Chapter 9. Using Referential Integrity to maintain relationships between entries

Procedure

1. Enable the Referential Integrity plug-in:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin referential-integrity enable

2. Set the subtree in which the plug-in searches for delete or rename operations of user entries:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin referential-integrity set --entry-scope "ou=People,dc=example,dc=com"

3. Optional: Exclude a subtree under the entry scope:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin referential-integrity set --exclude-entry-scope "ou=Special Users,ou=People,dc=example,dc=com"

   This command configures the plug-in to ignore delete or rename operations performed in the ou=Special Users,ou=People,dc=example,dc=com subtree.

4. Configure the subtree in which the plug-in updates group entries:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin referential-integrity set --container-scope "ou=Groups,dc=example,dc=com"

5. By default, the plug-in performs integrity updates on the member, uniqueMember, owner, and seeAlso attributes. To specify other attributes, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin referential-integrity set --membership-attr attribute_1 attribute_2

   Note that this command overrides the list of attributes in the plug-in’s configuration. If you want to add an attribute, pass the current list of attributes and the additional one to the --membership-attr option.

6. Optional: By default, Directory Server performs referential integrity checks immediately. If you want to set a delay, enter:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin referential-integrity set --update-delay=5

   This command delays the referential integrity checks by 5 seconds. Note that, if you enabled the Referential Integrity on multiple suppliers, setting a delay can cause replication loops and directory inconsistencies. To avoid such problems, enable the plug-in only on one supplier in the topology.

7. Restart the instance:

   # dsctl instance_name restart

Verification

1. Display the Referential Integrity plug-in configuration:

   # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin referential-integrity show
   ...
   nsslapd-plugincontainerscope: ou=Groups,dc=example,dc=com
   nsslapd-pluginentryscope: ou=People,dc=example,dc=com
   ...
   referint-membership-attr: member
   referint-membership-attr: uniquemember
   referint-membership-attr: owner
   referint-membership-attr: seeAlso
   referint-update-delay: 0
   ...

2. List the members of a group by displaying the member attributes of the groups:

   # ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com -b "cn=demoGroup,ou=Groups,dc=example,dc=com" member
   ...
   member: uid=demoUser,ou=People,dc=example,dc=com

3. Delete the uid=demoUser,ou=People,dc=example,dc=com user:

   # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" user delete "uid=demoUser,ou=People,dc=example,dc=com"

4. Display the members of the group again:

   # ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com -b "cn=demoGroup,ou=People,dc=example,dc=com" member

   If uid=demoUser,ou=People,dc=example,dc=com is no longer listed as a member of the group, the Referential Integrity plug-in works.

Procedure

1. Navigate to Plugins → Referential Integrity.
2. Enable the plug-in.
3. Click Actions → Restart Instance.
4. Navigate again to Plugins → Referential Integrity.
5. By default, the plug-in performs integrity updates on the member, uniqueMember, owner, and seeAlso attributes. To specify other attributes, update the list in the Membership Attribute field.
6. Set the Entry Scope field to the DN of the subtree in which the plug-in should search for delete or rename operations of user entries.
7. Optional: To exclude a subtree under the entry scope, enter the DN of the subtree in the Exclude Entry Scope field.
8. Set the Container Scope field to the DN of the subtree in which the plug-in should update group entries.
9. Optional: Update the path to the Referential Integrity log file. Directory Server uses this file to track changes in the directory. Note that the dirsrv user must have write permissions to this location.

10. Optional: By default, Directory Server performs referential integrity checks immediately. If you want to set a delay, set it in the Update Delay field.

    Note that, if you enabled the Referential Integrity on multiple suppliers, setting a delay can cause replication loops and directory inconsistencies. To avoid such problems, enable the plug-in only on one supplier in the topology.

11. Click Save Config.

Verification

1. List the members of a group by displaying the member attributes of the groups:

   # ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com -b "cn=demoGroup,ou=Groups,dc=example,dc=com" member
   ...
   member: uid=demoUser,ou=People,dc=example,dc=com

2. Delete the uid=demoUser,ou=People,dc=example,dc=com user:

   # dsidm -D "cn=Directory manager" ldap://server.example.com -b "dc=example,dc=com" user delete "uid=demoUser,ou=People,dc=example,dc=com"

3. Display the members of the group again:

   # ldapsearch -D "cn=Directory Manager" -W -H ldap://server.example.com -b "cn=demoGroup,ou=People,dc=example,dc=com" member

   If uid=demoUser,ou=People,dc=example,dc=com is no longer listed as a member of the group, the Referential Integrity plug-in works.