Hang on setting new password

[HighwayStar]

I'm using ltb self-service-password as docker service since long time and for some reason it became hangs on setting actual new password.

I'm trying to change password over email. Getting email, by link and typing new password, but apply new password hangs with timeout.

Here is log from docker when saving new password:

ltb-ssp-1  | ldap_create
ltb-ssp-1  | ldap_url_parse_ext(ldap://192.168.20.32)
ltb-ssp-1  | ldap_sasl_bind_s
ltb-ssp-1  | ldap_sasl_bind
ltb-ssp-1  | ldap_send_initial_request
ltb-ssp-1  | ldap_new_connection 1 1 0
ltb-ssp-1  | ldap_int_open_connection
ltb-ssp-1  | ldap_connect_to_host: TCP 192.168.20.32:389
ltb-ssp-1  | ldap_new_socket: 11
ltb-ssp-1  | ldap_prepare_socket: 11
ltb-ssp-1  | ldap_connect_to_host: Trying 192.168.20.32:389
ltb-ssp-1  | ldap_pvt_connect: fd: 11 tm: 10 async: 0
ltb-ssp-1  | ldap_ndelay_on: 11
ltb-ssp-1  | attempting to connect: 
ltb-ssp-1  | connect errno: 115
ltb-ssp-1  | ldap_int_poll: fd: 11 tm: 10
ltb-ssp-1  | ldap_is_sock_ready: 11
ltb-ssp-1  | ldap_ndelay_off: 11
ltb-ssp-1  | ldap_pvt_connect: 0
ltb-ssp-1  | ldap_open_defconn: successful
ltb-ssp-1  | ldap_send_server_request
ltb-ssp-1  | ldap_result ld 0x55dd66cd76a0 msgid 1
ltb-ssp-1  | wait4msg ld 0x55dd66cd76a0 msgid 1 (infinite timeout)
ltb-ssp-1  | wait4msg continue ld 0x55dd66cd76a0 msgid 1 all 1
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Connections:
ltb-ssp-1  | * host: 192.168.20.32  port: 389  (default)
ltb-ssp-1  | * from: IP=172.18.0.2:35982
ltb-ssp-1  |   refcnt: 2  status: Connected
ltb-ssp-1  |   last used: Thu Nov 13 09:14:16 2025
ltb-ssp-1  | 
ltb-ssp-1  | 
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Outstanding Requests:
ltb-ssp-1  |  * msgid 1,  origid 1, status InProgress
ltb-ssp-1  |    outstanding referrals 0, parent count 0
ltb-ssp-1  |   ld 0x55dd66cd76a0 request count 1 (abandoned 0)
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Response Queue:
ltb-ssp-1  |    Empty
ltb-ssp-1  |   ld 0x55dd66cd76a0 response count 0
ltb-ssp-1  | ldap_chkResponseList ld 0x55dd66cd76a0 msgid 1 all 1
ltb-ssp-1  | ldap_chkResponseList returns ld 0x55dd66cd76a0 NULL
ltb-ssp-1  | ldap_int_select
ltb-ssp-1  | read1msg: ld 0x55dd66cd76a0 msgid 1 all 1
ltb-ssp-1  | ldap_find_request_by_msgid: msgid 1, lr 0x55dd66cdad10 lr->lr_refcnt = 1
ltb-ssp-1  | read1msg: ld 0x55dd66cd76a0 msgid 1 message type bind
ltb-ssp-1  | read1msg: ld 0x55dd66cd76a0 0 new referrals
ltb-ssp-1  | read1msg:  mark request completed, ld 0x55dd66cd76a0 msgid 1
ltb-ssp-1  | request done: ld 0x55dd66cd76a0 msgid 1
ltb-ssp-1  | res_errno: 0, res_error: <>, res_matched: <>
ltb-ssp-1  | ldap_return_request: lrx 0x55dd66cdad10, lr 0x55dd66cdad10
ltb-ssp-1  | ldap_return_request: lrx->lr_msgid 1, lrx->lr_refcnt is now 0, lr is still present
ltb-ssp-1  | ldap_free_request (origid 1, msgid 1)
ltb-ssp-1  | ldap_free_request_int: lr 0x55dd66cdad10 msgid 1 removed
ltb-ssp-1  | ldap_do_free_request: asked to free lr 0x55dd66cdad10 msgid 1 refcnt 0
ltb-ssp-1  | ldap_parse_result
ltb-ssp-1  | ldap_msgfree
ltb-ssp-1  | ldap_search_ext
ltb-ssp-1  | put_filter: "(&(objectClass=person)(uid=tomin))"
ltb-ssp-1  | put_filter: AND
ltb-ssp-1  | put_filter_list "(objectClass=person)(uid=tomin)"
ltb-ssp-1  | put_filter: "(objectClass=person)"
ltb-ssp-1  | put_filter: simple
ltb-ssp-1  | put_simple_filter: "objectClass=person"
ltb-ssp-1  | put_filter: "(uid=tomin)"
ltb-ssp-1  | put_filter: simple
ltb-ssp-1  | put_simple_filter: "uid=tomin"
ltb-ssp-1  | ldap_build_search_req ATTRS: *
ltb-ssp-1  | ldap_send_initial_request
ltb-ssp-1  | ldap_send_server_request
ltb-ssp-1  | ldap_result ld 0x55dd66cd76a0 msgid 2
ltb-ssp-1  | wait4msg ld 0x55dd66cd76a0 msgid 2 (infinite timeout)
