openldap-technical January 2026

openldap-technical@openldap.org

16 participants
13 discussions

replication deleting users
by steiner＠rutgers.edu 31 Jan '26

31 Jan '26

I'm having an issue with LDAP replication hanging on our AWS ldap users (our master is on prem). So I've been playing with timeouts and keepalive But sometimes when I restart the slapd, it will start to continue replication and then all of a sudden it will start deleting all the users: syncrepl_del_nonpresent: rid=222 be_delete DN (0) and the only way I've found to recover is to stop the slapd, slapcat from the master and slapadd the ldif file into the consumer. Anyone know why this may be happening? Am I missing some setting that I haven't found yet? thanks, ds

2 2

sssd 2.6.3 and openldap 2.5.19 ppolicies
by Felix Natter 30 Jan '26

30 Jan '26

Dear openldap experts, my problem is that my ubuntu 22.04 systems do not honor password expirations (ppolicy/shadow) and ppolicy password complexities. I tried to track this down with AI: * our server does not seem to advertise the OpenLDAP ppolicy control * The ppolicy control OID that SSSD requires (only on Ubuntu, not on RH7) is: 1.3.6.1.4.1.42.2.27.9.5.1 * But your server (OpenlDAP 2.5.19) advertises only these ppolicy‑related controls(?): (ldapsearch -x -H ldap://SERVER -s base -b "" "+") supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8 supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1 * When using ldap_pwd_policy = ppolicy in /etc/sssd/sssd.conf, sssd crashes on startup * this also does not work: ldap_pwd_policy = ppolicy ldap_ppolicy_compat = True Is this train of thought anywhere close to useful? Is there another reason why e.g. passwd(1) ignores password settings on Ubuntu 22.04? Many Thanks and Best Regards, Felix -- Felix Natter debian/rules!

2 2

RE26 testing call (2.6.11) #2
by Quanah Gibson-Mount 29 Jan '26

29 Jan '26

This is the second testing call for OpenLDAP 2.6.11. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.11 Engineering Fixed slapd to use fresh timestamp for lastbind (ITS#10379) Fixed slapd delta-syncrepl to always use logDB rootdn (ITS#10360) Fixed slapd reverse lookup of proxied IPv6 addresses (ITS#10387) Fixed slapd logging (ITS#10410) Fixed slapd-ldap response when invalid secprops is configured (ITS#10392) Fixed slapd-mdb error when deleting last child of a branch (ITS#10304) Fixed slapd-mdb check for pool pause in search (ITS#10191) Fixed slapo-memberof clash with refint on subtree rename (ITS#10398) Fixed slapo-syncprov use correct rootDN for accesslog replay (ITS#10385) Minor Cleanup ITS#7901 ITS#10329 ITS#10335 ITS#10339 ITS#10343 ITS#10344 ITS#10345 ITS#10347 ITS#10348 ITS#10349 ITS#10353 ITS#10358 ITS#10359 ITS#10366 ITS#10367 ITS#10369 ITS#10370 ITS#10371 ITS#10372 ITS#10374 ITS#10375 ITS#10376 ITS#10377 ITS#10379 ITS#10380 ITS#10381 ITS#10384 ITS#10388 ITS#10390 ITS#10391 ITS#10400 ITS#10401 ITS#10408 Thanks, Quanah

4 7

Re: [LMDB] Tag problem - update is needed
by Quanah Gibson-Mount 28 Jan '26

28 Jan '26

--On Tuesday, January 27, 2026 2:09 PM +0000 * Neustradamus * <neustradamus(a)hotmail.com> wrote: > Dear OpenLDAP/LMDB team, > > There is an historical problem for Embedded Database LMDB (Lightning > Memory-Mapped Database) source code. > > The latest LMDB version is 0.9.31 (2023-07-10): > - https://github.com/LMDB/lmdb/tags > > Source: > - https://www.symas.com/mdb > > A complete update is possible? > > At the same time, can you change your visibility from "Private" to > "Public"? - https://github.com/orgs/LMDB/people > - https://github.com/orgs/openldap/people > > Note: LMDB 0.9.30 is missing too. Hi, Don't cross post to multiple lists. The official OpenLDAP git repository is at https://git.openldap.org you should be using that. The github location is a mirror that routinely breaks when doing updates. Regards, Quanah

2 2

Error# '-4 Decoding error' with ldap_search_ext_s API
by venugopal chinnakotla 26 Jan '26

