I'm not entirely sure, but I think you're asking to rewrite attribute values (aka "right hand sides"), e.g.: [on disk you have] attribute: value=something,base=oldBase [but you want the clients to see] attribute: value=something,base=newBase You should be able to do this by rewriting searchAttrDN. Of course this only works for DN-syntax attributes. If you're (ab)using Directory Strings for this, then it's not going to happen without a custom overlay.

You need something like database relay suffix "o=Example,c=US" relay "dc=example,dc=com" overlay rwm rwm-rewriteEngine on rwm-rewriteMap ldap mail2uid "ldap://:9011/dc=example,dc=com?uid?sub" rwm-rewriteMap ldap uid2mail "ldap://:9011/dc=example,dc=com?mail?sub"

but it's ugly and inefficient. See slapo-rwm(5) for details.

Thanks for this tips, it's works fine. > database relay > suffix "o=Example,c=US" > relay "dc=example,dc=com" > overlay rwm > rwm-rewriteEngine on > rwm-rewriteMap ldap mail2uid > "ldap://:9011/dc=example,dc=com?uid?sub" > rwm-rewriteMap ldap uid2mail > "ldap://:9011/dc=example,dc=com?mail?sub" > > rwm-rewriteContext default > rwm-rewriteRule "^(.+,)?(mail=[^,]+),o=Example,c=US$" > "$1uid=${mail2uid($2)},dc=example,dc=com" ":@I" Why this rule is needed ? > rwm-rewriteRule "^(.+,)?o=Example,c=US$" > "$1dc=example,dc=com" ":@I" This rule isn't needed when I'm using "massage" argument for "relay" directive.

> rwm-rewriteContext searchEntryDN > rwm-rewriteRule "^(.+,)?(uid=[^,]+),dc=example,dc=com$" > "$1mail=${uid2mail($2)},o=Example,c=US" ":@I" This rule work fine. I've tried to do the same rule for departmentNumber and departmentUID RDN change but slapd doesn't start if I set this following rules : rwm-rewriteContext searchEntryDN rwm-rewriteRule "^(.+,)?(uid=[^,]+),dc=example,dc=com$" "$1mail={uid2mail($2)},o=Example,c=US" ":I" rwm-rewriteRule "^(.+,)?(departmentUID=[^,]+),dmdName=[^,]+,dc=[a-zA-Z]+,dc=example,dc=com$" "$1departmentNumber={uid2number($2)},ou=services,o=Example,c=US$" ":@I"

> rwm-rewriteRule "^(.+,)?dc=example,dc=com$" > "$1o=Example,c=US" ":@I" This rule isn't needed when I'm using "massage" argument for "relay" directive.

Last question : can I modify returned attribute value using rwm ?

Pierangelo Masarati <ando(a)sys-net.it&gt; wrote: > Only DN-valued attributes. It (intentionally) doesn't work for other > attrs. Why? I recently atempted to use it and gave up because of that.

Raphaël 'SurcouF' Bordet wrote: > Thanks for this tips, it's works fine. > >> database relay >> suffix "o=Example,c=US" >> relay "dc=example,dc=com" >> overlay rwm >> rwm-rewriteEngine on >> rwm-rewriteMap ldap mail2uid >> "ldap://:9011/dc=example,dc=com?uid?sub" >> rwm-rewriteMap ldap uid2mail >> "ldap://:9011/dc=example,dc=com?mail?sub" >> >> rwm-rewriteContext default >> rwm-rewriteRule "^(.+,)?(mail=[^,]+),o=Example,c=US$" >> "$1uid=${mail2uid($2)},dc=example,dc=com" ":@I" > > Why this rule is needed ? > >> rwm-rewriteRule "^(.+,)?o=Example,c=US$" >> "$1dc=example,dc=com" ":@I" > > This rule isn't needed when I'm using "massage" argument for "relay" > directive. The "massage" directive automatically instantiates the equivalent of this rule, and more. I rather configure those rules manually to be able to fine-grain control the order of execution of rules. >> rwm-rewriteContext searchEntryDN >> rwm-rewriteRule "^(.+,)?(uid=[^,]+),dc=example,dc=com$" >> "$1mail=${uid2mail($2)},o=Example,c=US" ":@I" > > This rule work fine. I've tried to do the same rule for departmentNumber > and departmentUID RDN change but slapd doesn't start if I set this > following rules : > > rwm-rewriteContext searchEntryDN > rwm-rewriteRule "^(.+,)?(uid=[^,]+),dc=example,dc=com$" > "$1mail={uid2mail($2)},o=Example,c=US" ":I" > rwm-rewriteRule "^(.+,)?(departmentUID=[^,]+),dmdName=[^,]+,dc=[a-zA-Z]+,dc=example,dc=com$" > "$1departmentNumber={uid2number($2)},ou=services,o=Example,c=US$" > ":@I" Did you define the uid2number map?

>> rwm-rewriteRule "^(.+,)?dc=example,dc=com$" >> "$1o=Example,c=US" ":@I" > > This rule isn't needed when I'm using "massage" argument for "relay" > directive. See above. > Last question : can I modify returned attribute value using rwm ? Only DN-valued attributes. It (intentionally) doesn't work for other attrs.