I am using OpenLDAP (slapd) v2.4.47 on Debian. It complains in the following manner in the logfile (/var/log/debug)

slapd[1142]: conn=1508 op=4 SRCH base="cn=persons,cn=internal" scope=2 deref=0 filter="(&(objectClass=mozillaAbPersonAlpha)(|(cn=john*)(mail=john*)(sn=john*)))"
slapd[1142]: <= mdb_substring_candidates: (cn) not indexed                                                       
slapd[1142]: <= mdb_substring_candidates: (mail) not indexed                                                     
slapd[1142]: <= mdb_substring_candidates: (sn) not indexed                                                       

The corresponding database (/etc/ldap/slapd.d/cn=config/olcDatabase={1}mdb.ldif) configuration is:

dn: olcDatabase={1}mdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcMdbConfig
olcDatabase: {1}mdb
olcDbDirectory: /var/lib/ldap
olcDbIndex: objectClass eq
olcDbIndex: cn,sn,mail,uid,sambaSID eq
olcDbIndex: uidNumber,gidNumber eq
olcDbIndex: member,memberUid eq
olcDbIndex: sambaDomainName eq

also when I try to add index on the "problematic" attribute (e.g. cn), it fails:

# ldapmodify -H ldapi:// -Y EXTERNAL <<EOM
dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: cn eq
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
modifying entry "olcDatabase={1}mdb,cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)
        additional info: duplicate index definition for attr "cn"

This way I have tried all of cn, mail, sn with the same error, so it seems that the index is active on these attributes.

Why then OpenLDAP complains about missing indexes?

P.S. I have only one OpenLDAP running, so no way I could mess up.

1 Answer 1


Its complaining you need SUBstring indexes, not just equality indexes. You can add them with the "sub" keyword. For example:

olcDbIndex: cn,mail,sn sub,eq

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .