[389-users] "failed to decode ldap controls" with 1.2.10.2

I have two different servers, one installed recently (as in, earlier this week), and one that's been operating fine for more than a year. The new server is Centos 6.3, with 389-ds-base 1.2.10.2 The old server is Centos 5.5, with 389-ds-base 1.2.9.9 When I attempt to authenticate from an appliance which uses the Ruby Net::LDAP gem to the old server (via plain LDAP, no SSL), I have no problems, but when I switch out the old server for the new, I have auth failures. Other LDAP clients do not exhibit this problem eg ldapsearch, nslcd, etc) The logs on the old (working) auth server show: The logs on the new auth server show: Now, a tcpdump of the search queries shows that both search request packets from the Net::LDAP appliance are *identical* (except for the origin port, MAC addresses, etc), but not *quite* the same as the same query initiated through command-line ldapsearch. Here's a dump of a request packet from ldapsearch: and one from the Net::LDAP appliance: I note that the ldapsearch query uses: LDAPMessage ::= SEQUENCE { // 0x30 0x3e while the Net::LDAP query uses: LDAPMessage ::= SEQUENCE OF Control { // 0x30 0x40 in the PDU -- look at bytes 0x34 and 0x35 in the ldapsearch packet, and at bytes 0x36 and 0x37 in the Net::LDAP packet. Is 389-ds behaving correctly in this case, and the Net::LDAP gem is wrong? Or is this a regression in 389-ds? -- Colin Panisset Senior Systems Engineer, REA Group Ph: +61 (0)3 8456 4636 Mb: +61 (0) 457 788 259