openldap-technical October 2026

openldap-technical@openldap.org

5 participants
4 discussions

pass-through-authentication between Openldap directories
by Bauer-Lee, Sue 10 Oct '26

10 Oct '26

Hey all – Reaching out to see if anyone has successful experience with the following scenario as I’m struggling to find appropriate documentation. I have Openldap 2.6 directories on Oracle Linux 9 in multiple data centers – all with different naming contexts appropriate to the local environment. Because we’re not able to implement a federated SSO solution, I’d like to limit user password management by use of ‘remoteauth’ from one location to the other. I used this in Ping Identity awhile back – its plugin does a password comparison and updates the local; it seems not the case with Openldap. So yes, the ‘userPassword’ attribute was removed from all the records where I want to remote authenticate – although i did see *somewhere* that it could be fetched and stored locally (I’d hope for comparison on future auth requests?). In my case though, the provider is NOT Active Directory. As such I think the attribute values should be different in the overlay but I don’t see documentation to reflect that. ☹ I did take a stab at it but authentication fails – as I pretty much expected. {6}remoteauth.la is loaded. OLC configuration Primary/Master: dc=a,dc=b,dc=com (already part of a mirror replication pair) Consumer: dc=x,dc=y,dc=com (currently has data minus ‘userPassword’ attribute) The below isn’t correct ….. but I don’t know what the correct values *should* be …… dn: olcOverlay=remoteauth,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRemoteAuthCfg olcOverlay: remoteauth olcRemoteAuthTLS: starttls=yes tls_reqcert=never olcRemoteAuthMapping: default ldap://remote-host -> owns dc=a,dc=b,dc=com olcRemoteAuthDNAttribute: entryDN olcRemoteAuthDefaultRealm: ldap://localhost -> owns dc=x,dc=y,dc=com olcRemoteAuthStore: FALSE olcRemoteAuthRetryCount: 3 Please help? 🍒 Thanks in advance.

1 0

new certs no longer working for replication due to missing Client Authentication EKU
by steiner＠rutgers.edu 07 Oct '26

07 Oct '26

Evidently it is now the standard to not have the Client Authentication EKU included in TLS server certs so as my certs get updated (we changed providers recently), replication has stopped working. Is there a suggested solution to this problem. As far as we can tell, we can't get Client Authentication EKU with Certinext certs. Do I need to have separate self generated certs for replication? thanks, ds

2 3

RE26 testing call (2.6.16) #1
by Quanah Gibson-Mount 03 Oct '26

03 Oct '26

This is the first testing call for OpenLDAP 2.6.16. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.16 Engineering Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Minor Cleanup ITS#10586 ITS#10587 ITS#10588 ITS#10592 ITS#10593 ITS#10595 ITS#10596 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610

3 2

RE27 testing call (2.7.2) #1
by Quanah Gibson-Mount 01 Oct '26

01 Oct '26

This is the first testing call for OpenLDAP 2.7.2. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_7/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.7.2 Engineering Fixed libldap with deeply nested URL filters (ITS#10585) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Minor Cleanup ITS#8884 ITS#10455 ITS#10573 ITS#10586 ITS#10587 ITS#10588 ITS#10589 ITS#10592 ITS#10593 ITS#10594 ITS#10595 ITS#10596 ITS#10599 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical October 2026