slapo-constraint — Attribute Constraint Overlay to slapd
ETCDIR/slapd.conf
The constraint overlay is used to ensure that attribute values match some constraints beyond basic LDAP syntax. Attributes can have multiple constraints placed upon them, and all must be satisfied when modifying an attribute value under constraint.
This overlay is intended to be used to force syntactic regularity upon certain string represented data which have well known canonical forms, like telephone numbers, post codes, FQDNs, etc.
It constrains only LDAP adds and modify commands and only seeks to control the add and modify value of a modify request.
This slapd.conf
option applies to the constraint overlay. It should appear
after the overlay
directive.
Specifies the constraint which should apply to the
attribute named as the first parameter. Two types of
constraint are currently supported - regex and uri.
The parameter following the regex type is a Unix style
regular expression (See regex(7) ). The
parameter following the uri type is an LDAP
URI. The URI will be evaluated using an internal
search. It must not include a hostname, and it must
include a list of attributes to evaluate.
Any attempt to add or modify an attribute named as part of the constraint overlay specification which does not fit the constraint listed will fail with a LDAP_CONSTRAINT_VIOLATION error.
overlay constraint constraint_attribute mail regex ^[:alnum:]+@mydomain.com$ constraint_attribute title uri ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog)A specification like the above would reject any
titleattribute whose values were not listed in thetitleattribute of anytitleCatalogentries in the given scope.
This module was written in 2005 by Neil Dunbar of Hewlett-Packard and subsequently extended by Howard Chu and Emmanuel Dreyfus. OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from University of Michigan LDAP 3.3 Release.