Chapter 7. Managing Attributes and Values
7.1. Enforcing Attribute Uniqueness
7.1.1. Creating a New Configuration Record of the Attribute Uniqueness Plug-in
Note
Example Attribute Uniqueness
:
# ldapadd -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=Example Attribute Uniqueness,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject cn: Example Attribute Uniqueness nsslapd-pluginPath: libattr-unique-plugin nsslapd-pluginInitfunc: NSUniqueAttr_Init nsslapd-pluginType: betxnpreoperation nsslapd-pluginEnabled: off nsslapd-plugin-depends-on-type: database nsslapd-pluginId: NSUniqueAttr nsslapd-pluginVersion: none nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: Enforce unique attribute values uniqueness-attribute-name: uid
7.1.2. Configuring Attribute Uniqueness over Suffixes or Subtrees
7.1.2.1. Configuring Attribute Uniqueness over Suffixes or Subtrees Using the Command Line
mail
attributes are unique:
- Create a new configuration record of the Attribute Uniqueness plug-in named, for example,
mail Attribute Uniqueness
. For details, see Section 7.1.1, “Creating a New Configuration Record of the Attribute Uniqueness Plug-in”. - Enable the plug-in configuration record and configure that values stored in
mail
attributes must be unique inside, for example, theou=Engineering,dc=example,dc=com
andou=Sales,dc=example,dc=com
subtrees:# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=mail Attribute Uniqueness,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on - add: uniqueness-attribute-name uniqueness-attribute-name: mail - add: uniqueness-subtrees uniqueness-subtrees: ou=Engineering,dc=example,dc=com uniqueness-subtrees: ou=Sales,dc=example,dc=com
- Optionally, to configure uniqueness across all subtrees configured in this plug-in configuration record:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=mail Attribute Uniqueness,cn=plugins,cn=config changetype: modify add: uniqueness-across-all-subtrees uniqueness-across-all-subtrees: on
- Restart the instance:
# systemctl restart dirsrv@instance_name
7.1.2.2. Configuring Attribute Uniqueness over Suffixes or Subtrees Using the Console
mail
attributes are unique:
- Create a new configuration record of the Attribute Uniqueness plug-in. See Section 7.1.1, “Creating a New Configuration Record of the Attribute Uniqueness Plug-in”.
- Open the Property Editor in the plug-in configuration record's configuration. For details, see Section 1.9.3.2, “Configuring Plug-ins using the Console”.
- To enable the plug-in, set:
nsslapd-pluginEnabled: on
- Set that the
mail
attribute must be unique:uniqueness-attribute-name: mail
- Set the subtrees in which the attribute's value must be unique:
uniqueness-subtrees: ou=Engineering,dc=example,dc=com uniqueness-subtrees: ou=Sales,dc=example,dc=com
Select the value field of theuniqueness-subtrees
attribute and click the button to add the seconduniqueness-subtrees
attribute. - Optionally, to configure uniqueness across all subtrees configured in this plug-in configuration record, add the
uniqueness-across-all-subtrees
attribute and set it toon
:uniqueness-across-all-subtrees: on
- Click Property Editorto close the
- Restart the Directory Server instance. See Section 1.4.2, “Starting and Stopping a Directory Server Instance Using the Console”.
7.1.3. Configuring Attribute Uniqueness over Object Classes
uniqueness-attribute-name
is unique in this subtree.
