5.4. About Managed Entries
posixAccountentry) is created, a corresponding group entry (
posixGroupentry) should also be created. An instance of the Managed Entries Plug-in identifies what entry (the origin entry) triggers the plug-in to automatically generate a new entry (the managed entry). It also identifies a separate template entry which defines the managed entry configuration.
- The search criteria to identify the origin entries (using a search scope and a search filter)
- The subtree under which to create the managed entries (the new entry location)
- The template entry to use for the managed entries
Figure 5.4. Defining Managed Entries
dn: cn=Posix User-Group,cn=Managed Entries,cn=plugins,cn=config objectclass: extensibleObject cn: Posix User-Group originScope: ou=people,dc=example,dc=com originFilter: objectclass=posixAccount managedBase: ou=groups,dc=example,dc=com managedTemplate: cn=Posix User-Group Template,ou=Templates,dc=example,dc=com
5.4.1. Defining the Template for Managed Entries
dn: cn=Posix User-Group Template,ou=Templates,dc=example,dc=com objectclass: mepTemplateEntry cn: Posix User-Group Template mepRDNAttr: cn mepStaticAttr: objectclass: posixGroup mepMappedAttr: cn: $uid Group mepMappedAttr: gidNumber: $gidNumber mepMappedAttr: memberUid: $uid
Figure 5.5. Managed Entries, Templates, and Origin Entries
5.4.2. Entry Attributes Written by the Managed Entries Plug-in
dn: uid=jsmith,ou=people,dc=example,dc=com objectclass: mepOriginEntry objectclass: posixAccount ... sn: Smith mail: email@example.com mepManagedEntry: cn=jsmith Posix Group,ou=groups,dc=example,dc=com
dn: cn=jsmith Posix Group,ou=groups,dc=example,dc=com objectclass: mepManagedEntry objectclass: posixGroup ... mepManagedBy: uid=jsmith,ou=people,dc=example,dc=com
5.4.3. Managed Entries Plug-in and Directory Server Operations
- Add. With every add operation, the server checks to see if the new entry is within the scope of any Managed Entries Plug-in instance. If it meets the criteria for an origin entry, then a managed entry is created and managed entry-related attributes are added to both the origin and managed entry.
- Modify. If an origin entry is modified, it triggers the plug-in to update the managed entry.Changing a template entry, however, does not update the managed entry automatically. Any changes to the template entry are not reflected in the managed entry until after the next time the origin entry is modified.The mapped managed attributes within a managed entry cannot be modified manually, only by the Managed Entry Plug-in. Other attributes in the managed entry (including static attributes added by the Managed Entry Plug-in) can be modified manually.
- Delete. If an origin entry is deleted, then the Managed Entries Plug-in will also delete any managed entry associated with that entry.There are some limits on what entries can be deleted.
- A template entry cannot be deleted if it is currently referenced by a plug-in instance definition.
- A managed entry cannot be deleted except by the Managed Entries Plug-in.
- Rename. If an origin entry is renamed, then plug-in updates the corresponding managed entry. If the entry is moved out of the plug-in scope, then the managed entry is deleted, while if an entry is moved into the plug-in scope, it is treated like an add operation and a new managed entry is created.As with delete operations, there are limits on what entries can be renamed or moved.
- A configuration definition entry cannot be moved out of the Managed Entries Plug-in container entry. If the entry is removed, that plug-in instance is inactivated.
- If an entry is moved into the Managed Entries Plug-in container entry, then it is validated and treated as an active configuration definition.
- A template entry cannot be renamed or moved if it is currently referenced by a plug-in instance definition.
- A managed entry cannot be renamed or moved except by the Managed Entries Plug-in.
- Replication. The Managed Entries Plug-in operations are not initiated by replication updates. If an add or modify operation for an entry in the plug-in scope is replicated to another replica, that operation does not trigger the Managed Entries Plug-in instance on the replica to create or update an entry. The only way for updates for managed entries to be replicated is to replicate the final managed entry over to the replica.