openldap-technical

openldap-technical@openldap.org

10 participants
9989 discussions

Security policy
by Howard Chu 24 Aug '26

24 Aug '26

Since AI-driven "researchers" are submitting more bug reports these days in hopes of adding CVEs to their CVs, we're probably going to need to publish a more formalized security policy on the openldap.org web site. This is an example of what we're starting with. Feedback welcome. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

5 9

Which schemes and attributes?
by Stef Bon 21 Aug '26

21 Aug '26

Hi, I'm writing a DNSSD service, it works different than Avahi. It does dns discovery, and writes the records to a backend. At this moment the following I want to be supported: - ldap - sqlite - filesystem With the first, which scheme/attribute is there? It is about: - network host dns names - ip address (ipv4 and/or ipv6) - services like SMB, CUPS, SSH etc. with port I see a lot of good attributes like ipServicePort, ipProtocolNumber and ipHostNumber, in schema NIS, but I miss the hostname (==string) and servicename, and the original dnssd type (_ssh_tcp etc) Can you give and advice which attributes (or objectclass) to take? The following I have so far: - network hostname: nisObject (I don't know) - ip address: ipHostNumber - service name: ipServiceProtocol and ipServicePort So is nisObject a good candidate for a dns hostname? Stef

2 2

olcAccess
by Gustavo Rios 21 Aug '26

21 Aug '26

Hi folks, i have installed my openldap servers. I would like to replace the defaults olc access for my own preferences. How could i delete de installation default and replace by mine. The file is : /etc/ldap/slapd.d/cn=config/olcDatabase\=\{1\}mdb.ldif Only the relevant part(s) : olcAccess: {0}to attrs=userPassword by self write by anonymous auth by * none olcAccess: {1}to attrs=shadowLastChange by self write by * read olcAccess: {2}to * by * read How to delete this and load my own access ? Thanks a lot -- In software systems the price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay.

2 3

ldap schema
by Gustavo Rios 19 Aug '26

19 Aug '26

Hi folks! i need to load the qmail.schema for my system works well. I have copied it to /etc/ldap/schema, but it is working .... What more do i need to do? My slapd is below: etosha# slapd -VV @(#) $OpenLDAP: slapd 2.6.10+dfsg-1 (May 29 2025 23:41:48) $ Debian OpenLDAP Maintainers <pkg-openldap-devel(a)lists.alioth.debian.org> thanks alot your time and cooperation. best regards. -- In software systems the price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay.

2 1

Discussion: LDAP caching pagination
by Françis Castagna 18 Aug '26

18 Aug '26

hello folks, I hope you are well and thank you for providing a forum for users to raise inquiries. *Context*: I have this query shape that is quite expensive, coming in from python ldap3 lib used in many of my clients. I decided to put openldap using the pcache overlay between my clients and my AD servers to cache the results. ```python # The python code using ldap3 python lib # Below expands to (&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=cn=<group>,ou=REDACTED,ou=REDACTED,ou=REDACTED,ou=REDACTED,dc=REDACTED,dc=com)) for entry in conn.extend.standard.paged_search( search_base, search_filter, scope, attributes=list(attributes), paged_size=page_size, generator=True, ): ``` I am using these attribute sets and templates (cropped for brevity) ``` ... database ldap suffix "dc=REDACTED" uri ldap://REDACTED.com/ overlay pcache pcache mdb 100000 6 1000 100 pcacheAttrset 0 uidNumber gidNumber sAMAccountName loginShell sn pcacheAttrset 1 member uidNumber gidNumber loginShell sAMAccountName memberOf cn name pcacheAttrset 2 whenCreated mail sAMAccountName cn objectclass whenChanged userprincipalname uidNumber objectGUID sn memberOf userPrincipalName userAccountControl pwdLastSet loginShell pcacheAttrset 3 cn name sAMAccountName memberOf uidNumber gidNumber distinguishedName unixHomeDirectory REDACTED pcacheAttrset 4 gidNumber sAMAccountName pcacheAttrset 5 name member gidNumber sAMAccountName cn pcacheTemplate (&(objectClass=)(gidNumber=)) 0 10800 pcacheTemplate (&(objectClass=)(gidNumber=)) 4 10800 pcacheTemplate (&(objectClass=)(cn=)) 1 10800 pcacheTemplate (&(objectClass=group)(cn=)) 1 10800 pcacheTemplate (sAMAccountName=) 0 3600 ... ``` *Problem observed* I can't seem to get the paged queries to be cached and it only returns my AD server max limit of 1000 items even when there are more results leading to inacurrate results in my clients. ``` # LOGS 6a7cd2f0.2447015f 0x7f65effff640 conn=53266 op=3 SRCH base="ou=REDACTED,dc=com" scope=2 deref=3 filter="(&(objectClass=user)(!(objectClass=computer)))" 6a7cd2f0.2447c7b1 0x7f65effff640 conn=53266 op=3 SRCH attr=unixHomeDirectory sAMAccountName REDACTED uidNumber gidNumber name cn distinguishedName memberOf 6a7cd2f0.24480fd2 0x7f65effff640 conn=53266 op=3: non-critical pagedResults control disabled with proxy cache; stripped. 6a7cd2f0.244819ea 0x7f65effff640 conn=53266 op=3: non-critical control "1.2.840.113556.1.4.1339" not supported; stripped. 6a7cd2f0.24484d6b 0x7f65effff640 query template of incoming query = (&(objectClass=)(!(objectClass=))) 6a7cd2f0.24485ba0 0x7f65effff640 QUERY NOT ANSWERABLE 6a7cd2f0.24486181 0x7f65effff640 QUERY NOT CACHEABLE ``` I tried a number of permutation to fix this, but upon inspecting the code it seems that pagination is explicitly not supported. From this line: https://github.com/openldap/openldap/blob/fe9c74b257398deab91ef2ec69011df3c… *Questions:* 1. Is there an accepted design for adding pagedResults support to pcache (cookie handling, stable ordering, cursor state)? 2. Is there a recommended way to cache paged searches or to internally page cached results while forwarding a single non‑paged search to the backend? 3. Are there existing patches or modules that solve this (or similar) in OpenLDAP? Many thanks! Francis

