slapo-unique.5 5.42 KB
Newer Older
1
.TH SLAPO-UNIQUE 5 "RELEASEDATE" "OpenLDAP LDVERSION"
Quanah Gibson-Mount's avatar
Quanah Gibson-Mount committed
2
.\" Copyright 2004-2021 The OpenLDAP Foundation All Rights Reserved.
3
4
5
.\" Copying restrictions apply.  See COPYRIGHT/LICENSE.
.\" $OpenLDAP$
.SH NAME
Howard Chu's avatar
Howard Chu committed
6
slapo\-unique \- Attribute Uniqueness overlay to slapd
7
8
9
10
.SH SYNOPSIS
ETCDIR/slapd.conf
.SH DESCRIPTION
The Attribute Uniqueness overlay can be used with a backend database such as
11
.BR slapd\-mdb (5)
Howard Chu's avatar
Howard Chu committed
12
13
14
to enforce the uniqueness of some or all attributes within a
scope. This subtree defaults to all objects within the subtree of the
database for which the Uniqueness overlay is configured.
15
16
17
.LP
Uniqueness is enforced by searching the subtree to ensure that the values of
all attributes presented with an
Pierangelo Masarati's avatar
typos    
Pierangelo Masarati committed
18
.BR add ,
19
20
21
.B modify
or
.B modrdn
Howard Chu's avatar
Howard Chu committed
22
operation are unique within the scope.
Pierangelo Masarati's avatar
typos    
Pierangelo Masarati committed
23
For example, if uniqueness were enforced for the
24
25
26
27
28
29
.B uid
attribute, the subtree would be searched for any other records which also
have a
.B uid
attribute containing the same value. If any are found, the request is
rejected.
30
31
32
33
.LP
The search is performed using the rootdn of the database, to avoid issues
with ACLs preventing the overlay from seeing all of the relevant data. As
such, the database must have a rootdn configured.
34
35
36
37
38
39
40
41
.SH CONFIGURATION
These
.B slapd.conf
options apply to the Attribute Uniqueness overlay.
They should appear after the
.B overlay
directive.
.TP
42
.B unique_uri <[strict ][ignore ][serialize ]URI[[ URI...]...]>
Howard Chu's avatar
Howard Chu committed
43
Configure the base, attributes, scope, and filter for uniqueness
Howard Chu's avatar
Howard Chu committed
44
45
checking.  Multiple URIs may be specified within a domain,
allowing complex selections of objects.  Multiple
Howard Chu's avatar
Howard Chu committed
46
47
48
.B unique_uri
statements or
.B olcUniqueURI
49
attribute values will create independent domains, each with their own
Howard Chu's avatar
Howard Chu committed
50
independent lists of URIs and ignore/strict settings.
Howard Chu's avatar
Howard Chu committed
51

52
Keywords
53
54
.BR strict ,
.BR ignore ,
55
and
56
.B serialize
57
58
have to be enclosed in quotes (") together with the URI.

Howard Chu's avatar
Howard Chu committed
59
60
61
62
63
64
The LDAP URI syntax is a subset of
.B RFC-4516,
and takes the form:

ldap:///[base dn]?[attributes...]?scope[?filter]

65
The
Howard Chu's avatar
Howard Chu committed
66
.B base dn
Howard Chu's avatar
Howard Chu committed
67
68
defaults to that of the back-end database.
Specified base dns must be within the subtree of the back-end database.
Howard Chu's avatar
Howard Chu committed
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

If no
.B attributes
are specified, the URI applies to all non-operational attributes.

The
.B scope
component is effectively mandatory, because LDAP URIs default to
.B base
scope, which is not valid for uniqueness, because groups of one object
are always unique.  Scopes of
.B sub
(for subtree) and
.B one
for one-level are valid.

The
.B filter
component causes the domain to apply uniqueness constraints only to
matching objects.  e.g.
.B ldap:///?cn?sub?(sn=e*)
would require unique
.B cn
attributes for all objects in the subtree of the back-end database whose
.B sn
starts with an e.

It is possible to assert uniqueness upon all non-operational
attributes except those listed by prepending the keyword
.B ignore
Gavin Henry's avatar
Gavin Henry committed
99
If not configured, all non-operational (e.g., system) attributes must be
100
unique. Note that the
Howard Chu's avatar
Howard Chu committed
101
102
103
104
.B attributes
list of an
.B ignore
URI should generally contain the
Pierangelo Masarati's avatar
typos    
Pierangelo Masarati committed
105
106
.BR objectClass ,
.BR dc ,
107
108
109
110
111
.B ou
and
.B o
attributes, as these will generally not be unique, nor are they operational
attributes.
Howard Chu's avatar
Howard Chu committed
112
113
114
115
116
117
118
119
120
121
122

It is possible to set strict checking for the uniqueness domain by
prepending the keyword
.B strict.
By default, uniqueness is not enforced
for null values. Enabling
.B strict
mode extends the concept of uniqueness to include null values, such
that only one attribute within a subtree will be allowed to have a
null value.  Strictness applies to all URIs within a uniqueness
domain, but some domains may be strict while others are not.
123
124
125
126
127
128
129
130
131
132
133

It is possible to enforce strict serialization of modifications by
prepending the keyword
.B serialize.
By default, no serialization is performed, so multiple modifications
occurring nearly simultaneously may see incomplete uniqueness results.
Using
.B serialize
will force individual write operations to fully complete before allowing
any others to proceed, to ensure that each operation's uniqueness checks
are consistent.
Howard Chu's avatar
Howard Chu committed
134
.LP
Howard Chu's avatar
Howard Chu committed
135
136
137
It is not possible to set both URIs and legacy slapo\-unique configuration
parameters simultaneously. In general, the legacy configuration options
control pieces of a single unfiltered subtree domain.
Howard Chu's avatar
Howard Chu committed
138
139
140
141
142
143
144
145
146
147
148
149
150
151
.TP
.B unique_base <basedn>
This legacy configuration parameter should be converted to the
.B base dn
component of the above
.B unique_uri
style of parameter.
.TP
.B unique_ignore <attribute...>
This legacy configuration parameter should be converted to a
.B unique_uri
parameter with
.B ignore
keyword as described above.
152
153
.TP
.B unique_attributes <attribute...>
Howard Chu's avatar
Howard Chu committed
154
155
156
This legacy configuration parameter should be converted to a
.B unique_uri
parameter, as described above.
157
.TP
158
.B unique_strict <attribute...>
Howard Chu's avatar
Howard Chu committed
159
160
161
162
163
This legacy configuration parameter should be converted to a
.B strict
keyword prepended to a
.B unique_uri
parameter, as described above.
164
165
.SH CAVEATS
.LP
Howard Chu's avatar
Howard Chu committed
166
167
168
169
.B unique_uri
cannot be used with the old-style of configuration, and vice versa.
.B unique_uri
can implement everything the older system can do, however.
170
171
.LP
Typical attributes for the
Howard Chu's avatar
Howard Chu committed
172
173
.B ignore ldap:///...
URIs are intentionally not hardcoded into the overlay to allow for
174
maximum flexibility in meeting site-specific requirements.
175
.LP
176
177
Replication and operations with the
.B relax
178
179
180
control are allowed to bypass this enforcement. It is therefore important that
all servers accepting writes have this overlay configured in order to maintain
uniqueness in a replicated DIT.
181
182
183
184
185
.SH FILES
.TP
ETCDIR/slapd.conf
default slapd configuration file
.SH SEE ALSO
186
187
.BR slapd.conf (5),
.BR slapd\-config (5).