1

I have several branches in my LDAP directory that all use a UID attribute as part of the DN. Recently, I've been tasked with ensuring uniqueness for the UID attribute across the board, so that UID cannot match from one subtree to another one.

Using slapo-unique does work, up to a point. The issue arises when I add a user, but do not explicitly define the UID attribute in the LDIF, or application running the import.

First, we'll assume I have the following rule defined:

olcUniqueURI: ldap:///dc=domain,dc=com?uid?sub?(objectClass=inetOrgPerson)

Now, as an example, let's say I have an existing user who's DN is "uid=userj,ou=People,dc=domain,dc=com"

I then add the following ldif:

dn: uid=userj,ou=OtherPeople,dc=domain,dc=net
givenName: Joe
objectClass: inetOrgPerson
cn: Joe User
sn: User
uid: userj
mail: userj@domain.com

As one might expect, I get an error about uniqueness for uid. The issue arises now when I don't explicitly include the UID, but rely on that to be set via slapd on import because it's defined as the distinguished name:

dn: uid=userj,ou=OtherPeople,dc=domain,dc=net
givenName: Joe
objectClass: inetOrgPerson
cn: Joe User
sn: User
mail: userj@domain.com

And this is permitted. After adding this, a search using the search filter "(uid=userj) will pull up the two DNs:

uid=userj,ou=People,dc=domain,dc=com and uid=userj,ou=OtherPeople,dc=domain,dc=net

And both of them will show they have a UID attribute set to "userj". Looking at the debugging logs for slapd, when I don't explicitly set the UID in the ldif (which shouldn't be necessary as it's implied from the new DN), the logs show that it never queries LDAP for that UID attribute.

So, anyone have a suggestion how I might get around this issue? Obviously I suggested to people to always and implicitly define the UID attribute, even though it's part of the DN, but some people are stubborn and like to find ways to violate constraints.

Thanks in advance;

  • Interesting, I think the correct fix would be to somehow canonicalize the LDIF before checking with slapo-unique. Can you do that? – ptman Mar 13 '18 at 20:30
  • Well, I can - yes. My team of developers, well...not so willing. I used LDIF formatted files in my example to best explain the issue. They are creating entries using some bizarre replacement to java JNDI. – Eirik Toft Mar 13 '18 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.