Hello Ondřej

>up a short script to reproduce this, you can file a bug[0] and attach it
>there.

To reproduce the script, ldapsearch is enough

ldapsearch -o ldif-wrap=no -LLL -x -H ldap://localhost login=a.b entryDN subschemaSubentry | sort

entryDN: cn=a.b,ou=Network,ou=PT,o=Swisscom-Eurospot
entryDN: cn=a.b,ou=Network,ou=PT,o=Swisscom-Eurospot
subschemaSubentry: cn=Subschema
subschemaSubentry: cn=Subschema

Slapcat does not have this issue.

For the ldapsearch (old script to backup users) we simply added 

      | grep -v "^entryDN:" \
      | grep -v "^subschemaSubentry: » \

To remove the entries, which, on a slapadd get automatically created

>Hi Sebastian,
>could you share your configuration, are you using RWM or any of the
>proxies (back-ldap, slapo-chain, meta, ...)? Also if you manage to set


Here is the config (a bit anonymised) on ldap 2.4 and 2.6, we only changed policy (now standard) and TLS setup (Debian 13 compiled it with openssl)

include        /etc/ldap/schema/core.schema
include        /etc/ldap/schema/cosine.schema
include        /etc/ldap/schema/nis.schema
include        /etc/ldap/schema/inetorgperson.schema
include        /etc/ldap/schema/samba.schema
include        /etc/ldap/schema/sudo-ldap.schema
include        /etc/ldap/schema/openssh-lpk.schema
include        /etc/ldap/schema/ldapns.schema
#include        /etc/ldap/schema/ppolicy.schema

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args
modulepath        /usr/lib/ldap


include        /etc/ldap/schema/eurospot.schema
include        /etc/ldap/schema/insight.schema
include        /etc/ldap/schema/eurospotexternal.schema
include        /etc/ldap/schema/people.schema
include        /etc/ldap/schema/eurospotmatches.schema

# TLS
TLSCipherSuite         HIGH:MEDIUM
TLSCACertificateFile   /etc/ldap/ssl/x.crt
TLSCertificateFile     /etc/ldap/ssl/x.crt
TLSCertificateKeyFile  /etc/ldap/ssl/x.key
TLSVerifyClient        never

allow           bind_v2
loglevel        sync stats

# moduleload      back_hdb
moduleload      back_monitor
moduleload      back_ldap
moduleload      back_meta
moduleload      back_relay
moduleload      rwm
moduleload      syncprov
moduleload      auditlog.la
moduleload      ppolicy.la
moduleload      memberof.la
moduleload      refint.la
moduleload      back_mdb
moduleload      lastbind.so

sizelimit       unlimited
timelimit       900
tool-threads    2
idletimeout     60
threads         32
overlay         auditlog
auditlog       /var/log/ldapaudit/audit.log

overlay lastbind
lastbind-precision 60

database        monitor
rootdn          "cn=x,dc=y,dc=z"

# Specific Directives for database
database        mdb
maxsize 3221225472
envflags nosync
envflags writemap
envflags nometasync

suffix          ""
rootdn          "cn=x,dc=y,dc=z"

directory       "/var/lib/ldap/"

readonly off

index           objectClass eq
index           cn eq,pres
index           uid eq,pres
index           mail,mailalias eq,pres
index           login eq,pres
index           uidNumber eq,pres
index           memberUid eq,pres
index           eurospotEmployeeSearch eq,pres
index           sudoUser eq
index           member eq
index           memberOf eq
index           entryUUID eq
index           entryCSN eq

lastmod         on

limits dn.exact="cn=syncrepl,dc=sceur,dc=ch" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
limits dn.exact="cn=admin,dc=sceur,dc=ch" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
limits dn.exact="cn=manager" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
limits dn.exact="cn=manager,o=admin" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
limits dn.exact="cn=alliacom,o=admin" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited
limits dn.exact="cn=extranet,o=admin" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited

overlay                syncprov
syncprov-checkpoint    128 5
syncprov-sessionlog    128

overlay refint
refint_attributes memberOf member
refint_nothing "cn=placeholder,o=Swisscom-Eurospot"

overlay ppolicy
ppolicy_default "cn=passwordDefault,ou=Policies,o=z"
ppolicy_hash_cleartext




Sebastian Perkins​​​​
Senior Systems Development Engineer
https://www.linkedin.com/company/planet/
weareplanet.com
De : Ondřej Kuzník <ondra@mistotebe.net>
Date : lundi, 23 mars 2026 à 11:52
À : Sebastian Perkins <Sebastian.Perkins@hoistgroup.com>
Cc : openldap-technical@openldap.org <openldap-technical@openldap.org>
Objet : Re: Ldapsearch : double on certain extended attributes

[You don't often get email from ondra@mistotebe.net. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

CAUTION: This email originated from outside Planet. Do not click links or open attachments unless you recognise the sender and know the content is safe. Please report all suspicious emails by clicking on the report message button in Outlook.

On Thu, Mar 19, 2026 at 05:30:30PM +0000, Sebastian Perkins wrote:
> Hello All
>
> We are running into a very bizarre situation using opendap 2.4.57 on
> Debian 11 and Debian 13 openldap 2.6.10
>
> When running
>
> ldapsearch -LLL -x -H ldap://localhost login=x.y +
>
> We get the 2 below extended attributes (and only those) in double
>
> entryDN: cn=x.y,ou=Sales,ou=IT,o=Swisscom-Eurospot
> entryDN: cn=x.y,ou=Sales,ou=IT,o=Swisscom-Eurospot
>
> subschemaSubentry: cn=Subschema
> subschemaSubentry: cn=Subschema
>
> Standard attributes are fine
>
> A slapcat of the DB is perfect, no double up on the above on any user.
>
> phpmyadmin is also OK showing the extended attributes
>
> If I slapadd the DB (into the Debian 13 stance) … it works, but I also
> get the above again
>
> This is how we discovered the issue as the dump script used
> ldapsearch, and we were getting tons of « duplicates » (hence ignored)
> due to the above.

Hi Sebastian,
could you share your configuration, are you using RWM or any of the
proxies (back-ldap, slapo-chain, meta, ...)? Also if you manage to set
up a short script to reproduce this, you can file a bug[0] and attach it
there.

[0]. https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugs.openldap.org%2F&data=05%7C02%7CSebastian.Perkins%40hoistgroup.com%7C28e193988403453f9d1108de88ca5669%7Cb607882112c74949982752da66c836c7%7C0%7C0%7C639098599774756555%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=tsXyEhj4bk0X6ovfLBL5Kc47AUzx0Op%2BFadJuHgsNXA%3D&reserved=0

Thanks,

--
Ondřej Kuzník
Senior Software Engineer
Symas Corporation                       https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.symas.com%2F&data=05%7C02%7CSebastian.Perkins%40hoistgroup.com%7C28e193988403453f9d1108de88ca5669%7Cb607882112c74949982752da66c836c7%7C0%7C0%7C639098599774794807%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=TCM7Vysb4AccMK%2Bfk8UPgoLwjKq6sBhkg35Vx5%2BGOYM%3D&reserved=0
Packaged, certified, and supported LDAP solutions powered by OpenLDAP