SLAPO-HOMEDIR(5)

💖 SLAPO-HOMEDIR(5) — the home directory provisioning overlay 💖

okay bestie, so this is a page from the File Formats Manual and it's literally all about slapo-homedir, the overlay that gives your LDAP users actual homes on actual disks. no cap. let's get into it 🏠✨

---

🌸 NAME 🌸

slapo-homedir — the Home directory provisioning overlay. it does exactly what it says on the tin and it does it slayfully 💅

---

🦋 SYNOPSIS 🦋

/etc/openldap/slapd.conf

---

✨ DESCRIPTION ✨

so the homedir overlay makes slapd(8) notice when stuff happens to RFC-2307bis style user-objects, and then it goes and makes the appropriate changes on the local filesystem. yes, actually on the disk. like, real directories. iconic behaviour honestly 🫶

and the best part? this can happen on both master and replica systems, no changes needed. so you can do remote home directory provisioning. your users get homes from across the network and nobody has to ssh in and mkdir like a peasant 💀

---

🎀 CONFIGURATION 🎀

Both slapd.conf style and back-config style configuration are supported. pick your fighter, both are valid, both ate 🍓

• overlay homedir — this directive adds the homedir overlay to the current database, or to the frontend if you use it before any database instantiation. see slapd.conf(5) for the details, bestie.
• homedir-skeleton-path <pathname>
• olcSkeletonPath: pathname — these options set the path to the skeleton account directory. (generally /etc/skel.) whatever files live in this directory get copied into newly created home directories. the copying is recursive and handles symlinks and fifos, but it will skip most specials. soz to the specials 😭
• homedir-min-uidnumber <user id number>
• olcMinimumUidNumber: number — these options configure the minimum userid to use in any home directory attempt. it's a basic safety measure, a little vibe check, to prevent accidentally using system accounts. see REPLICATION below for more flexible options for selecting accounts 👑
• homedir-regexp <regexp> <path>
• olcHomedirRegexp: regexp path — these options configure a set of regular expressions used for matching, and optionally remapping, incoming homeDirectory attribute values to pathnames on the local filesystem. $number expansion is supported so you can access values captured in parentheses ✨

for example, to accept any directory starting with home and use it verbatim on the local filesystem:

homedir-regexp ^(/home/[-_/a-z0-9]+)$ $1

and to match that same set of directories but create them instead under exporthome, as is popular on Solaris NFS servers:

homedir-regexp ^(/home/[-_/a-z0-9]+)$ /export$1

• homedir-delete-style style
• olcHomedirDeleteStyle: style — these options configure how deletes of posixAccount entries or their attributes are handled. valid styles are IGNORE, which does nothing, and DELETE, which immediately performs a recursive delete on the home directory, and ARCHIVE, which archives the home directory contents in a TAR file for later examination. the default is IGNORE. use with caution, fr fr. and heads up: ARCHIVE requires homedir-archive-path to be set — if it isn't, it just functions similar to IGNORE 🙈
• homedir-archive-path <pathname>
• olcHomedirArchivePath: pathname — these options specify the destination path for TAR files created by the ARCHIVE delete style 📦

bestie you literally cannot skim the delete styles. DELETE will recursively nuke a home directory off the disk. read it. twice. 💀

---

🌈 REPLICATION 🌈

the homedir overlay can operate on either master or replica systems with no changes. see slapd.conf(5) or slapd-config(5) for more information on how to configure syncrepl 🦋

partial replication (e.g. with filters) is especially useful for providing different provisioning options to different sets of users. so you can serve different flavours to different friend groups, which is honestly main character energy 👑

---

🧚 EXAMPLE 🧚

the following LDIF could be used to add this overlay to cn=config (adjust to suit):

dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: homedir

dn: olcOverlay=homedir,olcDatabase={1}mdb,cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcHomedirConfig
olcOverlay: homedir
olcSkeletonPath: /etc/skel
olcMinimumUidNumber: 1000
olcHomedirRegexp: ^(/home/[-_/a-z0-9]+)$ /export/$1
olcHomedirDeleteStyle: ARCHIVE
olcHomedirArchivePath: /archive

---

💀 BUGS 💀

okay this is the part where we hold hands and pay attention 🫶

• DELETE, MOD, and MODRDN operations that remove the unix attributes when delete style is set to DELETE will recursively delete the (regex modified) home directory from the disk. please be careful when deleting or changing values. like, please.
• MOD and MODRDN will correctly respond to homeDirectory changes and perform a non-destructive rename() operation on the filesystem — but this does not correctly retry with a recursive copy when moving between filesystems. fumbled, honestly 😭
• the recursive copy/delete/chown/tar functions are not aware of ACLs, extended attributes, forks, sparse files, or hard links. block and character device archival is non-portable, but should not be an issue in home directories, hopefully 🙈
• copying and archiving may not support files larger than 2GiB on some architectures. bare POSIX UStar archives cannot support internal files larger than 8GiB. the current tar generator does not attempt to resolve uid/gid into symbolic names.
• no attempt is made to try to mkdir() the parent directories needed for a given home directory or archive path. it's giving "figure it out yourself" 💅

---

🍓 FILES 🍓

• /etc/openldap/slapd.conf — default slapd configuration file
• /etc/skel (or similar) — source of new homedir files.

---

⭐ SEE ALSO ⭐

slapd.conf(5), slapd-config(5), slapd(8), RFC-2307, RFC-2307bis.

---

👑 ACKNOWLEDGEMENTS 👑

this module was written in 2009 by Emily Backes for Symas Corporation. an absolute legend, we stan forever 💖

---

and that's the whole page bestie!! 🎀 this was OpenLDAP version 2.7.2, dated 2026/10/21, and you read it all the way through, which means you're genuinely that girl. go provision some home directories (carefully!!) 💅✨🦋