openldap-technical

openldap-technical@openldap.org

8 participants
9998 discussions

pwdLastSuccess and modifyTimestamp
by BONTEMPS Colin 13 Oct '26

13 Oct '26

Hello, This is my first post on this list. I’m Colin, an IAM engineer based in France. Has anyone else noticed that /modifyTimestamp /is updated with each bind operation when /lastbind /is on ? In my view, a bind operation doesn’t actually modify the entry, so I’d expect /modifyTimestamp /not to be updated along with /pwdLastSuccess/. I need a way to identify when non-technical attributes of an entry are updated. I couldn’t find any existing bug report or discussion about this, so I’m reaching out here. Thanks for your help, and have a great day! -- Colin Bontemps colin.bontemps(a)cnrs.fr

2 1

pass-through-authentication between Openldap directories
by Bauer-Lee, Sue 13 Oct '26

13 Oct '26

Hey all – Reaching out to see if anyone has successful experience with the following scenario as I’m struggling to find appropriate documentation. I have Openldap 2.6 directories on Oracle Linux 9 in multiple data centers – all with different naming contexts appropriate to the local environment. Because we’re not able to implement a federated SSO solution, I’d like to limit user password management by use of ‘remoteauth’ from one location to the other. I used this in Ping Identity awhile back – its plugin does a password comparison and updates the local; it seems not the case with Openldap. So yes, the ‘userPassword’ attribute was removed from all the records where I want to remote authenticate – although i did see *somewhere* that it could be fetched and stored locally (I’d hope for comparison on future auth requests?). In my case though, the provider is NOT Active Directory. As such I think the attribute values should be different in the overlay but I don’t see documentation to reflect that. ☹ I did take a stab at it but authentication fails – as I pretty much expected. {6}remoteauth.la is loaded. OLC configuration Primary/Master: dc=a,dc=b,dc=com (already part of a mirror replication pair) Consumer: dc=x,dc=y,dc=com (currently has data minus ‘userPassword’ attribute) The below isn’t correct ….. but I don’t know what the correct values *should* be …… dn: olcOverlay=remoteauth,olcDatabase={2}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcRemoteAuthCfg olcOverlay: remoteauth olcRemoteAuthTLS: starttls=yes tls_reqcert=never olcRemoteAuthMapping: default ldap://remote-host -> owns dc=a,dc=b,dc=com olcRemoteAuthDNAttribute: entryDN olcRemoteAuthDefaultRealm: ldap://localhost -> owns dc=x,dc=y,dc=com olcRemoteAuthStore: FALSE olcRemoteAuthRetryCount: 3 Please help? 🍒 Thanks in advance.

3 3

RE27 testing call (2.7.2) #2
by Quanah Gibson-Mount 12 Oct '26

12 Oct '26

This is the second testing call for OpenLDAP 2.7.2. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_7/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.7.2 Engineering Added slapd support for comments with ACLS (ITS#5500,ITS#10619) Added slapo-nssov option to forward updates (ITS#8149) Fixed libldap with deeply nested URL filters (ITS#10585) Fixed slapd GnuTLS client-cert verification handling (ITS#10616) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Contrib Fixed slappw-sha2 pointer aliasing (ITS#10611) Minor Cleanup ITS#8884 ITS#10455 ITS#10581 ITS#10573 ITS#10586 ITS#10587 ITS#10588 ITS#10589 ITS#10592 ITS#10593 ITS#10594 ITS#10595 ITS#10596 ITS#10599 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610 ITS#10612

2 2

RE26 testing call (2.6.16) #2
by Quanah Gibson-Mount 12 Oct '26

12 Oct '26

This is the second testing call for OpenLDAP 2.6.16. Depending on the results, this may be the final testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.16 Engineering Fixed slapd GnuTLS client-cert verification handling (ITS#10616) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Contrib Fixed slappw-sha2 pointer aliasing (ITS#10611) Minor Cleanup ITS#10581 ITS#10586 ITS#10587 ITS#10588 ITS#10592 ITS#10593 ITS#10595 ITS#10596 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610 ITS#10612

