Hello Ondřej
If you only load the modules you use (removing the rwm, meta, … modules below) does it still happen?
We literally stripped down the config to be bare minimum, and still happened.
We even just added a base DN entry and also failed…
The current solution is to grep -v the 2 entries in ldif for ldapsearch (slapcat to slapadd is fine)
FYI the ldapsearch dump is used for a very specific part of the tree containing users, allowing quick restore of users (crash, envrionment sync etc), the slapcat is more brutal 😃
Would the « Issue » be in the ldapsearch result ? As slapcat is fine… however an ldapsearch bug issue on deb11 and 13 in openldap 2.4 and 2.6 is probably not one.
Also (and this is unrelated), you don't need to use lastbind overlay anymore on 2.6, if you are happy to use the attribute pwdLastSuccess instead (defined in behera-ppolicy-10 and onward), you can just use: lastbind on astbind-precision 60 Instead of the overlay.
Thanks for that, the deb13 setup is still a proof of concept regarding the diffs from openldap 2.4 to 2.6
Sebastian
Sebastian Perkins Senior Systems Development Engineer weareplanet.com De : Ondřej Kuzník ondra@mistotebe.net Date : vendredi, 27 mars 2026 à 11:00 À : Sebastian Perkins Sebastian.Perkins@hoistgroup.com Cc : openldap-technical@openldap.org openldap-technical@openldap.org Objet : Re: Ldapsearch : double on certain extended attributes
[You don't often get email from ondra@mistotebe.net. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
CAUTION: This email originated from outside Planet. Do not click links or open attachments unless you recognise the sender and know the content is safe. Please report all suspicious emails by clicking on the report message button in Outlook.
On Thu, Mar 26, 2026 at 07:17:15AM +0000, Sebastian Perkins wrote:
could you share your configuration, are you using RWM or any of the proxies (back-ldap, slapo-chain, meta, ...)? Also if you manage to set
Here is the config (a bit anonymised) on ldap 2.4 and 2.6, we only changed policy (now standard) and TLS setup (Debian 13 compiled it with openssl)
I still don't see it in any of the similar configurations I've used. Nor do I see anything out of the ordinary in your configuration.
If you only load the modules you use (removing the rwm, meta, ... modules below) does it still happen?
# moduleload back_hdb moduleload back_monitor moduleload back_ldap moduleload back_meta moduleload back_relay moduleload rwm moduleload syncprov moduleload auditlog.la moduleload ppolicy.la moduleload memberof.la moduleload refint.la moduleload back_mdb moduleload lastbind.so
Also (and this is unrelated), you don't need to use lastbind overlay anymore on 2.6, if you are happy to use the attribute pwdLastSuccess instead (defined in behera-ppolicy-10 and onward), you can just use:
lastbind on lastbind-precision 60
Instead of the overlay.
Regards,
-- Ondřej Kuzník Senior Software Engineer Symas Corporation http://www.symas.com/http://www.symas.com/ Packaged, certified, and supported LDAP solutions powered by OpenLDAP
