Chapter 7. Managing Attributes and Values Red Hat Directory Server provides several different mechanisms for dynamically and automatically maintaining some types of attributes on directory entries. These plug-ins and configuration options simplify managing directory data and expressing relationships between entries. Part of the characteristic of entries are their relationships to each other. Obviously, a manager has an employee, so those two entries are related. Groups are associated with their members. There are less apparent relationships, too, like between entries which share a common physical location. Red Hat Directory Server provides several different ways that these relationships between entries can be maintained smoothly and consistently. There are several plug-ins can apply or generate attributes automatically as part of the data within the directory, including classes of service, linking attributes, and generating unique numeric attribute values. 7.1. Enforcing Attribute Uniqueness To ensure that the value of an attribute is unique across the directory or subtree, use the Attribute Uniqueness plug-in. If you want multiple attributes to be unique or if you want to use different conditions, create multiple configuration records of the plug-in. 7.1.1. Creating a New Configuration Record of the Attribute Uniqueness Plug-in For each attribute whose values must be unique, create a new configuration record of the Attribute Uniqueness plug-in. Note You can only create a new configuration record of the plug-in from the command line. To create a new unconfigured and disabled configuration record of the plug-in named Example Attribute Uniqueness : 7.1.2. Configuring Attribute Uniqueness over Suffixes or Subtrees You can configure the Attribute Uniqueness plug-in to ensure that values of an attribute are unique in certain suffixes, subtrees, or over suffixes and subtrees. 7.1.2.1. Configuring Attribute Uniqueness over Suffixes or Subtrees Using the Command Line To configure, for example, that values stored in mail attributes are unique: Create a new configuration record of the Attribute Uniqueness plug-in named, for example, mail Attribute Uniqueness . For details, see Section 7.1.1, "Creating a New Configuration Record of the Attribute Uniqueness Plug-in" . Enable the plug-in configuration record: Configure that values stored in mail attributes must be unique inside, for example, the ou=Engineering,dc=example,dc=com and ou=Sales,dc=example,dc=com subtrees: Optionally, to configure uniqueness across all subtrees configured in this plug-in configuration record: Restart the instance: 7.1.2.2. Configuring Attribute Uniqueness over Suffixes or Subtrees Using the Web Console To configure, for example, that values stored in mail attributes are unique: Open the Directory Server user interface in the web console. See Section 1.4, "Logging Into Directory Server Using the Web Console" . Select the instance. Open the Plugins menu. Select the Attribute Uniqueness plug-in. Click Add Config . Fill the fields, and enable the config. For example: Figure 7.1. Adding an Attribute Uniqueness Configuration Restart the instance. See Section 1.5.2, "Starting and Stopping a Directory Server Instance Using the Web Console" . 7.1.3. Configuring Attribute Uniqueness over Object Classes You can configure the Attribute Uniqueness plug-in to ensure that values of an attribute are unique in subtree entries that contain a specific object class. Directory Server searches for this object class in the parent entry of the updated object. If Directory Server did not find the object class, the search continues at the higher level entry up to the root of the directory tree. If the object class was found, Directory Server verifies that the value of the attribute set in uniqueness-attribute-name is unique in this subtree. To configure, for example, that values stored in mail attributes are unique under the entry that contains the nsContainer object class: Create a new configuration record of the Attribute Uniqueness plug-in named, for example, mail Attribute Uniqueness . For details, see Section 7.1.1, "Creating a New Configuration Record of the Attribute Uniqueness Plug-in" . Enable the plug-in configuration record: Configure that values stored in mail attributes must be unique under the entry that contains the nsContainer object class: Optionally, you can limit the scope of objects being checked. If you want the server to check only a subset of entries under the entry that contains the nsContainer object class, set an additional object class in the uniqueness-subtree-entries-oc parameter. This additional class will also have to be present. For example, the mail attribute must be unique in all entries under the entry that contains the nsContainer object class set. However, you want that the plug-in only searches the mail in entries that contain a object class that provides this attribute, such as inetOrgPerson . In this situation enter: Restart the instance: 7.1.4. Attribute Uniqueness Plug-in Configuration Parameters To configure an Attribute Uniqueness plug-in configuration record, set the plug-in's configuration attributes in the cn= attribute_uniqueness_configuration_record_name ,cn=plugins,cn=config entry. Example 7.1. Attribute Uniqueness Plug-in Configuration Using Plug-in-specific Attributes For a list of parameters you can set to configure the Attribute Uniqueness plug-in, see the corresponding section in the Red Hat Directory Server Configuration, Command, and File Reference .

Commands:
dsconf -D "cn=Directory Manager" ldap://server.example.com plugin attr-uniq add "Example" --attr-name uid
dsconf -D "cn=Directory Manager" ldap://server.example.com plugin attr-uniq enable "mail Attribute Uniqueness"
dsconf -D "cn=Directory Manager" ldap://server.example.com plugin attr-uniq set "mail Attribute Uniqueness" --attr-name mail --subtree ou=Engineering,dc=example,dc=com ou=Sales,dc=example,dc=com
dsconf -D "cn=Directory Manager" ldap://server.example.com plugin attr-uniq set "mail Attribute Uniqueness" --across--all-subtrees=on
dsctl instance_name restart
dsconf -D "cn=Directory Manager" ldap://server.example.com plugin attr-uniq enable "mail Attribute Uniqueness"
dsconf -D "cn=Directory Manager" ldap://server.example.com plugin attr-uniq set "mail Attribute Uniqueness" --top-entry-oc=nsContainer
dsconf -D "cn=Directory Manager" ldap://server.example.com plugin attr-uniq set "mail Attribute Uniqueness" --subtree-entries-oc=inetOrgPerson
dsctl instance_name restart
dn: cn= Example Attribute Uniqueness ,cn=plugins,cn=config nsslapd-pluginEnabled: on uniqueness-attribute-name: attribute_name uniqueness-top-entry-oc: objectclass1 uniqueness-subtree-entries-oc: objectclass2