openldap-technical October 2026

openldap-technical@openldap.org

9 participants
10 discussions

Password policy and olcSecurity
by BECOT Jérôme 21 Oct '26

21 Oct '26

Hello, I have a consumer (2.5) using ppolicy and the chain overlay to forward updates to the provider node. We use olcSecurity: ssf=128 simple_bind=128 update_ssf=256 on the consumer side, but allow 128bit ciphers. We expected that clients using less secured ciphers would not be able to do any write operation on the consumer (forwarded by the chain overlay /olcPpolicyForward updates is True on the database config), but it also affects the password policy that is not able to update security fields like pwdFailureTime (we get a 'ppolicy_bind_response: ppolicy state change failed with rc=13 text=stronger confidentiality required for update' error in the logs). I'm surprised that the SSF check applies to ppolicy as it is an overlay that only applies operational attribute updates in this case. Is it the intended behaviour or did we have miss something ? Regards Jerome

2 1

RE26 testing call (2.6.16) #3
by Quanah Gibson-Mount 15 Oct '26

15 Oct '26

This is the third testing call for OpenLDAP 2.6.16. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.16 Engineering Fixed slapd GnuTLS client-cert verification handling (ITS#10616) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Contrib Fixed slappw-sha2 pointer aliasing (ITS#10611) Minor Cleanup ITS#10581 ITS#10586 ITS#10587 ITS#10588 ITS#10592 ITS#10593 ITS#10595 ITS#10596 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610 ITS#10612 ITS#10620 ITS#10621

2 2

RE27 testing call (2.7.2) #3
by Quanah Gibson-Mount 14 Oct '26

14 Oct '26

This is the third testing call for OpenLDAP 2.7.2. Depending on the results, this may be the final testing call. Generally, get the code for RE27: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_7/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.7.2 Engineering Added slapd support for comments with ACLS (ITS#5500,ITS#10619) Added slapd-config option to throttle when qtime exceeds threshold (ITS#10617) Added slapo-nssov option to forward updates (ITS#8149) Fixed libldap with deeply nested URL filters (ITS#10585) Fixed slapd GnuTLS client-cert verification handling (ITS#10616) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Contrib Fixed slappw-sha2 pointer aliasing (ITS#10611) Minor Cleanup ITS#8617 ITS#8884 ITS#10455 ITS#10581 ITS#10573 ITS#10586 ITS#10587 ITS#10588 ITS#10589 ITS#10592 ITS#10593 ITS#10594 ITS#10595 ITS#10596 ITS#10599 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610 ITS#10612 ITS#10620 ITS#10621

1 0

pwdLastSuccess and modifyTimestamp
by BONTEMPS Colin 13 Oct '26

13 Oct '26

Hello, This is my first post on this list. I’m Colin, an IAM engineer based in France. Has anyone else noticed that /modifyTimestamp /is updated with each bind operation when /lastbind /is on ? In my view, a bind operation doesn’t actually modify the entry, so I’d expect /modifyTimestamp /not to be updated along with /pwdLastSuccess/. I need a way to identify when non-technical attributes of an entry are updated. I couldn’t find any existing bug report or discussion about this, so I’m reaching out here. Thanks for your help, and have a great day! -- Colin Bontemps colin.bontemps(a)cnrs.fr

2 1

pass-through-authentication between Openldap directories
by Bauer-Lee, Sue 13 Oct '26

