Provided by: slapd_2.4.11-0ubuntu6_i386 bug


       slapo-constraint - Attribute Constraint Overlay to slapd




       The  constraint  overlay  is used to ensure that attribute values match
       some  constraints  beyond  basic  LDAP  syntax.   Attributes  can  have
       multiple  constraints  placed upon them, and all must be satisfied when
       modifying an attribute value under constraint.

       This overlay is intended to be used to force syntactic regularity  upon
       certain  string represented data which have well known canonical forms,
       like telephone numbers, post codes, FQDNs, etc.

       It constrains only LDAP adds and modify  commands  and  only  seeks  to
       control the add and modify value of a modify request.


       This  slapd.conf  option  applies to the constraint overlay.  It should
       appear after the overlay directive.

       constraint_attribute <attribute_name> <type> <value>
              Specifies the constraint which should  apply  to  the  attribute
              named  as  the  first  parameter.   Two  types of constraint are
              currently supported - regex , size , count , and uri.

              The parameter following the regex type is a Unix  style  regular
              expression (See regex(7) ). The parameter following the uri type
              is an LDAP URI. The URI will  be  evaluated  using  an  internal
              search.   It  must not include a hostname, and it must include a
              list of attributes to evaluate.

              The size type can be used to enfore  a  limit  on  an  attribute
              length, and the count type limits the count of an attribute.

              Any  attempt  to add or modify an attribute named as part of the
              constraint  overlay  specification  which  does  not   fit   the
              constraint  listed  will  fail  with a LDAP_CONSTRAINT_VIOLATION


              overlay constraint
              constraint_attribute jpegPhoto size 131072
              constraint_attribute userPassword count 3
              constraint_attribute mail regex ^[:alnum:]$
              constraint_attribute title uri

              A specification like the above would reject any  mail  attribute
              which  did  not look like <alpha-numeric string> It
              would also reject any title  attribute  whose  values  were  not
              listed in the title attribute of any titleCatalog entries in the
              given scope.


              default slapd configuration file




       This module was written in 2005 by Neil Dunbar of  Hewlett-Packard  and
       subsequently  extended  by  Howard  Chu and Emmanuel Dreyfus.  OpenLDAP
       Software  is  developed  and  maintained  by   The   OpenLDAP   Project
       <>.    OpenLDAP   Software   is   derived  from
       University of Michigan LDAP 3.3 Release.