SLAPO-UNIQUE(5)

💖 SLAPO-UNIQUE 💖

okay bestie, gather round, because today we're talking about slapo-unique — the Attribute Uniqueness overlay for slapd, straight out of the File Formats Manual. it's giving gatekeeper energy but for attributes. let's go 🦋

---

✨ NAME ✨

slapo-unique — the Attribute Uniqueness overlay to slapd. no cap, that's literally the whole name.

---

🌸 SYNOPSIS 🌸

/etc/openldap/slapd.conf

yep. that's the file. that's the vibe. she lives in slapd.conf. 💅

---

👑 DESCRIPTION 👑

so the Attribute Uniqueness overlay is the bestie you plug into a backend database — like slapd-mdb(5) — to enforce the uniqueness of some or all attributes inside a scope. by default that subtree is all objects within the subtree of the database for which the Uniqueness overlay is configured. iconic default behavior, honestly.

how does she enforce it? by searching the subtree to make sure that the values of all attributes handed to her with an add, modify or modrdn operation are unique within the scope. example time: if uniqueness were enforced for the uid attribute, the subtree gets searched for any other records that also have a uid attribute holding that same value. found one? request rejected. bye. 💀

and here's the sneaky-but-important part: the search is performed using the rootdn of the database, so we don't get tripped up by ACLs keeping the overlay from seeing all the relevant data. which means… the database must have a rootdn configured. no rootdn, no uniqueness. periodt.

---

🎀 CONFIGURATION 🎀

these slapd.conf options apply to the Attribute Uniqueness overlay, and they should appear after the overlay directive. order matters, bestie.

• unique_uri <[strict ][ignore ][serialize ]URI[[ URI...]...]> — configure the base, attributes, scope, and filter for uniqueness checking. multiple URIs may be specified within a domain, which lets you do complex selections of objects. and listen: multiple unique_uri statements (or olcUniqueURI attribute values) create independent domains, each one with its own independent list of URIs and its own ignore/strict settings. they don't share, they don't gossip, they're independent.

the keywords strict, ignore, and serialize have to be enclosed in quotes (") together with the URI when you're using deprecated slapd.conf configurations. yes, deprecated. we love a legacy moment but put it in quotes.

the LDAP URI syntax is a subset of RFC-4516, and takes this form:

ldap:///[base dn]?[attributes...]?scope[?filter]

the base dn defaults to that of the back-end database, and any base dns you specify must be within the subtree of the back-end database. no wandering off. 🙈

if no attributes are specified, the URI applies to all non-operational attributes.

the scope component is effectively mandatory, because LDAP URIs default to base scope — and base scope is not valid for uniqueness, since groups of one object are always unique. shocking, i know. scopes of sub (for subtree) and one (for one-level) are valid. use those.

the filter component makes the domain apply uniqueness constraints only to matching objects. e.g. ldap:///?cn?sub?(sn=e*) would require unique cn attributes for all objects in the subtree of the back-end database whose sn starts with an e. cute, specific, effective.

you can also assert uniqueness upon all non-operational attributes except the ones you list, by prepending the keyword ignore. if it's not configured, all non-operational (e.g., system) attributes must be unique. and heads up — the attributes list of an ignore URI should generally contain the objectClass, dc, ou and o attributes, because those generally won't be unique, nor are they operational attributes. so like, don't forget them or you'll have a bad time. 😭

wanna set strict checking for the uniqueness domain? prepend the keyword strict. by default, uniqueness is not enforced for null values. enabling strict mode extends the concept of uniqueness to include null values, so only one attribute within a subtree is allowed to have a null value. strictness applies to all URIs within a uniqueness domain, but some domains may be strict while others are not. asymmetric slay.

and if you want to enforce strict serialization of modifications, prepend the keyword serialize. by default, no serialization is performed, so multiple modifications happening nearly simultaneously may see incomplete uniqueness results. using serialize forces individual write operations to fully complete before allowing any others to proceed, making sure each operation's uniqueness checks are consistent. it's the "one at a time, ladies" of overlays. 💅

it is not possible to set both URIs and legacy slapo-unique configuration parameters at the same time. pick a lane. in general, the legacy configuration options control pieces of a single unfiltered subtree domain.

• unique_base <basedn> — this legacy configuration parameter should be converted to the base dn component of the unique_uri style of parameter above. glow-up time.
• unique_ignore <attribute...> — this legacy configuration parameter should be converted to a unique_uri parameter with the ignore keyword, as described above.
• unique_attributes <attribute...> — this legacy configuration parameter should be converted to a unique_uri parameter, as described above.
• unique_strict <attribute...> — this legacy configuration parameter should be converted to a strict keyword prepended to a unique_uri parameter, as described above.

---

🫶 CAVEATS 🫶

unique_uri cannot be used with the old-style of configuration, and vice versa. they do not mix, they do not date, they do not text back. however, unique_uri can implement everything the older system can do. so it's not a downgrade, it's just a different era.

typical attributes for the ignore ldap:///... URIs are intentionally not hardcoded into the overlay, so you get maximum flexibility in meeting your site-specific requirements. the overlay trusts you. don't make it regret that. ✨

replication and operations with the relax control are allowed to bypass this enforcement. so it's genuinely important that all servers accepting writes have this overlay configured, or your replicated DIT will lose its uniqueness and nobody wants that. 😭

---

🍓 FILES 🍓

• /etc/openldap/slapd.conf — default slapd configuration file

---

🌈 SEE ALSO 🌈

slapd.conf(5), slapd-config(5).

---

and that's the whole page, bestie!! this is from OpenLDAP 2.7.2, dated 2026/10/21, and honestly? she ate. go make your attributes unique 💖✨🎀👑