# slapo-memberof

## NAME



           slapo-memberof - Reverse Group Membership overlay to slapd
    


## SYNOPSIS



           ETCDIR/slapd.conf
    


## DESCRIPTION



           The **memberof** overlay to slapd(8) allows automatic reverse group
           membership maintenance.  Any time a group entry is modified, its
           members are modified as appropriate in order to keep a DN-valued
           "is member of" attribute updated with the DN of the group.
    
           Note that the **dynlist** overlay can also provide this functionality
           and may be suitable for less demanding environments.
    


## CONFIGURATION



           The config directives that are specific to the **memberof** overlay
           must be prefixed by **memberof-** , to avoid potential conflicts with
           directives specific to the underlying database or to other stacked
           overlays.
    
           **overlay memberof**
                  This directive adds the memberof overlay to the current
                  database; see slapd.conf(5) for details.
    
           The following **slapd.conf** configuration options are defined for the
           memberof overlay.
    
           **memberof-group-oc** _< group-oc>_
                  The value _< group-oc>_ is the name of the objectClass that
                  triggers the reverse group membership update.  It defaults
                  to _groupOfNames_.
    
           **memberof-member-ad** _< member-ad>_
                  The value _< member-ad>_ is the name of the attribute that
                  contains the names of the members in the group objects; it
                  must be DN-valued.  It defaults to _member_.
    
           **memberof-memberof-ad** _< memberof-ad>_
                  The value _< memberof-ad>_ is the name of the attribute that
                  contains the names of the groups an entry is member of; it
                  must be DN-valued.  Its contents are automatically updated
                  by the overlay.  It defaults to _memberOf_.
    
           **memberof-dn** _< dn>_
                  The value _< dn>_ contains the DN that is used as
                  _modifiersName_ for internal modifications performed to
                  update the reverse group membership.  It defaults to the
                  _rootdn_ of the underlying database.
    
           **memberof-dangling {**_ignore_**,**_drop_**,**_error_**}**
                  This option determines the behavior of the overlay when,
                  during a modification, it encounters dangling references.
                  The default is _ignore_ , which may leave dangling references.
                  Other options are _drop_ , which discards those modifications
                  that would result in dangling references, and _error_ , which
                  causes modifications that would result in dangling
                  references to fail.
    
           **memberof-dangling-error** _< error-code>_
                  If **memberof-dangling** is set to _error_ , this configuration
                  parameter can be used to modify the response code returned
                  in case of violation.  It defaults to "constraint
                  violation", but other implementations are known to return
                  "no such object" instead.
    
           **memberof-refint {**_true_**|**_FALSE_**}**
                  This option determines whether the overlay will try to
                  preserve referential integrity or not.  If set to _TRUE_ ,
                  when an entry containing values of the "is member of"
                  attribute is modified, the corresponding groups are
                  modified as well.
    
           **memberof-addcheck {**_true_**|**_FALSE_**}**
                  This option determines whether the overlay will check newly
                  added entries for membership in any existing groups. This
                  check is useful if populated groups are created in the
                  directory before the entries they reference. The situation
                  often occurs during replication, which may replicate
                  entries in random order.  If set to _TRUE_ , every Add
                  operation will search for groups referencing the added
                  entry and populate its memberof attribute with the group
                  DNs. Note that **memberof-dangling** must be left on its
                  default setting of _ignore_ for this option to work.
    
           The memberof overlay may be used with any backend that provides
           full read-write functionality, but it is mainly intended for use
           with local storage backends. The maintenance operations it
           performs are internal to the server on which the overlay is
           configured and are never replicated. Consumer servers should be
           configured with their own instances of the memberOf overlay if it
           is desired to maintain these memberOf attributes on the consumers.
           Consumers must also be configured to exclude the _memberof_
           attribute from replication.  (See the **exattrs** option in the
           consumer configuration.)
    


## FILES



           ETCDIR/slapd.conf
                  default slapd configuration file
    


## BACKWARD COMPATIBILITY



           The memberof overlay has been reworked with the 2.5 release to use
           a consistent namespace as with other overlays. As a side-effect
           the following cn=config parameters are deprecated and will be
           removed in a future release: **olcMemberOf** is replaced with
           olcMemberOfConfig
    


## ACKNOWLEDGEMENTS



           This module was written in 2005 by Pierangelo Masarati for SysNet
           s.n.c.
    


* * *