26 Jan '26

Hi Team, We are working on migration of nsldap C sdk to OpenLDAP C sdk for our application client code. We are using OpenLDAP 2.6.7. As part of this migration, we are facing one issue related to Decoding Error while making ldap_search_ext_s API under load. OpenLDAP C SDK API ldap_search_ext_s is giving -4 : Decoding error when we are making a search call to LDAP server (with SSL and without SSL) under load with multi threading. Here are few log messages related to -4: decoding error [10052/17636][ERROR]Error# '-4' during search: 'error: Decoding error' Search Query = '(cn=user1)' for server 'ldapserver1:10001' [10052/15624][ERROR]Error# '-4' during search: 'error: Decoding error' Search Query = '(cn=user2)' for server 'ldapserver1:10001' When we run the same load with NSLDAP, we are not getting any Decoding errors. Whenever we switch to OpenLDAP APIs and run the load, we are getting Decoding errors for few transactions under the load. Could you please look into this and provide any solution available for this issue? Thank you. -- Thanks, *c.venugopal*

4 3

[LMDB] Nested transactions
by Stefano Cossu 18 Jan '26

18 Jan '26

Hi there, I am trying to create a nested RW transaction under a RO transaction in LMDB v0.9.33: int nested_op (MDB_env *env, MDB_txn *th) { MDB_txn *ptxn, *txn; if (th) ptxn = th; else mdb_txn_begin (env, NULL, MDB_RDONLY, &ptxn); return mdb_txn_begin (env, ptxn, 0, &txn); } (rc checks skipped in example) th can be NULL or an existing open transaction. It may be RW or RO. If I run this code, the second mdb_txn_begin call fails with EINVAL. If I set the parent in that call to NULL, it succeeds. I verified that env is healthy and I can open other transactions in it; in fact, the first mdb_txn_begin succeeds. According to the manual, I should be able to do this. Is the sample code correct? Thanks, Stefano

2 2

Re: RE26 testing call (2.6.11) #2
by Jean-Luc Bourguignon 15 Jan '26

15 Jan '26

Hello Quanah, configure, make, make test, make its were ok under Red Hat Enterprise Linux release 8.10 (Ootpa) Linux 4.18.0-553.72.1.el8_10.x86_64 #1 SMP Sat Aug 23 20:13:38 EDT 2025 x86_64 x86_64 x86_64 GNU/Linux Brgds, Jean-Luc. On Tue, Jan 13, 2026 at 1:19 AM Quanah Gibson-Mount <quanah(a)fast-mail.org> wrote: > This is the second testing call for OpenLDAP 2.6.11. Depending on the > results, this may be the final testing call. > > Generally, get the code for RE26: > > < > https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o… > > > > Extract, configure, and build. > > Execute the test suite (via make test) after it is built. Optionally, cd > tests && make its to run through the regression suite. > > Thanks! > > OpenLDAP 2.6.11 Engineering > Fixed slapd to use fresh timestamp for lastbind (ITS#10379) > Fixed slapd delta-syncrepl to always use logDB rootdn (ITS#10360) > Fixed slapd reverse lookup of proxied IPv6 addresses (ITS#10387) > Fixed slapd logging (ITS#10410) > Fixed slapd-ldap response when invalid secprops is configured > (ITS#10392) > Fixed slapd-mdb error when deleting last child of a branch > (ITS#10304) > Fixed slapd-mdb check for pool pause in search (ITS#10191) > Fixed slapo-memberof clash with refint on subtree rename > (ITS#10398) > Fixed slapo-syncprov use correct rootDN for accesslog replay > (ITS#10385) > Minor Cleanup > ITS#7901 > ITS#10329 > ITS#10335 > ITS#10339 > ITS#10343 > ITS#10344 > ITS#10345 > ITS#10347 > ITS#10348 > ITS#10349 > ITS#10353 > ITS#10358 > ITS#10359 > ITS#10366 > ITS#10367 > ITS#10369 > ITS#10370 > ITS#10371 > ITS#10372 > ITS#10374 > ITS#10375 > ITS#10376 > ITS#10377 > ITS#10379 > ITS#10380 > ITS#10381 > ITS#10384 > ITS#10388 > ITS#10390 > ITS#10391 > ITS#10400 > ITS#10401 > ITS#10408 > > > Thanks, > Quanah >