ltb-ssp-1  | wait4msg continue ld 0x55dd66cd76a0 msgid 2 all 1
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Connections:
ltb-ssp-1  | * host: 192.168.20.32  port: 389  (default)
ltb-ssp-1  | * from: IP=172.18.0.2:35982
ltb-ssp-1  |   refcnt: 2  status: Connected
ltb-ssp-1  |   last used: Thu Nov 13 09:14:16 2025
ltb-ssp-1  | 
ltb-ssp-1  | 
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Outstanding Requests:
ltb-ssp-1  |  * msgid 2,  origid 2, status InProgress
ltb-ssp-1  |    outstanding referrals 0, parent count 0
ltb-ssp-1  |   ld 0x55dd66cd76a0 request count 1 (abandoned 0)
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Response Queue:
ltb-ssp-1  |    Empty
ltb-ssp-1  |   ld 0x55dd66cd76a0 response count 0
ltb-ssp-1  | ldap_chkResponseList ld 0x55dd66cd76a0 msgid 2 all 1
ltb-ssp-1  | ldap_chkResponseList returns ld 0x55dd66cd76a0 NULL
ltb-ssp-1  | ldap_int_select
ltb-ssp-1  | read1msg: ld 0x55dd66cd76a0 msgid 2 all 1
ltb-ssp-1  | ldap_find_request_by_msgid: msgid 2, lr 0x55dd66cd9d30 lr->lr_refcnt = 1
ltb-ssp-1  | read1msg: ld 0x55dd66cd76a0 msgid 2 message type search-entry
ltb-ssp-1  | ldap_return_request: lrx 0x55dd66cd9d30, lr 0x55dd66cd9d30
ltb-ssp-1  | ldap_return_request: lrx->lr_msgid 2, lrx->lr_refcnt is now 0, lr is still present
ltb-ssp-1  | wait4msg continue ld 0x55dd66cd76a0 msgid 2 all 1
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Connections:
ltb-ssp-1  | * host: 192.168.20.32  port: 389  (default)
ltb-ssp-1  | * from: IP=172.18.0.2:35982
ltb-ssp-1  |   refcnt: 2  status: Connected
ltb-ssp-1  |   last used: Thu Nov 13 09:14:16 2025
ltb-ssp-1  | 
ltb-ssp-1  | 
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Outstanding Requests:
ltb-ssp-1  |  * msgid 2,  origid 2, status InProgress
ltb-ssp-1  |    outstanding referrals 0, parent count 0
ltb-ssp-1  |   ld 0x55dd66cd76a0 request count 1 (abandoned 0)
ltb-ssp-1  | ** ld 0x55dd66cd76a0 Response Queue:
ltb-ssp-1  |  * msgid 2,  type 100
ltb-ssp-1  |   ld 0x55dd66cd76a0 response count 1
ltb-ssp-1  | ldap_chkResponseList ld 0x55dd66cd76a0 msgid 2 all 1
ltb-ssp-1  | ldap_chkResponseList returns ld 0x55dd66cd76a0 NULL
ltb-ssp-1  | ldap_int_select
ltb-ssp-1  | read1msg: ld 0x55dd66cd76a0 msgid 2 all 1
ltb-ssp-1  | ldap_find_request_by_msgid: msgid 2, lr 0x55dd66cd9d30 lr->lr_refcnt = 1
ltb-ssp-1  | read1msg: ld 0x55dd66cd76a0 msgid 2 message type search-result
ltb-ssp-1  | read1msg: ld 0x55dd66cd76a0 0 new referrals
ltb-ssp-1  | read1msg:  mark request completed, ld 0x55dd66cd76a0 msgid 2
ltb-ssp-1  | request done: ld 0x55dd66cd76a0 msgid 2
ltb-ssp-1  | res_errno: 0, res_error: <>, res_matched: <>
ltb-ssp-1  | ldap_return_request: lrx 0x55dd66cd9d30, lr 0x55dd66cd9d30
ltb-ssp-1  | ldap_return_request: lrx->lr_msgid 2, lrx->lr_refcnt is now 0, lr is still present
ltb-ssp-1  | ldap_free_request (origid 2, msgid 2)
ltb-ssp-1  | ldap_free_request_int: lr 0x55dd66cd9d30 msgid 2 removed
ltb-ssp-1  | ldap_do_free_request: asked to free lr 0x55dd66cd9d30 msgid 2 refcnt 0
ltb-ssp-1  | adding response ld 0x55dd66cd76a0 msgid 2 type 101:
ltb-ssp-1  | ldap_parse_result
ltb-ssp-1  | ldap_get_dn
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_first_attribute
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_next_attribute
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_next_attribute
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_next_attribute
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_next_attribute
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_next_attribute
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_next_attribute
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_next_attribute
ltb-ssp-1  | ldap_get_values_len
ltb-ssp-1  | ldap_next_attribute