Note
mail
attributes are unique under the entry that contains the nsContainer
object class:
- Create a new configuration record of the Attribute Uniqueness plug-in named, for example,
mail Attribute Uniqueness
. For details, see Section 7.1.1, “Creating a New Configuration Record of the Attribute Uniqueness Plug-in”. - Enable the plug-in configuration record and configure that values stored in
mail
attributes must be unique under the entry that contains thensContainer
object class:# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=mail Attribute Uniqueness,cn=plugins,cn=config changetype: modify replace: nsslapd-pluginEnabled nsslapd-pluginEnabled: on - add: uniqueness-top-entry-oc uniqueness-top-entry-oc: nsContainer
- Optionally, you can limit the scope of objects being checked. If you want the server to check only a subset of entries under the entry that contains the
nsContainer
object class, set an additional object class in theuniqueness-subtree-entries-oc
parameter. This additional class will also have to be present.For example, themail
attribute must be unique in all entries under the entry that contains thensContainer
object class set. However, you want that the plug-in only searches themail
in entries that contain a object class that provides this attribute, such asinetOrgPerson
. In this situation enter:# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=mail Attribute Uniqueness,cn=plugins,cn=config add: uniqueness-subtree-entries-oc uniqueness-subtree-entries-oc: inetOrgPerson
- Restart the instance:
# systemctl restart dirsrv@instance_name
7.1.4. Attribute Uniqueness Plug-in Configuration Parameters
cn=attribute_uniqueness_configuration_record_name,cn=plugins,cn=config
entry.
nsslapd-plugarg*
attributes (Example 7.2, “Attribute Uniqueness Plug-in Configuration Using nsslapd-pluginarg*
Attributes”).
Important
Example 7.1. Attribute Uniqueness Plug-in Configuration Using Plug-in-specific Attributes
dn: cn=Example Attribute Uniqueness,cn=plugins,cn=config nsslapd-pluginEnabled: on uniqueness-attribute-name: attribute_name uniqueness-top-entry-oc: objectclass1 uniqueness-subtree-entries-oc: objectclass2
Example 7.2. Attribute Uniqueness Plug-in Configuration Using nsslapd-pluginarg*
Attributes
dn: cn=Example Attribute Uniqueness,cn=plugins,cn=config nsslapd-pluginEnabled: on nsslapd-pluginarg0: attribute=mail nsslapd-pluginarg1: markerObjectClass=objectclass1 nsslapd-pluginarg2: requiredObjectClass=objectclass2
Table 7.1. Attribute Uniqueness Plug-in Configuration Parameters
Parameter | New or Old Syntax | Definition |
---|---|---|
cn | Both | Sets the name of the Attribute Uniqueness plug-in configuration record. You can use any string, but Red Hat recommends naming the configuration record attribute_name Attribute Uniqueness . |
nsslapd-pluginEnabled | Both | Enables (on ) or disables (off ) the plug-in configuration record. |
uniqueness-attribute-name | New | Sets the name of the attribute whose values must be unique. This attribute is multi-valued. |
uniqueness-subtrees | New | Sets the DN under which the plug-in checks for uniqueness of the attribute's value. This attribute is multi-valued. |
uniqueness-across-all-subtrees | New | If enabled (on ), the plug-in checks that the attribute is unique across all subtrees set. If you set the attribute to off , uniqueness is only enforced within the subtree of the updated entry. |
uniqueness-top-entry-oc | New | Directory Server searches this object class in the parent entry of the updated object. If it was not found, the search continues at the next higher level entry up to the root of the directory tree. If the object class was found, Directory Server verifies that the value of the attribute set in uniqueness-attribute-name is unique in this subtree. |
uniqueness-subtree-entries-oc | New | Optionally, when using the uniqueness-top-entry-oc parameter, you can configure that the Attribute Uniqueness plug-in only verifies if an attribute is unique, if the entry contains the object class set in this parameter. For details, see Section 7.1.3, “Configuring Attribute Uniqueness over Object Classes”. |
nsslapd-pluginarg0 | Old |
The plug-in-specific attribute equivalent of this
nsslapd-pluginarg* parameter is uniqueness-attribute-name . See this parameter for a description.
Set the attribute to
attribute=attribute_name .
|
nsslapd-pluginarg[1-9] | Old |
The plug-in-specific attribute equivalent of this
nsslapd-pluginarg* parameter is uniqueness-top-entry-oc . See this parameter for a description.
Set the attribute to
markerObjectClass=object_class .
|
nsslapd-pluginarg[1-9] | Old |
The equivalent plug-in-specific attribute is
uniqueness-subtree-entries-oc . See this parameter for a description.
Set the attribute to
requiredObjectClass=object_class .
|