7.3. Linking Attributes to Manage Attribute Values
7.3.1. About Linking Attributes
linkType
) and one attribute which is automatically maintained by the plug-in (managedType
).

Figure 7.4. Basic Linked Attribute Configuration
Note

Figure 7.5. Restricting the Linked Attribute Plug-in to a Specific Subtree
- Both the managed attribute and linked attribute must require the Distinguished Name syntax in their attribute definitions. The linked attributes are essentially managed cross-references, and the way that the plug-in handles these cross-references is by pulling the DN of the entry from the attribute value.For information on planning custom schema elements, see Chapter 12, Managing the Directory Schema.
- Each Linked Attribute Plug-in instance must be local and any managed attributes must be blocked from replication using fractional replication.Any changes that are made on one supplier will automatically trigger the plug-in to manage the values on the corresponding directory entries, so the data stay consistent across servers. However, the managed attributes must be maintained by the plug-in instance for the data to be consistent between the linked entries. This means that managed attribute values should be maintained solely by the plug-in processes, not the replication process, even in a multi-master replication environment.For information on using fractional replication, see Section 15.1.7, “Replicating a Subset of Attributes with Fractional Replication”.
7.3.2. Looking at the Linking Attributes Plug-in Syntax
- The attribute that is managed manually by administrators, in the
linkType
attribute - The attribute that is created dynamically by the plug-in, in the
managedType
attribute - Optionally, a scope that restricts the plug-in to a specific part of the directory tree, in the
linkScope
attribute
Example 7.6. Example Linked Attributes Plug-in Instance Entry
dn: cn=Manager Link,cn=Linked Attributes,cn=plugins,cn=config objectClass: top objectClass: extensibleObject cn: Manager Link linkType: directReport managedType: manager linkScope: ou=people,dc=example,dc=com
Table 7.2. Linked Attributes Plug-in Instance Attributes
Plug-in Attribute | Description |
---|---|
cn | Gives a unique name for the plug-in instance. |
linkScope | Contains the DN of a suffix to which to restrict the function of the plug-in instance. |
linkType | Gives the attribute which is maintained by an administrator. This attribute is manually maintained and is used as the reference for the plug-in. This attribute must have a DN value format. When the attribute is added, modified, or deleted, then its value contains the DN of the target entry for the plug-in to update. |
managedType | Gives the attribute which is maintained by the plug-in. This attribute is created and updated on target entries. This attribute must have a DN value format. When the attribute is added to the entry, its value will point back as a cross-reference to the managed entry. |
7.3.3. Configuring Attribute Links
Note
- If it is not already enabled, enable the Linked Attributes Plug-in, as described in Section 1.9.2.2, “Enabling Plug-ins in the Directory Server Console” or Section 1.9.1, “Enabling Plug-ins Dynamically”.
- Create the plug-in instance. Both the
managedType
andlinkType
attributes are required. The plug-in syntax is covered in Section 7.3.2, “Looking at the Linking Attributes Plug-in Syntax”. The following example shows the plug-in instance created by usingldapmodify
:dn: cn=Manager Link,cn=Linked Attributes,cn=plugins,cn=config changetype: add objectClass: top objectClass: extensibleObject cn: Manager Link linkType: directReport managedType: manager
- If the server is not configured to enable dynamic plug-ins using
nsslapd-dynamic-plugins
, restart the server to apply the new plug-in instance:# systemctl restart dirsrv.target
7.3.4. Cleaning up Attribute Links
fixup-linkedattrs.pl
) or by launching a fix-up task.
7.3.4.1. Regenerating Linked Attributes Using fixup-linkedattrs.pl
fixup-linkedattrs.pl
script launches a special task to regenerate all of the managed-link attribute pairs on directory entries. One or the other may be lost in certain situations. If the link attribute exists in an entry, the task traces the cross-referenced DN in the available attribute and creates the corresponding configured managed attribute on the referenced entry. If a managed attribute exists with no corresponding link attribute, then the managed attribute value is removed.
# fixup-linkedattrs.pl -D "cn=Directory Manager" -w password
-l
option to specify the target plug-in instance DN:
# fixup-linkedattrs.pl -D "cn=Directory Manager" -w password -l "cn=Manager Link,cn=Linked Attributes,cn=plugins,cn=config"
fixup-linkedattrs.pl
script in the Red Hat Directory Server Configuration, Command, and File Reference.
7.3.4.2. Regenerating Linked Attributes Using ldapmodify
cn=tasks
configuration entry in the dse.ldif
file, so it is also possible to initiate a task by adding the entry using ldapmodify
. When the task is complete, the entry is removed from the directory.
fixup-linkedattrs.pl
script when it is run.
cn=fixup linked attributes,cn=tasks,cn=config
entry. The only required attribute is the cn
for the specific task, though it also allows the ttl
attribute to set a timeout period. Using ldapmodify
:
dn: cn=example,cn=fixup linked attributes,cn=tasks,cn=config changetype: add cn:example ttl: 5
dse.ldif
configuration, so it is possible to reuse the same task entry continually.
cn=fixup linked attributes
task configuration is described in more detail in the Configuration, Command, and File Reference.