13 Oct '26

Hey all – Reaching out to see if anyone has successful experience with the following scenario as I’m struggling to find appropriate documentation. I have Openldap 2.6 directories on Oracle Linux 9 in multiple data centers – all with different naming contexts appropriate to the local environment. Because we’re not able to implement a federated SSO solution, I’d like to limit user password management by use of ‘remoteauth’ from one location to the other. I used this in Ping Identity awhile back – its plugin does a password comparison and updates the local; it seems not the case with Openldap. So yes, the ‘userPassword’ attribute was removed from all the records where I want to remote authenticate – although i did see *somewhere* that it could be fetched and stored locally (I’d hope for comparison on future auth requests?). In my case though, the provider is NOT Active Directory. As such I think the attribute values should be different in the overlay but I don’t see documentation to reflect that. ☹ I did take a stab at it but authentication fails – as I pretty much expected. {6}remoteauth.la is loaded. OLC configuration Primary/Master: dc=a,dc=b,dc=com (already part of a mirror replication pair) Consumer: dc=x,dc=y,dc=com (currently has data minus ‘userPassword’ attribute) The below isn’t correct ….. but I don’t know what the correct values *should* be …… dn: olcOverlay=remoteauth,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRemoteAuthCfg olcOverlay: remoteauth olcRemoteAuthTLS: starttls=yes tls_reqcert=never olcRemoteAuthMapping: default ldap://remote-host -> owns dc=a,dc=b,dc=com olcRemoteAuthDNAttribute: entryDN olcRemoteAuthDefaultRealm: ldap://localhost -> owns dc=x,dc=y,dc=com olcRemoteAuthStore: FALSE olcRemoteAuthRetryCount: 3 Please help? 🍒 Thanks in advance.

3 3

RE27 testing call (2.7.2) #2
by Quanah Gibson-Mount 12 Oct '26

12 Oct '26

This is the second testing call for OpenLDAP 2.7.2. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_7/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.7.2 Engineering Added slapd support for comments with ACLS (ITS#5500,ITS#10619) Added slapo-nssov option to forward updates (ITS#8149) Fixed libldap with deeply nested URL filters (ITS#10585) Fixed slapd GnuTLS client-cert verification handling (ITS#10616) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Contrib Fixed slappw-sha2 pointer aliasing (ITS#10611) Minor Cleanup ITS#8884 ITS#10455 ITS#10581 ITS#10573 ITS#10586 ITS#10587 ITS#10588 ITS#10589 ITS#10592 ITS#10593 ITS#10594 ITS#10595 ITS#10596 ITS#10599 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610 ITS#10612

2 2

RE26 testing call (2.6.16) #2
by Quanah Gibson-Mount 12 Oct '26

12 Oct '26

This is the second testing call for OpenLDAP 2.6.16. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.16 Engineering Fixed slapd GnuTLS client-cert verification handling (ITS#10616) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Contrib Fixed slappw-sha2 pointer aliasing (ITS#10611) Minor Cleanup ITS#10581 ITS#10586 ITS#10587 ITS#10588 ITS#10592 ITS#10593 ITS#10595 ITS#10596 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610 ITS#10612

2 1

new certs no longer working for replication due to missing Client Authentication EKU
by steiner＠rutgers.edu 07 Oct '26

07 Oct '26

Evidently it is now the standard to not have the Client Authentication EKU included in TLS server certs so as my certs get updated (we changed providers recently), replication has stopped working. Is there a suggested solution to this problem. As far as we can tell, we can't get Client Authentication EKU with Certinext certs. Do I need to have separate self generated certs for replication? thanks, ds

2 3

RE26 testing call (2.6.16) #1
by Quanah Gibson-Mount 03 Oct '26

03 Oct '26

This is the first testing call for OpenLDAP 2.6.16. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.16 Engineering Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Minor Cleanup ITS#10586 ITS#10587 ITS#10588 ITS#10592 ITS#10593 ITS#10595 ITS#10596 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610

3 2

RE27 testing call (2.7.2) #1
by Quanah Gibson-Mount 01 Oct '26

01 Oct '26

This is the first testing call for OpenLDAP 2.7.2. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_7/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.7.2 Engineering Fixed libldap with deeply nested URL filters (ITS#10585) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Minor Cleanup ITS#8884 ITS#10455 ITS#10573 ITS#10586 ITS#10587 ITS#10588 ITS#10589 ITS#10592 ITS#10593 ITS#10594 ITS#10595 ITS#10596 ITS#10599 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical October 2026