HP UX Red Hat Direry Server Software manual Using the Attribute Uniqueness Plug-in

Chapter 18.

Using the Attribute Uniqueness Plug-in

The Attribute Uniqueness Plug-in can be used to ensure that the new or edited attributes always have unique values in the directory. A new instance of the Attribute Uniqueness Plug-in must be created for every attribute for which values must be unique. The Attribute Uniqueness Plug-in can enforce the uniqueness of the value for any attribute.

1. Overview of the Attribute Uniqueness Plug-in

The Attribute Uniqueness Plug-in is a preoperation plug-in. This means that the plug-in checks all update operations before the server performs an LDAP operation. The plug-in determines whether the operation applies to an attribute and a suffix that it is configured to monitor.

If an update operation applies to an attribute and suffix monitored by the plug-in and it would cause two entries to have the same attribute value, then the server terminates the operation and returns an LDAP_CONSTRAINT_VIOLATION error to the client.

Each instance of the Attribute Uniqueness Plug-in performs a check on a single attribute for one or more subtrees. To check uniqueness of several attributes, a separate instance of the plug-in must be created for each attribute to check.

The Attribute Uniqueness Plug-in can operate in specific, user-defined ways:

•It can check every entry in the specified subtrees.

For example, if a company, example.com, hosts the directories for example_a.com and example_b.com, when an entry such as uid=jdoe,ou=people,o=example_a,dc=example,dc=com is added, uniqueness needs to be enforced only in the o=example_a,dc=example,dc=com subtree. This is done by listing the DN of the subtree explicitly in the Attribute Uniqueness Plug-in configuration.

This configuration option is explained in more detail in Section 4.3.2, “Specifying a Suffix or Subtree”.

•Specify an object class pertaining to an entry in the DN of the updated entry and perform the uniqueness check on all the entries beneath it.

This option is useful in hosted environments. For example, when adding an entry such as uid=jdoe,ou=people,o=example_a,dc=example,dc=com, enforce uniqueness under the o=example_a,dc=example,dc=com subtree without listing this subtree explicitly in the configuration but, instead, by indicating a marker object class. If the marker object class is set to organization, the uniqueness check algorithm locates the entry in the DN that has this object class (o=example_a) and performs the check on all entries beneath it.

Additionally, it is possible to check uniqueness only if the updated entry includes a specified

503