openldap-technical August 2026

openldap-technical@openldap.org

10 participants
7 discussions

Security policy
by Howard Chu 01 Sep '26

01 Sep '26

Since AI-driven "researchers" are submitting more bug reports these days in hopes of adding CVEs to their CVs, we're probably going to need to publish a more formalized security policy on the openldap.org web site. This is an example of what we're starting with. Feedback welcome. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

5 10

Which schemes and attributes?
by Stef Bon 21 Aug '26

21 Aug '26

Hi, I'm writing a DNSSD service, it works different than Avahi. It does dns discovery, and writes the records to a backend. At this moment the following I want to be supported: - ldap - sqlite - filesystem With the first, which scheme/attribute is there? It is about: - network host dns names - ip address (ipv4 and/or ipv6) - services like SMB, CUPS, SSH etc. with port I see a lot of good attributes like ipServicePort, ipProtocolNumber and ipHostNumber, in schema NIS, but I miss the hostname (==string) and servicename, and the original dnssd type (_ssh_tcp etc) Can you give and advice which attributes (or objectclass) to take? The following I have so far: - network hostname: nisObject (I don't know) - ip address: ipHostNumber - service name: ipServiceProtocol and ipServicePort So is nisObject a good candidate for a dns hostname? Stef

2 2

olcAccess
by Gustavo Rios 21 Aug '26

21 Aug '26

Hi folks, i have installed my openldap servers. I would like to replace the defaults olc access for my own preferences. How could i delete de installation default and replace by mine. The file is : /etc/ldap/slapd.d/cn=config/olcDatabase\=\{1\}mdb.ldif Only the relevant part(s) : olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to * by * read How to delete this and load my own access ? Thanks a lot -- In software systems the price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay.

2 3

ldap schema
by Gustavo Rios 19 Aug '26

19 Aug '26

Hi folks! i need to load the qmail.schema for my system works well. I have copied it to /etc/ldap/schema, but it is working .... What more do i need to do? My slapd is below: etosha# slapd -VV @(#) $OpenLDAP: slapd 2.6.10+dfsg-1 (May 29 2025 23:41:48) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> thanks alot your time and cooperation. best regards. -- In software systems the price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay.

2 1

Discussion: LDAP caching pagination
by Françis Castagna 18 Aug '26

18 Aug '26

hello folks, I hope you are well and thank you for providing a forum for users to raise inquiries. *Context*: I have this query shape that is quite expensive, coming in from python ldap3 lib used in many of my clients. I decided to put openldap using the pcache overlay between my clients and my AD servers to cache the results. ```python # The python code using ldap3 python lib # Below expands to (&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=cn=<group>,ou=REDACTED,ou=REDACTED,ou=REDACTED,ou=REDACTED,dc=REDACTED,dc=com)) for entry in conn.extend.standard.paged_search( search_base, search_filter, scope, attributes=list(attributes), paged_size=page_size, generator=True, ): ``` I am using these attribute sets and templates (cropped for brevity) ``` ... database ldap suffix "dc=REDACTED" uri ldap://REDACTED.com/ overlay pcache pcache mdb 100000 6 1000 100 pcacheAttrset 0 uidNumber gidNumber sAMAccountName loginShell sn pcacheAttrset 1 member uidNumber gidNumber loginShell sAMAccountName memberOf cn name pcacheAttrset 2 whenCreated mail sAMAccountName cn objectclass whenChanged userprincipalname uidNumber objectGUID sn memberOf userPrincipalName userAccountControl pwdLastSet loginShell pcacheAttrset 3 cn name sAMAccountName memberOf uidNumber gidNumber distinguishedName unixHomeDirectory REDACTED pcacheAttrset 4 gidNumber sAMAccountName pcacheAttrset 5 name member gidNumber sAMAccountName cn pcacheTemplate (&(objectClass=)(gidNumber=)) 0 10800 pcacheTemplate (&(objectClass=)(gidNumber=)) 4 10800 pcacheTemplate (&(objectClass=)(cn=)) 1 10800 pcacheTemplate (&(objectClass=group)(cn=)) 1 10800 pcacheTemplate (sAMAccountName=) 0 3600 ... ``` *Problem observed* I can't seem to get the paged queries to be cached and it only returns my AD server max limit of 1000 items even when there are more results leading to inacurrate results in my clients. ``` # LOGS 6a7cd2f0.2447015f 0x7f65effff640 conn=53266 op=3 SRCH base="ou=REDACTED,dc=com" scope=2 deref=3 filter="(&(objectClass=user)(!(objectClass=computer)))" 6a7cd2f0.2447c7b1 0x7f65effff640 conn=53266 op=3 SRCH attr=unixHomeDirectory sAMAccountName REDACTED uidNumber gidNumber name cn distinguishedName memberOf 6a7cd2f0.24480fd2 0x7f65effff640 conn=53266 op=3: non-critical pagedResults control disabled with proxy cache; stripped. 6a7cd2f0.244819ea 0x7f65effff640 conn=53266 op=3: non-critical control "1.2.840.113556.1.4.1339" not supported; stripped. 6a7cd2f0.24484d6b 0x7f65effff640 query template of incoming query = (&(objectClass=)(!(objectClass=))) 6a7cd2f0.24485ba0 0x7f65effff640 QUERY NOT ANSWERABLE 6a7cd2f0.24486181 0x7f65effff640 QUERY NOT CACHEABLE ``` I tried a number of permutation to fix this, but upon inspecting the code it seems that pagination is explicitly not supported. From this line: https://github.com/openldap/openldap/blob/fe9c74b257398deab91ef2ec69011df3c… *Questions:* 1. Is there an accepted design for adding pagedResults support to pcache (cookie handling, stable ordering, cursor state)? 2. Is there a recommended way to cache paged searches or to internally page cached results while forwarding a single non‑paged search to the backend? 3. Are there existing patches or modules that solve this (or similar) in OpenLDAP? Many thanks! Francis

1 0

openldap
by Gustavo Rios 15 Aug '26

15 Aug '26

Hi folks. I am writing because i need to setup ldap to work with qmail. At the present moment i am faced with the task to load qmail.schema within the openldap server. The problem is while i have qmail.schema in my home directory, i have no qmail.ldif. Where may i download qmail.ldif from ? Thanks. Regards -- In software systems the price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay.

3 2

configuring sasl+heimdal+openldap
by Gustavo Rios 11 Aug '26

11 Aug '26

Hi folks. I am trying to get openldap working nicely, but i am facing some problems i cannot know how to solve this problems. I am trying : dpkg-reconfigure slapd And it creats the initial config. I would like to change the admin user to some one different from cn=admin. Is it possible to be done ? Second: i have some configuration in slapd.conf format, how to apply the relevant part only to the new way of running slapd ? I would like to preserve the access directives for the new format! How could i only change the access directives for the current openldap. Thank you for your time cooperation. Best regards. -- In software systems the price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay.

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical August 2026