1 0

openldap
by Gustavo Rios 15 Aug '26

15 Aug '26

Hi folks. I am writing because i need to setup ldap to work with qmail. At the present moment i am faced with the task to load qmail.schema within the openldap server. The problem is while i have qmail.schema in my home directory, i have no qmail.ldif. Where may i download qmail.ldif from ? Thanks. Regards -- In software systems the price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay.

3 2

configuring sasl+heimdal+openldap
by Gustavo Rios 11 Aug '26

11 Aug '26

Hi folks. I am trying to get openldap working nicely, but i am facing some problems i cannot know how to solve this problems. I am trying : dpkg-reconfigure slapd And it creats the initial config. I would like to change the admin user to some one different from cn=admin. Is it possible to be done ? Second: i have some configuration in slapd.conf format, how to apply the relevant part only to the new way of running slapd ? I would like to preserve the access directives for the new format! How could i only change the access directives for the current openldap. Thank you for your time cooperation. Best regards. -- In software systems the price of reliability is the pursuit of the utmost simplicity. It is a price which the very rich find most hard to pay.

1 0

RE27 testing call (2.7.0 alpha) #1
by Quanah Gibson-Mount 28 Jul '26

28 Jul '26

This is a testing call for the forthcoming OpenLDAP 2.7.0 alpha release. Note that the LMDB library has been updated to the 1.0 series, so if deploying this early RE27 into an existing 2.6 deployment it will be required to do a database dump via slapcat under 2.6, and then import the database with slapadd under 2.7. Generally, get the code for RE27: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_7/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! Regards, Quanah

2 1

RE26 testing call (2.6.14) #1
by Quanah Gibson-Mount 28 Jul '26

28 Jul '26

This is the first testing call for OpenLDAP 2.6.14. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.14 Engineering Added libldap support for OpenSSL 4.0 series (ITS#10498) Fixed lloadd to report errors from bindconf_parse (ITS#10525) Fixed lloadd incoming message id validation (ITS#10505) Fixed slapd to report errors from bindconf_parse (ITS#10525) Fixed slapd-mdb IDL code to optimize the intersection of a list and a range (ITS#10526) Fixed slapo-constraint count constraint with more than one attribute (ITS#10491) Fixed slapadd to ignore dynamic attributes in input LDIF (ITS#10501) Minor Cleanup ITS#8064 ITS#9909 ITS#10026 ITS#10467 ITS#10469 ITS#10470 ITS#10471 ITS#10473 ITS#10476 ITS#10479 ITS#10480 ITS#10481 ITS#10482 ITS#10483 ITS#10484 ITS#10485 ITS#10489 ITS#10492 ITS#10493 ITS#10478 ITS#10495 ITS#10496 ITS#10500 ITS#10503 ITS#10510 ITS#10514 ITS#10516 ITS#10524 ITS#10530 ITS#10532 ITS#10533 ITS#10535 ITS#10541 ITS#10543 ITS#10548 ITS#10550 --Quanah

2 1

slapmodify replaces entryUUID
by Hawes, David 22 Jul '26

22 Jul '26

I had a need to populate an attribute with slapmodify and was surprised to find that the entryUUID is also changed when olcLastMod=TRUE. This caused issues with a system that expected those values to remain static. The slapmodify man page doesn't mention this, and I had to look at source code for an explanation. At the very least it would be nice for the man page to warn about this, but it would be better to have an option to disable this behavior without having to change slapd configuration. I find the defaults to be less than desirable, and this could also cause issues with syncrepl for full refreshes. It makes sense to update the other operational attributes like creatorsName and createTimestamp, but why would anyone ever want the entryUUID to change?

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical