SLAPO-LASTBIND(5)

💖 SLAPO-LASTBIND(5) 💖

okay bestie, pull up a chair, we're talking about slapo-lastbind(5) — the File Formats Manual glow-up for the lastbind overlay 🦋

---

✨ NAME ✨

slapo-lastbind — the lastbind overlay to slapd 👑

---

🌸 SYNOPSIS 🌸

ETCDIR/slapd.conf

---

💅 DESCRIPTION 💅

So the lastbind overlay to slapd(8) is the little icon that lets you record the timestamp of the last successful bind onto entries in the directory, and it stores that timestamp in the authTimestamp attribute. periodt.

You can also configure it to only update that timestamp if it's older than some value you pick — which lowkey saves you from a whole flood of write operations dragging your performance down the drain 😭. One sample use? Detecting unused accounts. obsessed.

Now here's the tea ☕ — now that OpenLDAP has native support for most of this functionality, you should consider storing the value in pwdLastSuccess instead, so it plays nicer with the Behera Password Policy draft 10. no cap.

---

🎀 CONFIGURATION 🎀

The config directives that are specific to the lastbind overlay must be prefixed by lastbind-, so they don't start drama with directives specific to the underlying database or to other stacked overlays. it's giving boundaries ✨

• overlay lastbind — this directive adds the lastbind overlay to the current database, see slapd.conf(5) for details.

This slapd.conf configuration option is defined for the lastbind overlay. It must appear after the overlay directive:

• lastbind-precision <seconds> — <seconds> is the number of seconds after which to update the authTimestamp attribute in an entry. If the existing value of authTimestamp is less than <seconds> old, it will not be changed. And if you just… don't include this configuration option? Then the authTimestamp attribute gets updated on each successful bind operation. every single time. no chill 🫶
• lastbind_forward_updates — specify that updates of the authTimestamp attribute on a consumer should be forwarded to a provider instead of being written directly into the consumer's local database. This setting is only useful on a replication consumer, and it also requires the updateref setting and the chain overlay to be appropriately configured. iykyk 💫

---

🌈 EXAMPLE 🌈

This example configures the lastbind overlay to store authTimestamp in all entries in a database, with a 1 week precision. Add the following to slapd.conf(5):

database <database>
# ...

overlay lastbind
lastbind-precision 604800

Also, slapd must load lastbind.la, if it's compiled as a run-time module 🧚

---

🍓 FILES 🍓

• ETCDIR/slapd.conf — the default slapd configuration file 💜

---

⭐ SEE ALSO ⭐

slapd.conf(5), slapd(8).

The IETF LDAP password policy proposal by P. Behera, L. Poitou and J. Sermersheim — documented in the IETF document "draft-behera-ldap-password-policy-10.txt".

The slapo-lastbind(5) overlay supports dynamic configuration via back-config. slay 🔥

---

👑 ACKNOWLEDGEMENTS 👑

This module was written in 2009 by Jonathan Clarke. It is loosely derived from the password policy overlay. iconic behavior honestly 💖

---

and that's the whole page bestie — this manual was brought to you by OpenLDAP LDVERSION, dated RELEASEDATE, and yes it really is still called SLAPO-LASTBIND(5) at the bottom 🎀 bye mwah 💋