, Uwe

1 0

Logo usage
by Gloria Semme 21 Mar '24

21 Mar '24

Dear OpenLDAP Technical Team, I am reaching out to seek your guidance and permission regarding the use of the OpenLDAP logo. My team is in the process of creating a Grafana integration designed to facilitate the monitoring of OpenLDAP applications for our users. To enhance user experience and direct attention effectively, we plan to incorporate the OpenLDAP logo within the Grafana Cloud interface. Upon reviewing the available licensing information, we noted the absence of specific guidelines related to the use of the OpenLDAP logo. Given this, we wish to ensure our use aligns with your expectations and policies. Our design considerations include adjusting the logo to fit a square format to suit the dashboard's aesthetic. We are committed to respecting your branding guidelines and are open to any alternative suggestions or requirements you may have. We appreciate your support in this endeavor and look forward to your guidance. Thank you for your guidance. Best regards, -- [image: photo] *Gloria Semme* Sr. Engineering Manager Cloud Infrastructure Observability gloria.semme(a)grafana.com www.grafana.com

2 1

olcDbURI
by Bradley T Gill 15 Mar '24

15 Mar '24

Good Morning Group. I am struggling to find any documentation on this. Is there a limit to the amount of olcDbURI that can be defined for SASL? While I'm here, I might as well ask if there is a way to make it more resilient? Our servers get quarantined during pathing of AD and eventually SASL is broken until I restart OpenLDAP. Thanks! Bradley Gill

1 0

Lock conflicts?
by rzhou44＠tutamail.com 12 Mar '24

12 Mar '24

At work we have a program that actively reads/writes into LMDB file. This program uses MDB_NOLOCK (why, I'm not sure yet). Can I safely read/write to this LMDB file using my own programs or mdb_ command line tools? I worry that those (which by default use lock files) could conflict with the manual locking of the existing program and cause data corruptions. Thanks -Zhou

2 3

Configure replication without a plaintext password.
by mbalakri＠opentext.com 09 Mar '24

09 Mar '24

How to configure olcSyncrepl without a plaintext password? I tried using credentials="{SSHA256}jRlrKRCcrhYo7SqbPDc5WkoSxaHc8y/e0DPWaAnveUkQpQ7wEOWhsw==" format. Does olcSyncrepl accepts password in {SSHA256} format?

5 8

LMDB fix sized key and data question
by anton＠pcloud.com 07 Mar '24

07 Mar '24

Hello, I'm designing an application that will use LMDB. All (or almost all) of my databases will have a fixed size integer key (64bit) and fixed size data. Data is larger than a single integer but generally in 16-32 bytes range (range is for different databases, each database has a fixed data format). I'll not have duplicate key records. I'll mostly insert and retrieve single records. The question is would I benefit and should I use MDB_DUPSORT|MDB_DUPFIXED? Also the documentation says that MDB_DUPFIXED may only be used with MDB_DUPSORT. However I see code that specifically checks for MDB_DUPFIXED without MDB_DUPSORT and only then sets a flag for DUPFIXED records. However I did not get too deep in the code. https://github.com/LMDB/lmdb/blob/mdb.master/libraries/liblmdb/mdb.c#L7743 My point is that with fixed sized keys and values the btree may chose not to store record sizes, may not use pointers for the binary search but to search values instead and so on. Is that the optimization that is being done for MDB_DUPFIXED or is it something that only concerns duplicate values? Best, Anton

2 1

Counter concurrency access
by Pascal Jakobi 06 Mar '24

06 Mar '24

Hi there I am creating a program that needs to increment a counter. Typically a serial number has to be incremented every time I create a certificate. The problem is to handle concurrent access. Fundamentally I need to 1/ read the counter 2/ increment it. Therefore no one must be provided access to the counter during these two operations. Therefore I need to set a lock before the read operation and release it after the update. Is there a way to do this with OL ? I am conscious of the ldapmodify features thanks to Clement, however, this will not lock the read. Thks in adv. P

2 2

slapo-translucent bug?
by Marco Esposito M. 05 Mar '24

05 Mar '24

Dear openldap-technical, I have encountered an issue with slapo-translucent and I am trying to determine whether it is a problem with my configuration or a bug. By mistake, I opened a ticket on OpenLDAP ITS, and rightfully, I have been redirected here. https://bugs.openldap.org/show_bug.cgi?id=10184 The problem is as follows: the results from a translucent OpenLDAP server do not return any entry when a single attribute is present in the query filter. This attribute has been previously modified and is present in the local database of the translucent OpenLDAP server. To better explain the issue, I have set up an environment with containers. The repository is as follows: https://github.com/voidloop/openldap-bug To bring up the environment, two commands are needed: % make submodules % make docker-run Three containers will be running: upstream: a simple LDAP server with a couple of users, listening on port 51389/tcp. buggy: the translucent server from upstream with the problematic behavior, listening on port 52389/tcp. compiled: the translucent server from upstream recompiled with the modified code where I suspect there might be an issue, listening on port 53389/tcp. The containers are simple Fedora instances with OpenLDAP. Once the following ldapmodify command is executed: % ldapmodify -x -D cn=buggy,dc=example,dc=com -w password -H ldap://:52389 <<EOF dn: uid=ciccio,ou=people,dc=example,dc=com changetype: modify replace: uidNumber uidNumber: 99 EOF The following occurs: 1) Querying servers without filters: ------------------------------------------------------------------------------- Server "upstream" ------------------------------------------------------------------------------- % ldapsearch -x -H ldap://:51389 -b ou=people,dc=example,dc=com uid=ciccio # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=ciccio # requesting: ALL # # ciccio, people, example.com dn: uid=ciccio,ou=people,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount uid: ciccio cn: Ciccio Bello sn: Bello uidNumber: 1000 gidNumber: 1000 homeDirectory: /home/ciccio # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------------------------------------------------------- Translucent server "buggy" ------------------------------------------------------------------------------- % ldapsearch -x -H ldap://:52389 -b ou=people,dc=example,dc=com uid=ciccio # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=ciccio # requesting: ALL # # ciccio, people, example.com dn: uid=ciccio,ou=people,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount uid: ciccio cn: Ciccio Bello sn: Bello uidNumber: 99 gidNumber: 1000 homeDirectory: /home/ciccio # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------------------------------------------------------- Translucent server "compiled" ------------------------------------------------------------------------------- % ldapsearch -x -H ldap://:53389 -b ou=people,dc=example,dc=com uid=ciccio # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=ciccio # requesting: ALL # # ciccio, people, example.com dn: uid=ciccio,ou=people,dc=example,dc=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount uid: ciccio cn: Ciccio Bello sn: Bello uidNumber: 99 gidNumber: 1000 homeDirectory: /home/ciccio # search result search: 2 result: 0 Success # numResponses: 2 So far, everything is okay, no anomalous behavior. The issue arises when a filter is introduced. 2) Querying servers with a filter ------------------------------------------------------------------------------- Server "upstream" ------------------------------------------------------------------------------- % ldapsearch -x -H ldap://:51389 -b ou=people,dc=example,dc=com uid=ciccio uidNumber # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=ciccio # requesting: uidNumber # # ciccio, people, example.com dn: uid=ciccio,ou=people,dc=example,dc=com uidNumber: 1000 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ------------------------------------------------------------------------------- Translucent server "buggy" (!!) ------------------------------------------------------------------------------- % ldapsearch -x -H ldap://:52389 -b ou=people,dc=example,dc=com uid=ciccio uidNumber # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=ciccio # requesting: uidNumber # # search result search: 2 result: 0 Success # numResponses: 1 ------------------------------------------------------------------------------- Translucent server "compiled" ------------------------------------------------------------------------------- % ldapsearch -x -H ldap://:53389 -b ou=people,dc=example,dc=com uid=ciccio uidNumber # extended LDIF # # LDAPv3 # base <ou=people,dc=example,dc=com> with scope subtree # filter: uid=ciccio # requesting: uidNumber # # ciccio, people, example.com dn: uid=ciccio,ou=people,dc=example,dc=com uidNumber: 99 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Why does this behavior occur? I expect the "buggy" server to return the uidNumber attribute. The version of OpenLDAP in the container is the one installed with the Fedora package manager. Server configurations are available in the Git repository, but for convenience, I am listing them here: upstream: https://github.com/voidloop/openldap-bug/blob/main/upstream/slapd.ldif https://github.com/voidloop/openldap-bug/blob/main/upstream/entries.ldif buggy: https://github.com/voidloop/openldap-bug/blob/main/buggy/slapd.ldif compiled: https://github.com/voidloop/openldap-bug/blob/main/compiled/slapd.ldif The source code modification is as follows: % diff openldap/servers/slapd/overlays/translucent.c translucent.c -u --- openldap/servers/slapd/overlays/translucent.c 2024-02-29 11:30:52.620837844 +0100 +++ translucent.c 2024-02-29 11:14:11.274843929 +0100 @@ -928,16 +928,7 @@ /* send it now */ rs->sr_entry = re; rs->sr_flags |= REP_ENTRY_MUSTBEFREED; - if ( test_f ) { - rc = test_filter( op, rs->sr_entry, tc->orig ); - if ( rc == LDAP_COMPARE_TRUE ) { - rc = SLAP_CB_CONTINUE; - } else { - rc = 0; - } - } else { - rc = SLAP_CB_CONTINUE; - } + rc = SLAP_CB_CONTINUE; } } else if ( le ) { /* Only a local entry: remote was deleted I have also found posts from individuals who have identified the same issue, but either received no response or the response was unsatisfactory: https://openldap.org/lists/openldap-technical/201304/msg00069.html https://www.openldap.org/lists/openldap-bugs/200905/msg00159.html https://www.openldap.org/lists/openldap-technical/201106/msg00036.html Thank you for your attention, and I apologize for the lengthy message. Marco

