Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have OpenLDAP configured to act as a metadirectory in front of three different backends:

database meta
uri "ldap://,o=combined"
uri "ldap://,o=combined"
uri "ldap://,o=combined"
# ...and some suffixmap rules...

I do not have control over any of the backend directory servers.

The backends provide partially overlapping information and it is possible that someone may have an account with the same username but a different password on different backend servers.

Is it possible to enforce some sort of ordering on the backends such that (a) OpenLDAP will always query the backends in the same order and (b) return a single result (and stop searching) after finding a match? As far as I can tell, the backends are either queried in parallel or in an order that is not related to the order in which they are listed in slapd.conf.

share|improve this question
You mean to say the there are duplicates of the full dn? or just the rdn? – 84104 Aug 4 '11 at 21:03
There are duplicates of the uid (equivalent) neither (or not necessarily) the dn or rdn. – larsks Aug 4 '11 at 23:25
up vote 1 down vote accepted

From a discussion on the OpenLDAP technical mailing list:

  • The meta database searches the referenced backend servers in parallel, so the order of returned results is non-deterministic...but you get your results faster, since a slow backend won't delay the values from other backends.

  • Multiple databases using the ldap backend will be searched sequentially. This gets you the results in a predictable order, but has a noticeable impact on the time taken to complete the request.

There does not appear to be a good way to enforce uniqueness of results across multiple backends, other than setting sizelimit 1 and using the sequential configuration.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.