I’m new working with Openldap, and I want to filter some keys that are being printed out in the audit.ldif logs after they were enabled.

The key is added in this config: userPassword

dn: olcDatabase={2}mdb,cn=config
  changetype: modify
  replace: olcAccess
  olcAccess: {0}to *
    by ...
    by * break
  olcAccess: {1}to attrs=userPassword,shadowLastChange

Then when the audit logs, that userPassword is printed in base64:

# add 1715001336
dn: uid=spiderman,ou=users,dc=dc-here,dc=com
changetype: add
uid: spiderman
userPassword: e01ENX1ud1dxUWdMa3pvMXFjbEVkeHpYTTZRPT0= #THIS IS THE PROBLEM
...
# end add 1715001336

Configuration of the audit module

dn: cn=module,cn=config
objectClass: olcModuleList
cn: module
olcModulePath: /opt/bitnami/openldap/lib/openldap
olcModuleLoad: auditlog.so

dn: olcOverlay=auditlog,olcDatabase={2}mdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcAuditLogConfig
olcOverlay: auditlog
olcAuditlogFile: /tmp/audit/auditlog.log

How can I filter or avoid that key to be printed in the audit logs.
What I have tried so far:

Add a new olcAttributeType called olcAuditlogIgnore

dn: cn=olcAttributeTypes,cn=schema,cn=config
changetype: add
objectClass: olcSchemaConfig
cn: olcAttributeTypes
olcAttributeTypes: ( 1.3.6.1.4.1.4203.666.100.22 NAME 'olcAuditlogIgnore' 
  DESC 'OpenLDAP Auditlog Ignore Attribute' 
  EQUALITY caseIgnoreMatch 
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
  X-ORIGIN 'OpenLDAP' )

But having issues when trying to add it to the module

dn: olcOverlay=auditlog,olcDatabase={2}mdb,cn=config
changetype: modify
add: olcAuditlogIgnore
olcAuditlogIgnore: userPassword

Error:

modifying entry "olcOverlay=auditlog,olcDatabase={2}mdb,cn=config"
ldap_modify: No such object (32)
        matched DN: olcDatabase={2}mdb,cn=config

Whit this command I can find the olc

$- ldapsearch -H ldapi:/// -Y EXTERNAL -b 'cn=config'
output:
# {5}olcAttributeTypes, schema, config
dn: cn={5}olcAttributeTypes,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: {5}olcAttributeTypes
olcAttributeTypes: {0}( 1.3.6.1.4.1.4203.666.100.22 NAME 'olcAuditlogIgnore'  
 DESC 'OpenLDAP Auditlog Ignore Attribute'  EQUALITY caseIgnoreMatch  SYNTAX 1
 .3.6.1.4.1.1466.115.121.1.15  X-ORIGIN 'OpenLDAP' )

If I try adding {1} like below:

dn: olcOverlay={1}auditlog,olcDatabase={2}mdb,cn=config
changetype: modify
add: olcAuditlogIgnore
olcAuditlogIgnore: userPassword

Then the output is:

modifying entry "olcOverlay={1}auditlog,olcDatabase={2}mdb,cn=config"
ldap_modify: Object class violation (65)
        additional info: attribute 'olcAuditlogIgnore' not allowed

What am I missing?