SLAPO_LASTMOD(5)

📦 version 2.7.2, in arch rolling

✨ SLAPO_LASTMOD(5) ✨

okay bestie so you're reading the slapo-lastmod page out of the File Formats Manual section of the OpenLDAP docs, and honestly? it's giving niche but iconic. it's the manual for the Last Modification overlay. let's get into it 💅

🌸 NAME 🌸

slapo-lastmod — the Last Modification overlay. that's it, that's the name, periodt.

🦋 SYNOPSIS 🦋

ETCDIR/slapd.conf

💖 DESCRIPTION 💖

so here's the tea: the lastmod overlay creates a service entry rooted at the suffix of the database it's stacked onto. this entry holds four things — the DN, the modification type, the modifiersName, and the modifyTimestamp of the last write operation that happened on that database. main character energy fr.

⚠️ no cap warning: the lastmod overlay cannot be used when the "lastmod" feature is disabled, like when "lastmod off" is used. so don't even try it bestie, it's not gonna slay.

every operation aimed at the DN of the lastmod entry gets rejected — except reads, i.e. searches with base scope. those are fine, those are welcome, those are loved. 💖

regular operations? lowkey ignored. unless they result in an actual write. and if the write succeeds, the lastmod entry gets updated accordingly — if possible. the "if possible" is doing a lot of heavy lifting there, but okay, we move. 🫶

🎀 CONFIGURATION 🎀

these slapd.conf config options are for the lastmod overlay specifically. they must appear after the overlay directive — order matters, always has, always will. ✨

  • lastmod-rdnvalue <RDN value> — set the value of the RDN used for the service entry. by default, Lastmod is used. so if you don't say anything, that's what you get, no cap.
  • lastmod-enabled {yes|no} — say whether the overlay should be enabled or not at startup. by default, it's enabled. but here's the cute part — you can flip the boolean value of the lastmodEnabled attribute and change the overlay's status on the fly. this is so useful, like, for example, to stop the overlay from keeping track of big bulky bulk loads or deletions. big loads = big yikes, we skip those. 🙈

👑 OBJECT CLASS 👑

the lastmod overlay depends on the lastmod objectClass. here's the definition, exactly as it is, don't @ me:

( 1.3.6.1.4.1.4203.666.3.13 "
    NAME 'lastmod'
    DESC 'OpenLDAP per-database last modification monitoring'
    STRUCTURAL
    SUP top
    MUST ( cn $ lastmodDN $ lastmodType )
    MAY ( description $ seeAlso ) )

🧚 ATTRIBUTES 🧚

every section below breaks down the meaning and use of one particular attribute of this lastmod objectClass. most of the attributes that are specific to the lastmod objectClass are operational, since logically they can only be altered by the DSA — like, they're not for you, they're for the system, iykyk.

the most notable exception is the lastmodEnabled attributeType, which can be altered via protocol to change the status of the overlay. she's flexible like that. 💅

lastmodEnabled

this attribute holds a boolean flag that determines the status of the overlay. you can alter it via protocol by issuing a modify operation that replaces the value of the attribute. iconic, honestly.

(  1.3.6.1.4.1.4203.666.1.30
   NAME 'lastmodEnabled'
   DESC 'Lastmod overlay state'
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
   EQUALITY booleanMatch
   SINGLE-VALUE )

⭐ OPERATIONAL ATTRIBUTES ⭐

(same intro energy as above, bestie — the original says it twice so we're saying it twice 💖) every section below breaks down the meaning and use of one particular attribute of this lastmod objectClass. most of the attributes specific to the lastmod objectClass are operational, since logically they can only be altered by the DSA.

lastmodDN

this attribute contains the distinguished name of the entry that was last modified within the naming context of a database. she remembers who you were. 😭

(  1.3.6.1.4.1.4203.666.1.28
   NAME 'lastmodDN'
   DESC 'DN of last modification'
   EQUALITY distinguishedNameMatch
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.12
   NO-USER-MODIFICATION
   USAGE directoryOperation )

lastmodType

this attribute contains the type of the modification that happened to the last modified entry. the legal values are add, delete, exop, modify, modrdn and unknown. that last one, unknown, should only ever be used as a fall-thru for unhandled request types that are considered equivalent to a write operation. it's the "well, something happened" of values, and honestly? relatable. 💀

(  1.3.6.1.4.1.4203.666.1.29
   NAME 'lastmodType'
   DESC 'Type of last modification'
   SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
   EQUALITY caseIgnoreMatch
   SINGLE-VALUE
   NO-USER-MODIFICATION
   USAGE directoryOperation )

🌈 EXAMPLES 🌈

here's what it looks like in the wild, copy it exactly, don't freestyle:

database    mdb
suffix      dc=example,dc=com
overlay     lastmod
lastmod-rdnvalue "Last Modification"

💜 SEE ALSO 💜

💀 BUGS 💀

okay so, the real talk section, gather round:

  • it is unclear whether this overlay can safely interoperate with other overlays. so, like, don't just throw it in a group chat with other overlays and assume everything's fine.
  • if the underlying backend doesn't implement entry_get/entry_release handlers, modrdn update can become tricky. not like, fun tricky. like, tricky tricky. 😭
  • the code needs some cleanup and more consistent error handling. it's giving "we'll fix it later" energy.
  • so far, the OIDs for the schema haven't been assigned yet. yeah. that's a thing. 🙈

🫶 ACKNOWLEDGEMENTS 🫶

this module was written in 2004 by Pierangelo Masarati in fulfillment of requirements from SysNet s.n.c.; this man page has been copied from slapo-ppolicy(5), and most of the overlays ever written are copied from Howard Chu's first overlays. chain of inspiration fr fr, we love to see it.

OpenLDAP is developed and maintained by The OpenLDAP Project (http://www.openldap.org/). OpenLDAP is derived from University of Michigan LDAP 3.3 Release. iconic lineage, no notes. 👑

and that's the whole page bestie, you ate that 💅 this one's from OpenLDAP LDVERSION, released RELEASEDATE, and it lives under SLAPO_LASTMOD(5) — go forth and read them logs, mwah 🎀✨

📦 where this page comes from