SLAPSCHEMA(8C)

📦
version 2.7.2 · 25 versions
, in arch rolling

👑 SLAPSCHEMA — the 8C section girlie 💅

okay so bestie, welcome to SLAPSCHEMA(8C) — yes that's section 8C, the admin-tools-and-daemons section, and yes she's iconic. This is the in-database schema checking utility that ships with SLAPD, aka the OpenLDAP standalone daemon's little truth-teller. She reads your database and goes "ma'am… this entry does not comply." 🫶

✨ NAME ✨

slapschema — the SLAPD in-database schema checking utility 🌸

🌈 SYNOPSIS 🌈

/usr/bin/slapschema [-afilter] [-bsuffix] [-c] [-ddebug-level]
[-fslapd.conf] [-Fconfdir] [-g] [-HURI] [-lerror-file] [-ndbnum]
[-ooption[=value]] [-ssubtree-dn] [-v]

like. look at her. so many little flags. so much power. 🎀

💖 DESCRIPTION 💖

So slapschema is literally here to check whether the contents of a slapd(8) database actually comply with the schema. She opens the database you point her at — determined by the database number or the suffix — and then she goes through its contents and checks them against the corresponding schema. Errors get written to standard output, or to a file if you specified one. 💅

Also!! Databases that are configured as subordinate to the one you picked get output too — unless you pass -g, in which case they mind their own business.

ngl here's the real tea: admins sometimes need to change existing schema items. We're talking:

  • adding new required attributes to objectClasses
  • removing existing required or allowed attributes from objectClasses
  • entirely removing objectClasses
  • or literally any other change that could take perfectly valid entries and make them ✨no longer compliant✨ with the modified schema

And the whole point of running slapschema after you modify the schema is that she points out the inconsistencies right then instead of letting them lurk and jump out later when inconsistent entries need to be modified. 🫣

Some behaviour notes so you're not surprised:

  • The entry records are checked in database order, not superior-first order. she does not do hierarchy-coreography, she does a straight walk.
  • The entry records are checked considering all (user and operational) attributes stored in the database.
  • Dynamically generated attributes (like subschemaSubentry) are not considered. she said dynamic? not her problem. 🙈

🎀 OPTIONS 🎀

  • -a filter — Only check entries matching the asserted filter. For example:
slapschema -a \
    "(!(entryDN:dnSubtreeMatch:=ou=People,dc=example,dc=com))"

will check all but the "ou=People,dc=example,dc=com" subtree of the "dc=example,dc=com" database. Deprecated; use -H ldap:///???(filter) instead. 💀

  • -b suffix — Use the specified suffix to determine which database to check. By default, the first database that supports the requested operation is used. And bestie, careful: -b cannot be used in conjunction with the -n option. they don't get along. 🚫
  • -c — Enable continue mode, aka ignore errors and keep going. she's unbothered, moisturized, in her lane.
  • -d debug-level — Enable debugging messages as defined by the specified debug-level; see slapd(8) for the deets. 🔍
  • -f slapd.conf — Specify an alternative slapd.conf(5) file. bring your own config, queen.
  • -F confdir — Specify a config directory. If both -f and -F are specified, the config file will be read and converted to config directory format and written to the specified directory. If neither option is specified, an attempt to read the default config directory will be made before trying to use the default config file. And if a valid config directory exists, then the default config file is ignored. periodt. ✨
  • -g — Disable subordinate gluing. Only the specified database will be processed, and not its glued subordinates (if any). no plus-ones allowed. 🙅
  • -H URI — Use dn, scope and filter from URI to only handle matching entries. the glow-up replacement for -a and -s, iykyk. 🌟
  • -l error-file — Write errors to the specified file instead of standard output. 📝
  • -n dbnum — Check the dbnum-th database listed in the configuration file. The config database slapd-config(5), is always the first database, so use -n 0

And the same rules apply: the -n cannot be used in conjunction with the -b option. 💅

  • -o option[=value] — Specify an option with a(n optional) value. Possible generic options/values are:
syslog=<subsystems>  (see `-s' in slapd(8))
syslog-level=<level> (see `-S' in slapd(8))
syslog-user=<user>   (see `-l' in slapd(8))
  • -s subtree-dn — Only check entries in the subtree specified by this DN. Implies -b subtree-dn if no -b nor -n option is given. Deprecated; use -H ldap:///subtree-dn instead. 🫠
  • -v — Enable verbose mode. she will tell you EVERYTHING. 🗣️

⚠️ LIMITATIONS ⚠️

Okay this one matters, bestie, so listen up. For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this, so you can ensure consistency of the database. 🔥

It is always safe to run slapschema with the slapd-mdb(5), and slapd-null(5) backends. those two? certified safe. no notes. 💖

🌸 EXAMPLES 🌸

To check the schema compliance of your SLAPD database after modifications to the schema, and put any error in a file called errors.ldif, give the command:

/usr/bin/slapschema -l errors.ldif

look at her go. one line. doing the most. 👑

🦋 SEE ALSO 🦋

💜 ACKNOWLEDGEMENTS 💜

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release.

okay that's the whole page, you ate that, go forth and check your schema bestie 🫶

this was OpenLDAP 2.7.2, dated 2026/10/21, page SLAPSCHEMA(8C) — mwah, no cap 💅✨

📦 where this page comes from