Hello,
my goal it to extend a uniqueness configuration. I do already enforce uniqueness of mail addresses:
slapd.conf: moduleload unique.la overlay unique unique_uri ldap:///dc=basedn?mail?sub?
that works.
Now also address rewriting data should be migrated LDAP. Rewriting addresses are stored in the attribute "mailalternateaddress" Requirement: no address may occur twice no matter if stored as "mail" or "mailalternateaddress" Logical it's something like unique_uri (ldap:///dc=basedn?mail?sub?) OR (ldap:///dc=basedn?mail?sub?)
Now I fail to correctly translate that to a valid configuration. https://www.openldap.org/software/man.cgi?query=slapo-unique say "unique_uri <[strict ][ignore ]URI[URI...]...>" with a formal definition of URI "ldap:///[base dn]?[attributes...]?scope[?filter]" It also say "Multiple URIs may be specified within a domain, allowing complex selections of objects."
As the manpage doesn't give an example I tried: unique_uri ldap:///dc=ldap?mailalternateaddress?sub ldap:///dc=ldap?mail?sub
slapd logs 5c445384 /etc/openldap/slapd.conf: line 149 (unique_uri ldap:///dc=ldap?mailalternateaddress?sub ldap:///dc=ldap?mail?sub) -> slapd starts but uniqueness is not enforced
So I tried multiple versions: To make it readable: uri1=ldap:///dc=ldap?mailalternateaddress?sub uri2=ldap:///dc=ldap?mail?sub
unique_uri uri1 uri2 unique_uri uri1uri2 unique_uri uri1,uri2 unique_uri uri1, uri2 unique_uri "uri1 uri2" unique_uri "uri1""uri2" unique_uri "uri1","uri2" unique_uri "uri1", "uri2"
Mostly slapd failed to start with an error "invalid ldap urilist" If slapd started, the uniqueness wasn't enforced One version (unique_uri "uri1 uri2") result in slapd consume 100% cpu time.
Anybody have a hint how to enforce uniqueness on multiple attributes?
Andreas
On 1/20/19 12:13 PM, A. Schulze wrote:
my goal it to extend a uniqueness configuration. I do already enforce uniqueness of mail addresses:
slapd.conf: moduleload unique.la overlay unique unique_uri ldap:///dc=basedn?mail?sub?
that works.
Now also address rewriting data should be migrated LDAP. Rewriting addresses are stored in the attribute "mailalternateaddress" Requirement: no address may occur twice no matter if stored as "mail" or "mailalternateaddress" Logical it's something like unique_uri (ldap:///dc=basedn?mail?sub?) OR (ldap:///dc=basedn?mail?sub?)
The OR is not possible.
Thus in Æ-DIR I store all possible e-mail addresses in one attribute (in my case 'mailLocalAddress' representing a mailbox) for which uniqueness is enforced and maintain a copy of the preferred address in attribute 'mail'.
Additional constraints ensure that 'mail' has only one value and the value of 'mail' is member of set in 'mailLocalAddress'.
Those attributes then also get synced to MS AD attributes 'proxyAddresses' and 'mail' if the mailboxes are in Exchange.
Ciao, Michael.
Michael Ströder:
Logical it's something like unique_uri (ldap:///dc=basedn?mail?sub?) OR (ldap:///dc=basedn?mail?sub?)
The OR is not possible.
What else does the following statement on "unique_uri" mean? How should I understand that?
Multiple URIs may be specified within a domain, allowing complex selections of objects. Multiple unique_uri statements or olcUniqueURI attributes will create independent domains, each with their own independent lists of URIs and ignore/strict settings.
source: https://www.openldap.org/software/man.cgi?query=slapo-unique
The sentences clearly distinguish between ONE unique_uri statement with multiple URIs and MULTIPLE unique_uri statements
Maybe someone knows an example for the first version to clarify it's use.
Andreas
On 1/21/19 11:43 AM, A. Schulze wrote:
Michael Ströder:
Logical it's something like unique_uri (ldap:///dc=basedn?mail?sub?) OR (ldap:///dc=basedn?mail?sub?)
The OR is not possible.
What else does the following statement on "unique_uri" mean? [..snipped..]
Example:
If you have two unique_uri statements
unique_uri ldap:///dc=basedn?a?sub? unique_uri ldap:///dc=basedn?b?sub?
this will result in a uniqueness checking filter like this:
(|(a=val1)(b=val2))
Note that val1 and val2 are different values!
What you'd like is a nested filter like for checking val1 in two different attributes like this:
(|(|(a=val1)(b=val1))(c=val2))
To best of my knowledge this is not possible.
Ciao, Michael.
openldap-technical@openldap.org
-
A. Schulze -
Michael Ströder