1SLAPO-UNIQUE(5)               File Formats Manual              SLAPO-UNIQUE(5)
2
3
4

NAME

6       slapo-unique - Attribute Uniqueness overlay to slapd
7

SYNOPSIS

9       /etc/openldap/slapd.conf
10

DESCRIPTION

12       The  Attribute  Uniqueness  overlay can be used with a backend database
13       such as slapd-mdb(5) to enforce the  uniqueness  of  some  or  all  at‐
14       tributes  within  a  scope. This subtree defaults to all objects within
15       the subtree of the database for which the Uniqueness overlay is config‐
16       ured.
17
18       Uniqueness is enforced by searching the subtree to ensure that the val‐
19       ues of all attributes presented with an add, modify or modrdn operation
20       are  unique within the scope.  For example, if uniqueness were enforced
21       for the uid attribute, the subtree would  be  searched  for  any  other
22       records  which  also have a uid attribute containing the same value. If
23       any are found, the request is rejected.
24
25       The search is performed using the rootdn of the database, to avoid  is‐
26       sues  with  ACLs preventing the overlay from seeing all of the relevant
27       data. As such, the database must have a rootdn configured.
28

CONFIGURATION

30       These slapd.conf options apply to  the  Attribute  Uniqueness  overlay.
31       They should appear after the overlay directive.
32
33       unique_uri <[strict ][ignore ][serialize ]URI[[ URI...]...]>
34              Configure the base, attributes, scope, and filter for uniqueness
35              checking.  Multiple URIs may be specified within a  domain,  al‐
36              lowing  complex  selections  of  objects.   Multiple  unique_uri
37              statements or olcUniqueURI attribute values will create indepen‐
38              dent  domains, each with their own independent lists of URIs and
39              ignore/strict settings.
40
41              Keywords strict, ignore, and serialize have to  be  enclosed  in
42              quotes (") together with the URI.
43
44              The LDAP URI syntax is a subset of RFC-4516, and takes the form:
45
46              ldap:///[base dn]?[attributes...]?scope[?filter]
47
48              The  base  dn defaults to that of the back-end database.  Speci‐
49              fied base dns must be within the subtree of the  back-end  data‐
50              base.
51
52              If no attributes are specified, the URI applies to all non-oper‐
53              ational attributes.
54
55              The scope component is effectively mandatory, because LDAP  URIs
56              default  to  base  scope, which is not valid for uniqueness, be‐
57              cause groups of one object are always  unique.   Scopes  of  sub
58              (for subtree) and one for one-level are valid.
59
60              The  filter component causes the domain to apply uniqueness con‐
61              straints     only      to      matching      objects.       e.g.
62              ldap:///?cn?sub?(sn=e*)  would  require unique cn attributes for
63              all objects in the subtree of the  back-end  database  whose  sn
64              starts with an e.
65
66              It is possible to assert uniqueness upon all non-operational at‐
67              tributes except those listed by prepending the keyword ignore If
68              not  configured,  all  non-operational (e.g., system) attributes
69              must be unique. Note that the attributes list of an  ignore  URI
70              should  generally  contain  the  objectClass,  dc,  ou and o at‐
71              tributes, as these will generally not be unique,  nor  are  they
72              operational attributes.
73
74              It  is possible to set strict checking for the uniqueness domain
75              by prepending the keyword strict.  By default, uniqueness is not
76              enforced  for null values. Enabling strict mode extends the con‐
77              cept of uniqueness to include null values, such  that  only  one
78              attribute within a subtree will be allowed to have a null value.
79              Strictness applies to all URIs within a uniqueness  domain,  but
80              some domains may be strict while others are not.
81
82              It  is possible to enforce strict serialization of modifications
83              by prepending the keyword serialize.  By default, no  serializa‐
84              tion  is  performed,  so multiple modifications occurring nearly
85              simultaneously may see incomplete uniqueness results.  Using se‐
86              rialize will force individual write operations to fully complete
87              before allowing any others to proceed, to ensure that each oper‐
88              ation's uniqueness checks are consistent.
89
90       It  is not possible to set both URIs and legacy slapo-unique configura‐
91       tion parameters simultaneously. In general,  the  legacy  configuration
92       options control pieces of a single unfiltered subtree domain.
93
94       unique_base <basedn>
95              This  legacy  configuration parameter should be converted to the
96              base dn component of the above unique_uri style of parameter.
97
98       unique_ignore <attribute...>
99              This legacy configuration parameter should  be  converted  to  a
100              unique_uri parameter with ignore keyword as described above.
101
102       unique_attributes <attribute...>
103              This  legacy  configuration  parameter  should be converted to a
104              unique_uri parameter, as described above.
105
106       unique_strict <attribute...>
107              This legacy configuration parameter should  be  converted  to  a
108              strict keyword prepended to a unique_uri parameter, as described
109              above.
110

CAVEATS

112       unique_uri cannot be used with the old-style of configuration, and vice
113       versa.   unique_uri  can  implement everything the older system can do,
114       however.
115
116       Typical attributes for the ignore ldap:///...  URIs  are  intentionally
117       not  hardcoded  into  the  overlay  to allow for maximum flexibility in
118       meeting site-specific requirements.
119
120       Replication and operations with the relax control are allowed to bypass
121       this  enforcement. It is therefore important that all servers accepting
122       writes have this overlay configured in order to maintain uniqueness  in
123       a replicated DIT.
124

FILES

126       /etc/openldap/slapd.conf
127              default slapd configuration file
128

SEE ALSO

130       slapd.conf(5), slapd-config(5).
131
132
133
134OpenLDAP 2.6.2                    2022/05/04                   SLAPO-UNIQUE(5)
Impressum