1 .TH SLAPO-UNIQUE 5 "RELEASEDATE" "OpenLDAP LDVERSION"
2 .\" Copyright 2004-2009 The OpenLDAP Foundation All Rights Reserved.
3 .\" Copying restrictions apply. See COPYRIGHT/LICENSE.
6 slapo-unique \- Attribute Uniqueness overlay to slapd
10 The Attribute Uniqueness overlay can be used with a backend database such as
12 to enforce the uniqueness of some or all attributes within a
13 scope. This subtree defaults to all objects within the subtree of the
14 database for which the Uniqueness overlay is configured.
16 Uniqueness is enforced by searching the subtree to ensure that the values of
17 all attributes presented with an
22 operation are unique within the scope.
23 For example, if uniqueness were enforced for the
25 attribute, the subtree would be searched for any other records which also
28 attribute containing the same value. If any are found, the request is
31 The search is performed using the rootdn of the database, to avoid issues
32 with ACLs preventing the overlay from seeing all of the relevant data. As
33 such, the database must have a rootdn configured.
37 options apply to the Attribute Uniqueness overlay.
38 They should appear after the
42 .B unique_uri <[strict ][ignore ]URI[URI...]...>
43 Configure the base, attributes, scope, and filter for uniqueness
44 checking. Multiple URIs may be specified within a domain, allowing complex selections of objects. Multiple
48 attributes will create independent domains, each with their own independent lists of URIs and ignore/strict settings.
50 The LDAP URI syntax is a subset of
54 ldap:///[base dn]?[attributes...]?scope[?filter]
58 defaults to that of the back-end database. Specified base dns must be within the subtree of the back-end database.
62 are specified, the URI applies to all non-operational attributes.
66 component is effectively mandatory, because LDAP URIs default to
68 scope, which is not valid for uniqueness, because groups of one object
69 are always unique. Scopes of
73 for one-level are valid.
77 component causes the domain to apply uniqueness constraints only to
78 matching objects. e.g.
79 .B ldap:///?cn?sub?(sn=e*)
82 attributes for all objects in the subtree of the back-end database whose
86 It is possible to assert uniqueness upon all non-operational
87 attributes except those listed by prepending the keyword
89 If not configured, all non-operational (e.g., system) attributes must be
94 URI should generally contain the
100 attributes, as these will generally not be unique, nor are they operational
103 It is possible to set strict checking for the uniqueness domain by
104 prepending the keyword
106 By default, uniqueness is not enforced
107 for null values. Enabling
109 mode extends the concept of uniqueness to include null values, such
110 that only one attribute within a subtree will be allowed to have a
111 null value. Strictness applies to all URIs within a uniqueness
112 domain, but some domains may be strict while others are not.
114 It is not possible to set both URIs and legacy slapo-unique configuration parameters simultaneously. In general, the legacy configuration options control pieces of a single unfiltered subtree domain.
116 .B unique_base <basedn>
117 This legacy configuration parameter should be converted to the
119 component of the above
123 .B unique_ignore <attribute...>
124 This legacy configuration parameter should be converted to a
128 keyword as described above.
130 .B unique_attributes <attribute...>
131 This legacy configuration parameter should be converted to a
133 parameter, as described above.
136 This legacy configuration parameter should be converted to a
138 keyword prepended to a
140 parameter, as described above.
144 cannot be used with the old-style of configuration, and vice versa.
146 can implement everything the older system can do, however.
148 Typical attributes for the
149 .B ignore ldap:///...
150 URIs are intentionally not hardcoded into the overlay to allow for
151 maximum flexibility in meeting site-specific requirements.
155 default slapd configuration file
158 .BR slapd\-config (5).