1 0

RE26 testing call (2.6.11) #1
by Quanah Gibson-Mount 12 Jan '26

12 Jan '26

This is the first testing call for OpenLDAP 2.6.11. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.11 Engineering Fixed slapd to use fresh timestamp for lastbind (ITS#10379) Fixed slapd delta-syncrepl to always use logDB rootdn (ITS#10360) Fixed slapd reverse lookup of proxied IPv6 addresses (ITS#10387) Fixed slapd logging (ITS#10410) Fixed slapd-ldap response when invalid secprops is configured (ITS#10392) Fixed slapd-mdb error when deleting last child of a branch (ITS#10304) Fixed slapd-mdb check for pool pause in search (ITS#10191) Fixed slapo-memberof clash with refint on subtree rename (ITS#10398) Fixed slapo-syncprov use correct rootDN for accesslog replay (ITS#10385) Minor Cleanup ITS#7901 ITS#10329 ITS#10335 ITS#10339 ITS#10343 ITS#10344 ITS#10345 ITS#10347 ITS#10348 ITS#10349 ITS#10353 ITS#10358 ITS#10359 ITS#10366 ITS#10367 ITS#10369 ITS#10370 ITS#10371 ITS#10372 ITS#10374 ITS#10375 ITS#10376 ITS#10377 ITS#10379 ITS#10380 ITS#10381 ITS#10384 ITS#10388 ITS#10390 ITS#10391 ITS#10400 ITS#10401 ITS#10408

2 3

Syncrepl problem in Vagrant environment
by Stefan Kania 09 Jan '26

09 Jan '26

Hi to all, I have a strange problem. If I install the following LDIFs in an multi provider environment, build directly on vritualBox VMs, everyting is fine: --------Schema extension -------- dn: cn=stkaPosixExtension,cn=schema,cn=config objectClass: olcSchemaConfig cn: stkaPosixExtension olcObjectClasses: ( 1.3.6.1.4.1.56860.1.2.1 NAME 'stkaPosixGroup' DESC 'advanced PosixGroup for dynamic use' SUP top AUXILIARY MUST ( cn $ gidNumber ) MAY ( userPassword $ memberUid $ description ) ) olcObjectClasses: ( 1.3.6.1.4.1.56860.1.2.2 NAME 'stkaPosixAccount' DESC 'advanced PosixAccount for dynamic use' SUP posixAccount AUXILIARY MAY ( memberUID ) ) -------------------------------- ---- Overlay autogroup ------------ dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: autogroup.la dn: olcOverlay=autogroup,olcDatabase={2}mdb,cn=config changetype: add objectClass: olcAutoGroupConfig objectClass: olcOverlayConfig olcOverlay: autogroup olcAutoGroupAttrSet: groupOfURLs memberURL memberUID ----------------------------------- dn: cn=dynposix,ou=groups,dc=example,dc=net cn: dynposix objectClass: top objectClass: groupOfURLs objectClass: stkaPosixGroup gidNumber: 4242 memberURL: ldap:///dc=example,dc=net?memberUID?sub?(title=Linuxuser) --- dynamic group ------------- --- dynamic group user ------- dn: uid=dynuser,ou=users,dc=example,dc=net objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: stkaPosixAccount cn: John Doe sn: Dynamo title: Linuxuser uid: dynuser gidNumber: 1000 homeDirectory: /home/dynuser uidNumber: 12345 userPassword: {ARGON2}$argon2i$v=19$m=4096,t=3,p=1$ZHN2cnZ0... memberUid: dynuser ------------------------------ I can see the user, replication of cn0config is working, even if I add new changes. No I want to do a setup with vagrant and Debian13. As soon as I try to add the overlay (the schema extension is working fine) the OpenLDAP i crashing wit the following message: ------------------------------ Dec 16 11:16:49 ldap02 slapd[3344]: syncprov_db_open: starting syncprov for suffix cn=config Dec 16 11:16:49 ldap02 slapd[3344]: conn=-1 op=0 syncprov_findcsn: mode=FIND_MAXCSN csn= Dec 16 11:16:49 ldap02 systemd[1]: symas-openldap-server.service: Main process exited, code=killed, status=11/SEGV Dec 16 11:16:49 ldap02 systemd[1]: symas-openldap-server.service: Failed with result 'signal'. ------------------------------ I have never seen this message before. Any hint where I can search for the problem? Stefan

3 4

SASL Targets Quarantined
by Bradley T Gill 08 Jan '26

08 Jan '26

I am not sure of the quarantine is a function of OpenLDAP or Cyrus SASL. But is it's behavior configurable? Too many times when AD is patched, all of our targets go into quarantine of will not attempt SASL until restarted. It would be more robust to wait 10 minutes and try again, then 20, 30, and hour, etc.. So it can recover gracefully. Is that possible how the solution stands now? Thanks, Brad

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical January 2026