SLAPO-CONSTRAINT(5)

💖 SLAPO-CONSTRAINT(5) 💖

okay so bestie, welcome to the SLAPO-CONSTRAINT(5) glow-up 💅 this is a File Formats Manual page and it's about the Attribute Constraint Overlay for slapd. yes it's as iconic as it sounds. let's go ✨

---

✨ NAME ✨

slapo-constraint — Attribute Constraint Overlay to slapd 🎀

---

✨ SYNOPSIS ✨

/etc/openldap/slapd.conf

---

✨ DESCRIPTION ✨

so, the constraint overlay is literally here to make sure attribute values match certain constraints that go beyond basic LDAP syntax. lowkey a vibe check for your data. 🌸

an attribute can have multiple constraints stacked on it, and every single one of them has to be satisfied whenever you modify an attribute value that's under constraint. no skipping, no partial credit, no "close enough". periodt.

this overlay is meant to be used to force syntactic regularity onto certain string-represented data that has a well known canonical form — think telephone numbers, post codes, FQDNs, that kind of thing. ✨

ngl it's kind of picky about scope: it constrains only LDAP add, modify and rename commands, and it only seeks to control the add and replace values of modify and rename requests. that's it, that's the whole job. 🔥

and here's the slay part: constraints can be lifted for operations where the relax control is set and the user has manage privileges to the relevant attribute. main character energy only. 👑

---

✨ CONFIGURATION ✨

these slapd.conf options apply to the constraint overlay. and bestie, they should appear after the overlay directive — order matters, don't be chaotic. 💀

• constraint_attribute <attribute_name>[,...] <type> <value> [<extra> [...]] — specifies the constraint that should apply to the comma-separated attribute list named as the first parameter. right now eight types of constraint are supported: regex, negregex, size, count, uri, neguri, set, and negset. 🦋

the parameter following the regex or negregex type is a Unix style regular expression (see regex(7)). the parameter following the uri or neguri type is an LDAP URI. that URI gets evaluated using an internal search. it must not include a hostname, and it must include a list of attributes to evaluate. 🙈

the parameter following the set or negset type is a string interpreted according to the syntax in use for ACL sets. this lets you construct constraints based on the contents of the entry. so much power fr fr. 💖

the size type can be used to enforce a limit on an attribute length, and the count type limits the number of values of an attribute. 📏

extra parameters can occur in any order after the ones described above.

<extra> : restrict=<uri>

this extra parameter lets you restrict the application of the corresponding constraint only to entries that match the base, scope and filter portions of the LDAP URI. the base, if present, must be within the naming context of the database. the scope is only used when the base is present; it defaults to base. the other parameters of the URI are not allowed. 🎀

• constraint_allowempty FALSE | TRUE — historically, slapo-constraint rejected Modify/Add requests with an empty sequence of modifications. that was not intentional, and if this option is TRUE, such modifications will be allowed so long as they are otherwise valid. the default is FALSE to maintain backwards compatibility. 🌈

---

💀 heads up bestie: any attempt to add or modify an attribute named as part of the constraint overlay specification which does not fit the constraint listed will fail with a LDAP_CONSTRAINT_VIOLATION error — unless the relax control was set and the user has manage privilege on the attribute in question. so frustrating but also correct.

---

✨ EXAMPLES ✨

overlay constraint
constraint_attribute jpegPhoto size 131072
constraint_attribute userPassword count 3
constraint_attribute mail regex ^[[:alnum:]]+@mydomain.com$
constraint_attribute mail negregex ^[[:alnum:]]+@notallowed.com$
constraint_attribute title uri
  ldap:///dc=catalog,dc=example,dc=com?title?sub?(objectClass=titleCatalog)
constraint_attribute cn neguri
  ldap:///ou=People,dc=example,dc=com?cn,sn?sub?(objectClass=inetOrgPerson)
constraint_attribute cn,sn,givenName set
  "(this/givenName + [ ] + this/sn) & this/cn"
  restrict="ldap:///ou=People,dc=example,dc=com??sub?(objectClass=inetOrgPerson)"

so let's break down what all that actually does, because it's giving very much "read the whole thing":

a specification like the above would reject any mail attribute which did not look like alphanumeric string@mydomain.com or that looks like alphanumeric string@notallowed.com. 🚫

it would also reject any title attribute whose values were not listed in the title attribute of any titleCatalog entries in the given scope. and pls note: the "dc=catalog,dc=example,dc=com" subtree ought to reside in a separate database, otherwise the initial set of titleCatalog entries could not be populated while the constraint is in effect. sneaky little gotcha, iykyk. 😭

with the type "neguri" (negated "uri"), it would ensure uniqueness of one (or more) attributes against one (or more) other attributes. so a specification like the above would reject any cn attributes whose any values was already listed in another cn or sn attributes of any inetOrgPerson entries in the given scope. 🦋

finallyyyy, it requires the values of the attribute cn to be constructed by pairing values of the attributes sn and givenName, separated by a space, but only for entries derived from the objectClass inetOrgPerson. ✨

and should the type "negset" have been used instead of "set", the condition would have been reversed. plot twist. 🔥

---

✨ FILES ✨

• /etc/openldap/slapd.conf — default slapd configuration file 🎀

---

✨ SEE ALSO ✨

slapd.conf(5), slapd-config(5), 👑

---

✨ ACKNOWLEDGEMENTS ✨

this module was written in 2005 by Neil Dunbar of Hewlett-Packard and subsequently extended by Howard Chu and Emmanuel Dreyfus. 💜

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. 🌈

---

and that's the whole page bestie 🫶 this was SLAPO-CONSTRAINT(5), straight out of OpenLDAP 2.7.2, dated 2026/10/21. slay, go constrain something responsibly 💅✨🍓