openldap: Attribute Uniqueness Overlay

http://www.symas.com/blog/?page_id=80

Attribute Uniqueness Overlay

It is sometimes necessary to enforce unique values for one or more attributes in a directory; the employee ID number is an excellent example of this requirement.

The Solution

It is sometimes necessary to enforce unique values for one or more attributes in a directory; the employee ID number is an excellent example of this requirement.

By default, the attribute uniqueness overlay will enforce uniqueness across all non-operational attributes in the request; the overlay can be configured to ignore certain attributes or to enforce uniqueness only upon specific attributes. If no Base DN is specified, the overlay will use the suffix of the database onto which it has been configured.

Typical Configuration

modulepath /opt/symas/lib/openldap
moduleload back_hdb.la
moduleload unique.la

database hdb
cachesize 10000
suffix “dc=symas,dc=com”

rootdn “cn=Manager,dc=symas,dc=com”
rootpw Secret

index default eq
index objectClass,dc,o,ou
index member,owner,seeAlso
index uid,employeeNumber

overlay unique
unique_base “ou=People,dc=symas,dc=com”
unique_attributes uid employeeNumber

Note that this configuration only enforces uniqueness within the subtree “ou=People,dc=symas,dc=com”. By default, the attribute uniqueness overlay will enforce uniqueness across the entire directory. Also note that indexing the unique attributes “eq” is also highly recommended.