2 1

new certs no longer working for replication due to missing Client Authentication EKU
by steiner＠rutgers.edu 07 Oct '26

07 Oct '26

Evidently it is now the standard to not have the Client Authentication EKU included in TLS server certs so as my certs get updated (we changed providers recently), replication has stopped working. Is there a suggested solution to this problem. As far as we can tell, we can't get Client Authentication EKU with Certinext certs. Do I need to have separate self generated certs for replication? thanks, ds

2 3

RE26 testing call (2.6.16) #1
by Quanah Gibson-Mount 03 Oct '26

03 Oct '26

This is the first testing call for OpenLDAP 2.6.16. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_6/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.6.16 Engineering Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Minor Cleanup ITS#10586 ITS#10587 ITS#10588 ITS#10592 ITS#10593 ITS#10595 ITS#10596 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610

3 2

RE27 testing call (2.7.2) #1
by Quanah Gibson-Mount 01 Oct '26

01 Oct '26

This is the first testing call for OpenLDAP 2.7.2. Depending on the results, this may be the only testing call. Generally, get the code for RE26: <https://git.openldap.org/openldap/openldap/-/archive/OPENLDAP_REL_ENG_2_7/o…> Extract, configure, and build. Execute the test suite (via make test) after it is built. Optionally, cd tests && make its to run through the regression suite. Thanks! OpenLDAP 2.7.2 Engineering Fixed libldap with deeply nested URL filters (ITS#10585) Fixed slapo-accesslog handling of per-op info state (ITS#10597) Fixed slapo-sssvlv control parsing (ITS#10590) Minor Cleanup ITS#8884 ITS#10455 ITS#10573 ITS#10586 ITS#10587 ITS#10588 ITS#10589 ITS#10592 ITS#10593 ITS#10594 ITS#10595 ITS#10596 ITS#10599 ITS#10600 ITS#10602 ITS#10606 ITS#10607 ITS#10608 ITS#10609 ITS#10610

1 0

malloc crashes since OpenLDAP 2.6.15 (or 2.6.14)
by Geert Hendrickx 17 Sep '26

17 Sep '26

Hi Shortly after upgrading from OpenLDAP 2.6.13 to 2.6.15 (from Symas repo on RHEL 8), we are seeing malloc crashes: Sep 16 12:08:24 slapd[2358763]: free(): invalid pointer Sep 16 13:40:52 slapd[2377743]: malloc(): unaligned tcache chunk detected Sep 16 13:50:51 slapd[2416163]: double free or corruption (out) Sep 16 12:23:04 slapd[2379983]: malloc(): unaligned tcache chunk detected Sep 16 12:48:31 slapd[2401167]: malloc(): unaligned tcache chunk detected Sep 16 13:24:48 slapd[2400058]: malloc(): unaligned fastbin chunk detected We rolled back for now, what can we provide to help debug this? Geert

2 2

Fwd: OpenLDAP 2.6.15 now available
by A. Schulze 09 Sep '26

09 Sep '26

----- Weitergeleitete Nachricht von project(a)openldap.org ----- Datum: Tue, 8 Sep 2026 22:53:06 +0000 (UTC) Von: project(a)openldap.org Betreff: OpenLDAP 2.6.15 now available An: openldap-announce(a)openldap.org OpenLDAP 2.6.15 is now available for download as detailed on our download page: https://www.openldap.org/software/download/ Hello, a signature file is missing: https://openldap.org/software/download/OpenLDAP/openldap-release/openldap-2… works, but https://openldap.org/software/download/OpenLDAP/openldap-release/openldap-2… fail Andreas

2 1

Security policy
by Howard Chu 01 Sep '26

01 Sep '26

Since AI-driven "researchers" are submitting more bug reports these days in hopes of adding CVEs to their CVs, we're probably going to need to publish a more formalized security policy on the openldap.org web site. This is an example of what we're starting with. Feedback welcome. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

5 10

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

openldap-technical