2 2

OpenLDAP SQL
by kimkihoon 05 Mar '24

05 Mar '24

I'm trying to use mysql external db server for openLDAP db. I just read this README file from openldap github(https://github.com/openldap/openldap/blob/master/servers/slapd/back-… But it seems only localhost server can be used. Can anyone tell me how? Thx for the help

3 2

Fwd: New Ldap 2.6.6 in Kubernetes
by Jignesh Patel 01 Mar '24

01 Mar '24

We have set up a new docker OpenLDAP Version 2.6.6 on Kubernetes. We could migrate all the data except the following two attributes *authTimestamp* and *lastLoginTime* not working in personalized schema. How to configure them?

2 1

Disable uniqueness for mail Attribute
by CALDEIRA JAVIEL Sandro 01 Mar '24

01 Mar '24

Hi, I have a legacy ldap instance (openlda-2.4) which has in the same redundant user info containing mail attribute among others (objectclass: inetOrgPerson) in 2 different ous (objectclass: organizationalUnit). I know it is a bad design for ldap users structure but I am not allowed to change it in a short time. When I tried to migrate this ldap database to openldap 2.6 I realize this is not possible anymore. I identified it is just related to mail attribute because if I omit mail attribute or use a different value for mail, then all data is imported properly. Error from phpldapadmin: Attribute value would not be unique This update has been or will be cancelled, it would result in an attribute value not being unique. You might like to search the LDAP server for the offending entry. (Search) warn LDIF text import Could not add object cn=*****,ou=Users,ou=TRG01,dc=***,dc=*****,dc=** LDAP said: Success Error number: 0x00 (LDAP_SUCCESS) Description: The operation completed successfully.

3 9

memberOf with groupOfNames
by Stefan Kania 01 Mar '24

01 Mar '24

Hi to all, up to now I only used: olcDlAttrSet: groupOfURLs memberURL member+memberOf@groupOfNames to dynamically add the Attribute memberOf to all members of a groupOfURLs. Is it possible to do the same with members for groupOfNames and groupOfUniqueNames? I yes, can someone please post the syntax? Stefan

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical March 2024