SLAPO-REFINT(5)

📦
version 2.7.2 · 24 versions
, in arch rolling

💖 SLAPO-REFINT 💖

okay bestie, welcome to slapo-refint — the Referential Integrity overlay for slapd. She's a File Formats Manual girlie. Let's get into it 🫶

✨ NAME ✨

slapo-refint — the Referential Integrity overlay for slapd, no cap 💅

🌸 SYNOPSIS 🌸

/etc/openldap/slapd.conf

🦋 DESCRIPTION 🦋

so basically, the Referential Integrity overlay is the friend who never lets the group chat drift apart 💖 You can pair her up with a backend database like slapd-mdb(5) and she'll maintain the cohesiveness of a schema that uses reference attributes. She keeps everyone's references pointing at people who actually still exist. iconic behaviour.

Here's how she keeps integrity: she updates database records that contain the named attributes so they match up with the results of a modrdn or a delete operation. For example, say your integrity attribute is configured as manager — if someone deletes the record "uid=robert,ou=people,dc=example,dc=com", that triggers a search for all the other records that have a manager attribute containing that DN. Every entry that matches that search gets its manager attribute removed. bye robert 👋

Or, alternate scenario: renaming that same record into "uid=george,ou=people,dc=example,dc=com" triggers a search for all other records whose manager attribute contains that DN. Matching entries have their manager attribute deleted and replaced by the new DN. glow-up, but everywhere at once ✨

okay important: rootdn must be set for the database. refint runs as the rootdn to gain the access she needs to make her updates. rootpw is not needed, bestie, she's built different.

🎀 CONFIGURATION 🎀

these slapd.conf options apply to the Referential Integrity overlay. They should appear after the overlay directive. order matters, queen 👑

  • refint_attributes <attribute> [...] — specify one or more attributes for which integrity will be maintained, exactly as described above. one or many, your call 💅
  • refint_nothing <string> — specify an arbitrary value to be used as a placeholder when the last value would otherwise be deleted from an attribute. This is useful when the schema requires an attribute to exist even though referential integrity is enforced on it. If you didn't have this, attempting to delete a required attribute would throw an Object Class Violation and the whole request would just fail 😭 The string must be a valid DN, fr fr.
  • refint_modifiersname <DN> — specify the DN to be used as the modifiersName of the internal modifications the overlay performs. It defaults to "cn=Referential Integrity Overlay" 🫶
⚠️ heads up: modifications performed by this overlay are not propagated during replication. You have to configure this overlay identically on replication consumers to maintain full synchronization with the provider. no shortcuts, no skipping, periodt.

🌈 FILES 🌈

  • /etc/openldap/slapd.conf — default slapd configuration file ⭐

💜 SEE ALSO 💜

slapd.conf(5), slapd-config(5).

👑 ACKNOWLEDGEMENTS 👑

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. shoutout to the OGs 🫡

and that's the whole page, bestie — this is OpenLDAP 2.7.2, dated 2026/10/21, so you know it's fresh 🌸 go forth and keep those references intact 💖✨🎀

📦 where this page comes from