1SLAPO-UNIQUE(5) File Formats Manual SLAPO-UNIQUE(5)
2
6 slapo-unique - Attribute Uniqueness overlay to slapd
7
9 /etc/openldap/slapd.conf
10
12 The Attribute Uniqueness overlay can be used with a backend database
13 such as slapd-bdb(5) to enforce the uniqueness of some or all
14 attributes within a scope. This subtree defaults to all objects within
15 the subtree of the database for which the Uniqueness overlay is config‐
16 ured.
17 Uniqueness is enforced by searching the subtree to ensure that the val‐
19 ues of all attributes presented with an add, modify or modrdn operation
20 are unique within the scope. For example, if uniqueness were enforced
21 for the uid attribute, the subtree would be searched for any other
22 records which also have a uid attribute containing the same value. If
23 any are found, the request is rejected.
24 The search is performed using the rootdn of the database, to avoid
26 issues with ACLs preventing the overlay from seeing all of the relevant
27 data. As such, the database must have a rootdn configured.
28
30 These slapd.conf options apply to the Attribute Uniqueness overlay.
31 They should appear after the overlay directive.
32 unique_uri <[strict ][ignore ]URI[URI...]...>
34 Configure the base, attributes, scope, and filter for uniqueness
35 checking. Multiple URIs may be specified within a domain,
36 allowing complex selections of objects. Multiple unique_uri
37 statements or olcUniqueURI attributes will create independent
38 domains, each with their own independent lists of URIs and
39 ignore/strict settings.
40 The LDAP URI syntax is a subset of RFC-4516, and takes the form:
42 ldap:///[base dn]?[attributes...]?scope[?filter]
44 The base dn defaults to that of the back-end database. Speci‐
46 fied base dns must be within the subtree of the back-end data‐
47 base.
48 If no attributes are specified, the URI applies to all non-oper‐
50 ational attributes.
51 The scope component is effectively mandatory, because LDAP URIs
53 default to base scope, which is not valid for uniqueness,
54 because groups of one object are always unique. Scopes of sub
55 (for subtree) and one for one-level are valid.
56 The filter component causes the domain to apply uniqueness con‐
58 straints only to matching objects. e.g.
59 ldap:///?cn?sub?(sn=e*) would require unique cn attributes for
60 all objects in the subtree of the back-end database whose sn
61 starts with an e.
62 It is possible to assert uniqueness upon all non-operational
64 attributes except those listed by prepending the keyword ignore
65 If not configured, all non-operational (e.g., system) attributes
66 must be unique. Note that the attributes list of an ignore URI
67 should generally contain the objectClass, dc, ou and o
68 attributes, as these will generally not be unique, nor are they
69 operational attributes.
70 It is possible to set strict checking for the uniqueness domain
72 by prepending the keyword strict. By default, uniqueness is not
73 enforced for null values. Enabling strict mode extends the con‐
74 cept of uniqueness to include null values, such that only one
75 attribute within a subtree will be allowed to have a null value.
76 Strictness applies to all URIs within a uniqueness domain, but
77 some domains may be strict while others are not.
78 It is not possible to set both URIs and legacy slapo-unique configura‐
80 tion parameters simultaneously. In general, the legacy configuration
81 options control pieces of a single unfiltered subtree domain.
82 unique_base <basedn>
84 This legacy configuration parameter should be converted to the
85 base dn component of the above unique_uri style of parameter.
86 unique_ignore <attribute...>
88 This legacy configuration parameter should be converted to a
89 unique_uri parameter with ignore keyword as described above.
90 unique_attributes <attribute...>
92 This legacy configuration parameter should be converted to a
93 unique_uri parameter, as described above.
94 unique_strict
96 This legacy configuration parameter should be converted to a
97 strict keyword prepended to a unique_uri parameter, as described
98 above.
99
101 unique_uri cannot be used with the old-style of configuration, and vice
102 versa. unique_uri can implement everything the older system can do,
103 however.
104 Typical attributes for the ignore ldap:///... URIs are intentionally
106 not hardcoded into the overlay to allow for maximum flexibility in
107 meeting site-specific requirements.
108
110 /etc/openldap/slapd.conf
111 default slapd configuration file
112
114 slapd.conf(5), slapd-config(5).
115OpenLDAP 2.4.23 2010/06/30 SLAPO-UNIQUE(5)