7.3. Linking Attributes to Manage Attribute Values
7.3.1. About Linking Attributes
linkType
) and one attribute which is automatically maintained by the plug-in (managedType
).

Figure 7.5. Basic Linked Attribute Configuration
Note

Figure 7.6. Restricting the Linked Attribute Plug-in to a Specific Subtree
- Both the managed attribute and linked attribute must require the Distinguished Name syntax in their attribute definitions. The linked attributes are essentially managed cross-references, and the way that the plug-in handles these cross-references is by pulling the DN of the entry from the attribute value.For information on planning custom schema elements, see Chapter 12, Managing the Directory Schema.
- Each Linked Attribute Plug-in instance must be local and any managed attributes must be blocked from replication using fractional replication.Any changes that are made on one supplier will automatically trigger the plug-in to manage the values on the corresponding directory entries, so the data stay consistent across servers. However, the managed attributes must be maintained by the plug-in instance for the data to be consistent between the linked entries. This means that managed attribute values should be maintained solely by the plug-in processes, not the replication process, even in a multi-master replication environment.For information on using fractional replication, see Section 15.1.7, “Replicating a Subset of Attributes with Fractional Replication”.
7.3.2. Looking at the Linking Attributes Plug-in Syntax
- The attribute that is managed manually by administrators, in the
linkType
attribute - The attribute that is created dynamically by the plug-in, in the
managedType
attribute - Optionally, a scope that restricts the plug-in to a specific part of the directory tree, in the
linkScope
attribute
Example 7.5. Example Linked Attributes Plug-in Instance Entry
dn: cn=Manager Link,cn=Linked Attributes,cn=plugins,cn=config objectClass: top objectClass: extensibleObject cn: Manager Link linkType: directReport managedType: manager linkScope: ou=people,dc=example,dc=com
7.3.3. Configuring Attribute Links
- If it is not already enabled, enable the Linked Attributes plug-in. For details, see Section 1.10.3, “Enabling and Disabling Plug-ins”.f
- Create the plug-in instance. Both the
--managed-type
and--link-type
parameters are required. The following example shows the plug-in instance created by usingdsconf
:# dsconf -D "cn=Directory Manager" ldap://server.example.com plugin linked-attr config "Manager Link" add --link-type=directReport --managed-type=manager
- Restart the instance:
# dsctl instance_name restart
If you enable the dynamic plug-in as described in Section 1.10.2, “Enabling Plug-ins Dynamically”, restarting the instance is not required.
7.3.4. Cleaning up Attribute Links
dsconf plugin linked-attr fixup
command or by launching a fix-up task.
7.3.4.1. Regenerating Linked Attributes
dsconf plugin linked-attr fixup
command launches a special task to regenerate all of the managed-link attribute pairs on directory entries. One or the other may be lost in certain situations. If the link attribute exists in an entry, the task traces the cross-referenced DN in the available attribute and creates the corresponding configured managed attribute on the referenced entry. If a managed attribute exists with no corresponding link attribute, then the managed attribute value is removed.
# dsconf -D "cn=Directory Manager" ldap://server.example.com plugin linked-attr fixup
# dsconf -D "cn=Directory Manager" ldap://server.example.com plugin linked-attr fixup "cn=Manager Link,cn=Linked Attributes,cn=plugins,cn=config"
7.3.4.2. Regenerating Linked Attributes Using ldapmodify
cn=tasks
configuration entry in the dse.ldif
file, so it is also possible to initiate a task by adding the entry using ldapmodify
. When the task is complete, the entry is removed from the directory.
dsconf plugin linked-attr fixup
command when it is run.
cn=fixup linked attributes,cn=tasks,cn=config
entry. The only required attribute is the cn
for the specific task, though it also allows the ttl
attribute to set a timeout period. Using ldapmodify
:
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=example,cn=fixup linked attributes,cn=tasks,cn=config changetype: add cn:example ttl: 5
dse.ldif
configuration, so it is possible to reuse the same task entry continually.
cn=fixup linked attributes
task configuration is described in more detail in the Configuration, Command, and File Reference.