I have several branches in my LDAP directory that all use a UID attribute as part of the DN. Recently, I've been tasked with ensuring uniqueness for the UID attribute across the board, so that UID cannot match from one subtree to another one.
Using slapo-unique does work, up to a point. The issue arises when I add a user, but do not explicitly define the UID attribute in the LDIF, or application running the import.
First, we'll assume I have the following rule defined:
Now, as an example, let's say I have an existing user who's DN is "uid=userj,ou=People,dc=domain,dc=com"
I then add the following ldif:
dn: uid=userj,ou=OtherPeople,dc=domain,dc=net givenName: Joe objectClass: inetOrgPerson cn: Joe User sn: User uid: userj mail: email@example.com
As one might expect, I get an error about uniqueness for uid. The issue arises now when I don't explicitly include the UID, but rely on that to be set via slapd on import because it's defined as the distinguished name:
dn: uid=userj,ou=OtherPeople,dc=domain,dc=net givenName: Joe objectClass: inetOrgPerson cn: Joe User sn: User mail: firstname.lastname@example.org
And this is permitted. After adding this, a search using the search filter "(uid=userj) will pull up the two DNs:
uid=userj,ou=People,dc=domain,dc=com and uid=userj,ou=OtherPeople,dc=domain,dc=net
And both of them will show they have a UID attribute set to "userj". Looking at the debugging logs for slapd, when I don't explicitly set the UID in the ldif (which shouldn't be necessary as it's implied from the new DN), the logs show that it never queries LDAP for that UID attribute.
So, anyone have a suggestion how I might get around this issue? Obviously I suggested to people to always and implicitly define the UID attribute, even though it's part of the DN, but some people are stubborn and like to find ways to violate constraints.
Thanks in advance;