Hello Ondřej
up a short script to reproduce this, you can file a bug[0] and attach it there.
To reproduce the script, ldapsearch is enough
ldapsearch -o ldif-wrap=no -LLL -x -H ldap://localhost login=a.b entryDN subschemaSubentry | sort
entryDN: cn=a.b,ou=Network,ou=PT,o=Swisscom-Eurospot entryDN: cn=a.b,ou=Network,ou=PT,o=Swisscom-Eurospot subschemaSubentry: cn=Subschema subschemaSubentry: cn=Subschema
Slapcat does not have this issue.
For the ldapsearch (old script to backup users) we simply added
| grep -v "^entryDN:" \ | grep -v "^subschemaSubentry: » \
To remove the entries, which, on a slapadd get automatically created
Hi Sebastian, could you share your configuration, are you using RWM or any of the proxies (back-ldap, slapo-chain, meta, ...)? Also if you manage to set
Here is the config (a bit anonymised) on ldap 2.4 and 2.6, we only changed policy (now standard) and TLS setup (Debian 13 compiled it with openssl)
include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/samba.schema include /etc/ldap/schema/sudo-ldap.schema include /etc/ldap/schema/openssh-lpk.schema include /etc/ldap/schema/ldapns.schema #include /etc/ldap/schema/ppolicy.schema
pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args modulepath /usr/lib/ldap
include /etc/ldap/schema/eurospot.schema include /etc/ldap/schema/insight.schema include /etc/ldap/schema/eurospotexternal.schema include /etc/ldap/schema/people.schema include /etc/ldap/schema/eurospotmatches.schema
# TLS TLSCipherSuite HIGH:MEDIUM TLSCACertificateFile /etc/ldap/ssl/x.crt TLSCertificateFile /etc/ldap/ssl/x.crt TLSCertificateKeyFile /etc/ldap/ssl/x.key TLSVerifyClient never
allow bind_v2 loglevel sync stats
# moduleload back_hdb moduleload back_monitor moduleload back_ldap moduleload back_meta moduleload back_relay moduleload rwm moduleload syncprov moduleload auditlog.la moduleload ppolicy.la moduleload memberof.la moduleload refint.la moduleload back_mdb moduleload lastbind.so
sizelimit unlimited timelimit 900 tool-threads 2 idletimeout 60 threads 32 overlay auditlog auditlog /var/log/ldapaudit/audit.log
overlay lastbind lastbind-precision 60
database monitor rootdn "cn=x,dc=y,dc=z"
# Specific Directives for database database mdb maxsize 3221225472 envflags nosync envflags writemap envflags nometasync
suffix "" rootdn "cn=x,dc=y,dc=z"
directory "/var/lib/ldap/"
readonly off
index objectClass eq index cn eq,pres index uid eq,pres index mail,mailalias eq,pres index login eq,pres index uidNumber eq,pres index memberUid eq,pres index eurospotEmployeeSearch eq,pres index sudoUser eq index member eq index memberOf eq index entryUUID eq index entryCSN eq
lastmod on
limits dn.exact="cn=syncrepl,dc=sceur,dc=ch" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=admin,dc=sceur,dc=ch" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=manager" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=manager,o=admin" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=alliacom,o=admin" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited limits dn.exact="cn=extranet,o=admin" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
overlay syncprov syncprov-checkpoint 128 5 syncprov-sessionlog 128
overlay refint refint_attributes memberOf member refint_nothing "cn=placeholder,o=Swisscom-Eurospot"
overlay ppolicy ppolicy_default "cn=passwordDefault,ou=Policies,o=z" ppolicy_hash_cleartext
Sebastian Perkins Senior Systems Development Engineer weareplanet.com De : Ondřej Kuzník ondra@mistotebe.net Date : lundi, 23 mars 2026 à 11:52 À : Sebastian Perkins Sebastian.Perkins@hoistgroup.com Cc : openldap-technical@openldap.org openldap-technical@openldap.org Objet : Re: Ldapsearch : double on certain extended attributes
[You don't often get email from ondra@mistotebe.net. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
CAUTION: This email originated from outside Planet. Do not click links or open attachments unless you recognise the sender and know the content is safe. Please report all suspicious emails by clicking on the report message button in Outlook.
On Thu, Mar 19, 2026 at 05:30:30PM +0000, Sebastian Perkins wrote:
Hello All
We are running into a very bizarre situation using opendap 2.4.57 on Debian 11 and Debian 13 openldap 2.6.10
When running
ldapsearch -LLL -x -H ldap://localhost login=x.y +
We get the 2 below extended attributes (and only those) in double
entryDN: cn=x.y,ou=Sales,ou=IT,o=Swisscom-Eurospot entryDN: cn=x.y,ou=Sales,ou=IT,o=Swisscom-Eurospot
subschemaSubentry: cn=Subschema subschemaSubentry: cn=Subschema
Standard attributes are fine
A slapcat of the DB is perfect, no double up on the above on any user.
phpmyadmin is also OK showing the extended attributes
If I slapadd the DB (into the Debian 13 stance) … it works, but I also get the above again
This is how we discovered the issue as the dump script used ldapsearch, and we were getting tons of « duplicates » (hence ignored) due to the above.
Hi Sebastian, could you share your configuration, are you using RWM or any of the proxies (back-ldap, slapo-chain, meta, ...)? Also if you manage to set up a short script to reproduce this, you can file a bug[0] and attach it there.
[0]. https://bugs.openldap.org/https://bugs.openldap.org/
Thanks,
-- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com/http://www.symas.com/ Packaged, certified, and supported LDAP solutions powered by OpenLDAP
