Hello Ondřej

>If you only load the modules you use (removing the rwm, meta, …
>modules below) does it still happen?

We literally stripped down the config to be bare minimum, and still happened.

We even just added a base DN entry and also failed… 

The current solution is to grep -v the 2 entries in ldif for ldapsearch (slapcat to slapadd is fine)

FYI the ldapsearch dump is used for a very specific part of the tree containing users, allowing quick restore of users (crash, envrionment sync etc), the slapcat is more brutal 😃

Would the « Issue » be in the ldapsearch result ? As slapcat is fine… however an ldapsearch bug issue on deb11 and 13 in openldap 2.4 and 2.6 is probably not one.


>Also (and this is unrelated), you don't need to use lastbind overlay
>anymore on 2.6, if you are happy to use the attribute pwdLastSuccess
>instead (defined in behera-ppolicy-10 and onward), you can just use:
>lastbind on
>astbind-precision 60
> Instead of the overlay.

Thanks for that, the deb13 setup is still a proof of concept regarding the diffs from openldap 2.4 to 2.6

Sebastian

Sebastian Perkins​​​​
Senior Systems Development Engineer
https://www.linkedin.com/company/planet/
weareplanet.com
De : Ondřej Kuzník <ondra@mistotebe.net>
Date : vendredi, 27 mars 2026 à 11:00
À : Sebastian Perkins <Sebastian.Perkins@hoistgroup.com>
Cc : openldap-technical@openldap.org <openldap-technical@openldap.org>
Objet : Re: Ldapsearch : double on certain extended attributes

[You don't often get email from ondra@mistotebe.net. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

CAUTION: This email originated from outside Planet. Do not click links or open attachments unless you recognise the sender and know the content is safe. Please report all suspicious emails by clicking on the report message button in Outlook.

On Thu, Mar 26, 2026 at 07:17:15AM +0000, Sebastian Perkins wrote:
>> could you share your configuration, are you using RWM or any of the
>> proxies (back-ldap, slapo-chain, meta, ...)? Also if you manage to set
>
> Here is the config (a bit anonymised) on ldap 2.4 and 2.6, we only
> changed policy (now standard) and TLS setup (Debian 13 compiled it
> with openssl)

I still don't see it in any of the similar configurations I've used.
Nor do I see anything out of the ordinary in your configuration.

If you only load the modules you use (removing the rwm, meta, ...
modules below) does it still happen?

> # moduleload      back_hdb
> moduleload      back_monitor
> moduleload      back_ldap
> moduleload      back_meta
> moduleload      back_relay
> moduleload      rwm
> moduleload      syncprov
> moduleload      auditlog.la
> moduleload      ppolicy.la
> moduleload      memberof.la
> moduleload      refint.la
> moduleload      back_mdb
> moduleload      lastbind.so

Also (and this is unrelated), you don't need to use lastbind overlay
anymore on 2.6, if you are happy to use the attribute pwdLastSuccess
instead (defined in behera-ppolicy-10 and onward), you can just use:

lastbind on
lastbind-precision 60

Instead of the overlay.

Regards,

--
Ondřej Kuzník
Senior Software Engineer
Symas Corporation                       https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.symas.com%2F&data=05%7C02%7CSebastian.Perkins%40hoistgroup.com%7C705717e1653041ff72aa08de8be7a276%7Cb607882112c74949982752da66c836c7%7C0%7C0%7C639102024168472737%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=KrSPpZ137MN75%2BFzrhIxksGShW5DnwPEFcjrK9hM9j0%3D&reserved=0
Packaged, certified, and supported LDAP solutions powered by OpenLDAP