Returning first match only with OpenLDAP slapd-meta backend?

Question

I have OpenLDAP configured to act as a metadirectory in front of three different backends:

database meta
uri "ldap://ldap1.example.com/ou=domain1,o=combined"
uri "ldap://ldap2.example.com/ou=domain2,o=combined"
uri "ldap://ldap3.example.com/ou=domain3,o=combined"
# ...and some suffixmap rules...

I do not have control over any of the backend directory servers.

The backends provide partially overlapping information and it is possible that someone may have an account with the same username but a different password on different backend servers.

Is it possible to enforce some sort of ordering on the backends such that (a) OpenLDAP will always query the backends in the same order and (b) return a single result (and stop searching) after finding a match? As far as I can tell, the backends are either queried in parallel or in an order that is not related to the order in which they are listed in slapd.conf.

Answer 1

From a discussion on the OpenLDAP technical mailing list:

• The meta database searches the referenced backend servers in parallel, so the order of returned results is non-deterministic...but you get your results faster, since a slow backend won't delay the values from other backends.

• Multiple databases using the ldap backend will be searched sequentially. This gets you the results in a predictable order, but has a noticeable impact on the time taken to complete the request.

There does not appear to be a good way to enforce uniqueness of results across multiple backends, other than setting sizelimit 1 and using the sequential configuration.