my config

<?php

$ldap_url = "ldap://192.168.20.32";
$ldap_binddn = "cn=admin,dc=example,dc=org";
$ldap_bindpw = 'xxxxxxxx';
$debug = true;

$ldap_base = "ou=people,dc=example,dc=org";
$ldap_use_ppolicy_control = true;
$hash = "SSHA";

$use_pwnedpasswords = true;
$use_questions = false;

$mail_from = "projects@example.org";
$mail_from_name = "Example Self Service Password";

$mail_smtp_debug = 2;

$mail_smtp_host = 'mail.example.org;
$mail_smtp_secure = '';

$mail_smtp_autotls = false;
$use_sms = false;

$keyphrase = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx";
$reset_url = $_SERVER['HTTP_X_FORWARDED_PROTO'] . "://" . $_SERVER['HTTP_X_FORWARDED_HOST'] .'/ltb'. $_SERVER['SCRIPT_NAME'];

docker-compose.yml

version: '2'

services:
  ltb-ssp:
    image: docker.io/ltbproject/self-service-password:latest
    ports:
      - '8000:80'
    volumes:
      - ./config.inc.local.php:/var/www/conf/config.inc.local.php

I have not changed any settings from last time it works, only number of users grown 500+ now.

[HighwayStar]

I seems problem caused by use_pwnedpasswords = true, switching to false resolving hang issue

[davidcoutadeur]

If you enable use_pwnedpasswords, you should open the network flow from self-service-password to https://haveibeenpwned.com/, else it won't work.