I've followed the docs (and some forums), and made these modifications: (OpenLDAP doc: http://www.openldap.org/doc/admin24/overlays.html#Attribute%20Uniqueness) but I still can set the mail attribute as same e-mail address for two different users.

Michael Ströder wrote: >On 8/8/18 11:25 AM, Ervin Hegedüs wrote: >>I've followed the docs (and some forums), and made these >>modifications: >> >>(OpenLDAP doc: >>http://www.openldap.org/doc/admin24/overlays.html#Attribute%20Uniqueness) >> >>but I still can set the mail attribute as same e-mail address >>for two different users. > >It should just work. Which OpenLDAP version and builds are you using? > >Wild guess: Did you also add an eq-index for the unique attributes *and* re-index the DB? (Note - adding an index by LDAPmodify'ing cn=config automatically reindexes the DB...)

On 8/8/18 12:43 PM, Howard Chu wrote: > Michael Ströder wrote: >> On 8/8/18 11:25 AM, Ervin Hegedüs wrote: >>> I've followed the docs (and some forums), and made these >>> modifications: >>> >>> (OpenLDAP doc: >>> http://www.openldap.org/doc/admin24/overlays.html#Attribute%20Uniqueness) >>> >>> but I still can set the mail attribute as same e-mail address >>> for two different users. >> >> It should just work. Which OpenLDAP version and builds are you using? >> >> Wild guess: Did you also add an eq-index for the unique attributes *and* re-index the DB? > > (Note - adding an index by LDAPmodify'ing cn=config automatically reindexes the DB...) Yes, I know.

On Wed, Aug 08, 2018 at 12:36:06PM +0200, Michael Ströder wrote: > *and* > re-index the DB? no. (never)

Hi Michael, On Wed, Aug 08, 2018 at 12:51:53PM +0200, Michael Ströder wrote: > On 8/8/18 12:46 PM, Ervin Hegedüs wrote: > >On Wed, Aug 08, 2018 at 12:36:06PM +0200, Michael Ströder wrote: > >>*and* > >>re-index the DB? > > > >no. (never) > > Please check whether the search (mail=foo(a)example.com) really returns the > existing entries. # slapindex -n 1 ... # ... modified the entry's mail to an existing one... # ldapsearch -vvv -x -H ldaps://dev-ldap-01:636 -b "dc=hu" -D "admin..." -w "mail=airween(a)company.hu" | grep ^mail ldap_initialize( ldaps://dev-ldap-01:636/??base ) Enter LDAP Password: filter: mail=airween(a)company.hu requesting: All userApplication attributes mail: airween(a)company.hu mail: airween(a)company.hu (there are two entries) # ... rollback the modification ... # ldapsearch -vvv -x -H ldaps://dev-ldap-01:636 -b "dc=hu" -D "admin..." -w "mail=airween(a)company.hu" | grep ^mail ldap_initialize( ldaps://dev-ldap-01:636/??base ) Enter LDAP Password: filter: mail=airween(a)company.hu requesting: All userApplication attributes mail: airween(a)company.hu (there is only one entry) relevant output of 'slapcat -b cn=config': dn: cn=module{2},cn=config objectClass: olcModuleList cn: module{2} olcModulePath: /usr/lib/ldap/ olcModuleLoad: {0}unique.la structuralObjectClass: olcModuleList ... dn: olcOverlay={1}unique,olcDatabase={1}mdb,cn=config objectClass: olcOverlayConfig objectClass: olcUniqueConfig olcOverlay: {1}unique olcUniqueURI: ldap:///?uid?sub? olcUniqueURI: ldap:///?mail?sub? olcUniqueURI: ldap:///?uidNumber?sub? olcUniqueURI: ldap:///?sn?sub? olcUniqueURI: ldap:///?cn?sub? olcUniqueURI: ldaps:///?uid?sub? olcUniqueURI: ldaps:///?mail?sub? olcUniqueURI: ldaps:///?uidNumber?sub? olcUniqueURI: ldaps:///?sn?sub? olcUniqueURI: ldaps:///?cn?sub? ... dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=hu ... olcDbIndex: objectClass eq olcDbIndex: cn,uid eq olcDbIndex: uidNumber,gidNumber eq olcDbIndex: member,memberUid eq olcDbIndex: mail eq olcDbIndex: sn eq

--On Thursday, August 09, 2018 9:51 AM +0200 Ervin Hegedüs <airween(a)gmail.com&gt; wrote: >>olcUniqueURI: ldap:///?uid?sub? >>olcUniqueURI: ldap:///?mail?sub? >>olcUniqueURI: ldap:///?uidNumber?sub? >>olcUniqueURI: ldap:///?sn?sub? >>olcUniqueURI: ldap:///?cn?sub?

>>olcUniqueURI: ldaps:///?uid?sub? >>olcUniqueURI: ldaps:///?mail?sub? >>olcUniqueURI: ldaps:///?uidNumber?sub? >>olcUniqueURI: ldaps:///?sn?sub? >>olcUniqueURI: ldaps:///?cn?sub? Using "ldaps://" here is invalid. These are internal searches that don't use the LDAP protocol.

One thing you've not shown in your configurations is whether or not the {1}mdb,cn=config DB has a rootdn configured for that database instance. As noted in the man page, a rootdn is required on the specific database instance for the overlay to function: " The search is performed using the rootdn of the database, to avoid issues with ACLs preventing the overlay from seeing all of the relevant data. As such, the database must have a rootdn configured."

Additionaly, you haven't noted how you are making the modifications to add the duplicate entries. Again, as noted in the man page: " Replication and operations with manageDsaIt control are allowed to bypass this enforcement. It is therefore important that all servers accepting writes have this overlay configured in order to maintain uniqueness in a replicated DIT.." So it is possible the LDAP client you are using to make the modifications is setting the manageDsaIT control.

--On Thursday, August 30, 2018 10:36 AM +0200 Ervin Hegedüs <airween(a)gmail.com&gt; wrote: > I'm using jXplorer, I didn't found any manageDsaIt settings, so I > assume that it doesn't support, perhaps I can't bypass the > enforcement - but may be I'm wrong. > > The unique key constraint still doesn't work. Start with the command line ldapmodify binary instead. jxplorer does in fact set the manageDSAIT flag on some operations.

--On Thursday, August 30, 2018 10:36 AM +0200 Ervin Hegedüs <airween(a)gmail.com&gt; wrote: >I'm using jXplorer, I didn't found any manageDsaIt settings, so I >assume that it doesn't support, perhaps I can't bypass the >enforcement - but may be I'm wrong. > >The unique key constraint still doesn't work. Start with the command line ldapmodify binary instead. jxplorer does in fact set the manageDSAIT flag on some operations.

On 8/8/18 12:46 PM, Ervin Hegedüs wrote: >On Wed, Aug 08, 2018 at 12:36:06PM +0200, Michael Ströder wrote: >>*and* >>re-index the DB? > >no. (never) Please check whether the search (mail=foo(a)example.com) really returns the existing entries.