Provided by:
slapd_2.4.11-0ubuntu6_i386 
NAME
slapo-constraint - Attribute Constraint Overlay to slapd
SYNOPSIS
/etc/ldap/slapd.conf
DESCRIPTION
The constraint overlay is used to ensure that attribute values match
some constraints beyond basic LDAP syntax. Attributes can have
multiple constraints placed upon them, and all must be satisfied when
modifying an attribute value under constraint.
This overlay is intended to be used to force syntactic regularity upon
certain string represented data which have well known canonical forms,
like telephone numbers, post codes, FQDNs, etc.
It constrains only LDAP adds and modify commands and only seeks to
control the add and modify value of a modify request.
CONFIGURATION
This slapd.conf option applies to the constraint overlay. It should
appear after the overlay directive.
constraint_attribute <attribute_name> <type> <value>
Specifies the constraint which should apply to the attribute
named as the first parameter. Two types of constraint are
currently supported - regex , size , count , and uri.
The parameter following the regex type is a Unix style regular
expression (See regex(7) ). The parameter following the uri type
is an LDAP URI. The URI will be evaluated using an internal
search. It must not include a hostname, and it must include a
list of attributes to evaluate.
The size type can be used to enfore a limit on an attribute
length, and the count type limits the count of an attribute.
Any attempt to add or modify an attribute named as part of the
constraint overlay specification which does not fit the
constraint listed will fail with a LDAP_CONSTRAINT_VIOLATION
error.
EXAMPLES
overlay constraint
constraint_attribute jpegPhoto size 131072
constraint_attribute userPassword count 3
constraint_attribute mail regex ^[:alnum:]+@mydomain.com$
constraint_attribute title uri
ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog)
A specification like the above would reject any mail attribute
which did not look like <alpha-numeric string>@mydomain.com It
would also reject any title attribute whose values were not
listed in the title attribute of any titleCatalog entries in the
given scope.
FILES
/etc/ldap/slapd.conf
default slapd configuration file
SEE ALSO
slapd.conf(5).
ACKNOWLEDGEMENTS
This module was written in 2005 by Neil Dunbar of Hewlett-Packard and
subsequently extended by Howard Chu and Emmanuel Dreyfus. OpenLDAP
Software is developed and maintained by The OpenLDAP Project
<http://www.openldap.org/>. OpenLDAP Software is derived from
University of Michigan LDAP 3.3 Release.