Re: unique contraint bypassed by java modify (and correctly enforced by pytho/ldapmodify)

On Fri, Sep 25, 2015 at 09:51:59 +0200, Alessandro Dentella wrote:

On Thu, Sep 24, 2015 at 04:34:13PM -0700, Quanah Gibson-Mount wrote:

...

I'd guess that java is using the manageDSAit control to bypass slapo-unique, and your other programs aren't.

Honestly I didn't even know about this possibility. Can I see that from the logs? They're not currently aware of using it unless is a default. What check can I ask them to perform?

Is there a way to inhibit this kind of access?

It should not be allowed if your client has only "write" access but no "manage" access. Are you using the rootdn?

Geert