openldap-technical June 2025

openldap-technical@openldap.org

18 participants
23 discussions

Q: CRL handling for multiple CAs
by Windl, Ulrich 05 Jun '25

05 Jun '25

Hi! I have a question: olcTLSCRLFile is SINGLE-VALUE in OpenLDAP 2.5 When I have different Sub-Cas (say one issuing host certificates, while another issues user certificates) I can handle only one CRL file obviously. Can this scenario be handled in OpenLDAP 2.5 (maybe like concatenating multiple CRLs)? What if the restriction SINGLE-VALUE is dropped? What about the idea adding a second token to olcTLSCRLFile that specifies a regex that must match the certificates subject to use that CRL? Kind regards, Ulrich Windl

2 2

Clarification on RDN Length Limit in MDB Backend (Symas/OpenLDAP 2.6.7)
by anilkumar.pathuri7＠gmail.com 05 Jun '25

05 Jun '25

Hi Team, I'm currently working with OpenLDAP (Symas 2.6.7) using the MDB backend, and we've encountered limitations with the length of a single RDN component while importing LDIFs. **Observed Behavior:** While `MDB_MAXKEYSIZE` is defined as 511 bytes, we found through testing that: - An RDN component (like `uid=...`) of **241 bytes** works - An RDN component of **242 bytes or more** consistently fails with: ldap_add: Other (e.g., implementation specific) error (80) - The full DN length is far below the 8192-byte DN limit, and only the RDN seems to be affected **Test Environment:** - OpenLDAP version: `Symas 2.6.7` - Backend: `mdb` - OS: `RHEL8` We confirmed this limit by iteratively creating entries with increasing `uid` lengths and saw consistent breakage at 242 bytes. **Questions:** 1. Is 241 & below bytes the *officially safe practical limit* for a single RDN in LMDB-based OpenLDAP setups? 2. Can we increase the limit? Reference link: https://www.openldap.org/lists/openldap-technical/201401/msg00239.html Regards, Anil P

3 2

Q: lastbind, pwdLastSuccess, and authTimestamp
by Windl, Ulrich 02 Jun '25

02 Jun '25

Hi! Slapd-config states that pwdLastSuccess (provided by slapd) will be set if olcLastBind is set to true. However to do that the lastbind module/overlay is needed. But the latter sets authTimestamp. Slapo-policy documents that authTimestamp (provided by lastbind module) is set when lastbind is enabled. At it seems pwdLastSuccess and authTimestamp are set to the same value. Can someone explain the logic behind? I'm confused; do I really need the lastbind overlay? I'm using OpenLDAP 2.5.X Kind regards, Ulrich Windl

3 7

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical June 2025