Re: unique overlay on a per branch basis

[Quanah Gibson-Mount <quanah@zimbra.com>]

--On Wednesday, September 24, 2014 6:34 PM +0000 Craig White 
<CWhite@skytouchtechnology.com> wrote:

> Assuming branches like:
>
>   ou=people,ou=company1,dc=example,dc=com
>
>   ou=people,ou=company2,dc=example,dc=com
>
> Is it possible to use a regular expression in the configuration to ensure 
a unique uid attribute in each branch but allow an identical uid attribute 
in different companies like:
> uid=Bob,ou=people,ou=company1,dc=example,dc=com
>
>  uid=Bob,ou=people,ou=company2,dc=example,dc=com

> I ask because the man page for slapo-unique seems to suggest only
> absolute dn's

No it does not.  From the man page:

      unique_uri <[strict ][ignore ]URI[URI...]...>
             Configure  the base, attributes, scope, and filter for 
uniqueness checking.  Multiple URIs may be specified within a domain, 
allowing complex selections of objects.  Mul-
             tiple unique_uri statements or olcUniqueURI attributes will 
create independent domains, each with their own independent lists of URIs 
and ignore/strict settings.

             Keywords strict and ignore have to be enclosed in quotes (") 
together with the URI.

             The LDAP URI syntax is a subset of RFC-4516, and takes the 
form:

             ldap:///[base dn]?[attributes...]?scope[?filter]

             The base dn defaults to that of the back-end database. 
Specified base dns must be within the subtree of the back-end database.

             If no attributes are specified, the URI applies to all 
non-operational attributes.

             The scope component is effectively mandatory, because LDAP 
URIs default to base scope, which is not valid for uniqueness, because 
groups of one object are always  unique.
             Scopes of sub (for subtree) and one for one-level are valid.

             The filter component causes the domain to apply uniqueness 
constraints only to matching objects.  e.g.  ldap:///?cn?sub?(sn=e*) would 
require unique cn attributes for all
             objects in the subtree of the back-end database whose sn 
starts with an e.

             It is possible to assert uniqueness upon all non-operational 
attributes except those listed by prepending the keyword ignore If not 
configured, all non-operational (e.g.,
             system)  attributes must be unique. Note that the attributes 
list of an ignore URI should generally contain the objectClass, dc, ou and 
o attributes, as these will gener-
             ally not be unique, nor are they operational attributes.

             It is possible to set strict checking for the uniqueness 
domain by prepending the keyword strict.  By default, uniqueness is not 
enforced for null values. Enabling strict
             mode  extends the concept of uniqueness to include null 
values, such that only one attribute within a subtree will be allowed to 
have a null value.  Strictness applies to
             all URIs within a uniqueness domain, but some domains may be 
strict while others are not.

Also, your example is completely bogus.  RDNs are already required to be 
unique in a given subtree.   There is no way you could have two entries of:

uid=bob,ou=people,ou=company1,dc=example,dc=com

I.e., it is already guaranteed that uid will be unique in this case, since 
it is the RDN value.

--Quanah



--

Quanah Gibson-Mount
Server Architect
Zimbra, Inc.
--------------------
Zimbra ::  the leader in open source messaging and collaboration