I just set up an OpenLDAP server (v2.4.23) and loaded some data. I can browse and edit via Apache Directory Studio, but not deletions all fail.

For example, I tried to delete a list of DNs from a file:

ldapdelete -f rmroles.txt -W -D "cn=admin,cn=config"

but it dies with the message:

ldap_delete: Server is unwilling to perform (53)
        additional info: shadow context; no update referral

Most of the info I've found suggests that this is related to replication, but I haven't set up replication on this server yet. olcReadOnly is FALSE, and I've set olcAccess to to * by * manage.

Any other ideas what could be wrong?

3 Answers 3


Apparently just having the olcMirrorMode attribute present on cn=config (even when set to FALSE) is enough to trigger shadow context. Delete the attribute and restart slapd.

  • Another contribution: I was defining olcMirrorMode on a separate "changetype: modify" in the end of the .ldif file. It does not seem to be a good idea. When I added the olcMirrorMode as part of the previous "changetype: modify" I as doing, it ran successfully. Oct 9, 2013 at 21:49

Old thread, but I found that my solution was slightly different.

Again, my LDAP server was in a sync/replication setup and needed to be disabled.

In /etc/openldap/slapd.conf the syncrepl directive was specified (and some associated configuration underneath).

Commenting this out and restarting the ldap server allowed me to make changes to the LDAP database.

  1. Just watch attribute userPassword's value.
  2. It is prefixed by {MD5} (in my case)
  3. Just select Encryption method according to it

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .