SLAPO-UNIQUE(5)                        File Formats Manual                        SLAPO-UNIQUE(5)



NAME
       slapo-unique - Attribute Uniqueness overlay to slapd

SYNOPSIS
       /etc/ldap/slapd.conf

DESCRIPTION
       The  Attribute Uniqueness overlay can be used with a backend database such as slapd-bdb(5)
       to enforce the uniqueness of some or all attributes within a scope. This subtree  defaults
       to all objects within the subtree of the database for which the Uniqueness overlay is con‐
       figured.

       Uniqueness is enforced by  searching  the  subtree  to  ensure  that  the  values  of  all
       attributes  presented with an add, modify or modrdn operation are unique within the scope.
       For example, if uniqueness were enforced for the  uid  attribute,  the  subtree  would  be
       searched  for any other records which also have a uid attribute containing the same value.
       If any are found, the request is rejected.

       The search is performed using the rootdn of the database, to avoid issues with  ACLs  pre‐
       venting  the overlay from seeing all of the relevant data. As such, the database must have
       a rootdn configured.

CONFIGURATION
       These slapd.conf options apply to the Attribute Uniqueness overlay.   They  should  appear
       after the overlay directive.

       unique_uri <[strict ][ignore ]URI[URI...]...>
              Configure  the base, attributes, scope, and filter for uniqueness checking.  Multi‐
              ple URIs may be specified within a domain, allowing complex selections of  objects.
              Multiple  unique_uri  statements or olcUniqueURI attributes will create independent
              domains, each with their own independent lists of URIs and ignore/strict settings.

              Keywords strict and ignore have to be enclosed in quotes (") together with the URI.

              The LDAP URI syntax is a subset of RFC-4516, and takes the form:

              ldap:///[base dn]?[attributes...]?scope[?filter]

              The base dn defaults to that of the back-end database.  Specified base dns must  be
              within the subtree of the back-end database.

              If no attributes are specified, the URI applies to all non-operational attributes.

              The  scope  component  is  effectively mandatory, because LDAP URIs default to base
              scope, which is not valid for uniqueness, because groups of one object  are  always
              unique.  Scopes of sub (for subtree) and one for one-level are valid.

              The  filter  component  causes  the  domain to apply uniqueness constraints only to
              matching objects.  e.g.  ldap:///?cn?sub?(sn=e*) would require unique cn attributes
              for all objects in the subtree of the back-end database whose sn starts with an e.

              It  is  possible  to  assert  uniqueness upon all non-operational attributes except
              those listed by prepending the keyword ignore If  not  configured,  all  non-opera‐
              tional  (e.g.,  system) attributes must be unique. Note that the attributes list of
              an ignore URI should generally contain the objectClass, dc, ou and o attributes, as
              these will generally not be unique, nor are they operational attributes.

              It  is  possible to set strict checking for the uniqueness domain by prepending the
              keyword strict.  By default, uniqueness is not enforced for null  values.  Enabling
              strict  mode  extends  the  concept of uniqueness to include null values, such that
              only one attribute within a subtree will be allowed to have a null value.   Strict‐
              ness applies to all URIs within a uniqueness domain, but some domains may be strict
              while others are not.

       It is not possible to set both  URIs  and  legacy  slapo-unique  configuration  parameters
       simultaneously.  In  general,  the legacy configuration options control pieces of a single
       unfiltered subtree domain.

       unique_base <basedn>
              This legacy configuration parameter should be converted to the base dn component of
              the above unique_uri style of parameter.

       unique_ignore <attribute...>
              This  legacy  configuration parameter should be converted to a unique_uri parameter
              with ignore keyword as described above.

       unique_attributes <attribute...>
              This legacy configuration parameter should be converted to a unique_uri  parameter,
              as described above.

       unique_strict <attribute...>
              This  legacy  configuration  parameter  should  be  converted  to  a strict keyword
              prepended to a unique_uri parameter, as described above.

CAVEATS
       unique_uri cannot be used with the old-style of configuration, and vice versa.  unique_uri
       can implement everything the older system can do, however.

       Typical  attributes  for the ignore ldap:///...  URIs are intentionally not hardcoded into
       the overlay to allow for maximum flexibility in meeting site-specific requirements.

       Replication and operations with manageDsaIt control are allowed to  bypass  this  enforce‐
       ment.  It  is therefore important that all servers accepting writes have this overlay con‐
       figured in order to maintain uniqueness in a replicated DIT.

FILES
       /etc/ldap/slapd.conf
              default slapd configuration file

SEE ALSO
       slapd.conf(5), slapd-config(5).



OpenLDAP                                    2014/09/20                            SLAPO-UNIQUE(5)