SLAPO-MEMBEROF(5)            File Formats Manual           SLAPO-MEMBEROF(5)

NAME         top

       slapo-memberof - Reverse Group Membership overlay to slapd

SYNOPSIS         top


DESCRIPTION         top

       The memberof overlay to slapd(8) allows automatic reverse group
       membership maintenance.  Any time a group entry is modified, its
       members are modified as appropriate in order to keep a DN-valued "is
       member of" attribute updated with the DN of the group.


       The config directives that are specific to the memberof overlay must
       be prefixed by memberof-, to avoid potential conflicts with
       directives specific to the underlying database or to other stacked

       overlay memberof
              This directive adds the memberof overlay to the current
              database; see slapd.conf(5) for details.

       The following slapd.conf configuration options are defined for the
       memberof overlay.

       memberof-group-oc <group-oc>
              The value <group-oc> is the name of the objectClass that
              triggers the reverse group membership update.  It defaults to

       memberof-member-ad <member-ad>
              The value <member-ad> is the name of the attribute that
              contains the names of the members in the group objects; it
              must be DN-valued.  It defaults to member.

       memberof-memberof-ad <memberof-ad>
              The value <memberof-ad> is the name of the attribute that
              contains the names of the groups an entry is member of; it
              must be DN-valued.  Its contents are automatically updated by
              the overlay.  It defaults to memberOf.

       memberof-dn <dn>
              The value <dn> contains the DN that is used as modifiersName
              for internal modifications performed to update the reverse
              group membership.  It defaults to the rootdn of the underlying

       memberof-dangling {ignore, drop, error}
              This option determines the behavior of the overlay when,
              during a modification, it encounters dangling references.  The
              default is ignore, which may leave dangling references.  Other
              options are drop, which discards those modifications that
              would result in dangling references, and error, which causes
              modifications that would result in dangling references to

       memberof-dangling-error <error-code>
              If memberof-dangling is set to error, this configuration
              parameter can be used to modify the response code returned in
              case of violation.  It defaults to "constraint violation", but
              other implementations are known to return "no such object"

       memberof-refint {true|FALSE}
              This option determines whether the overlay will try to
              preserve referential integrity or not.  If set to TRUE, when
              an entry containing values of the "is member of" attribute is
              modified, the corresponding groups are modified as well.

       The memberof overlay may be used with any backend that provides full
       read-write functionality, but it is mainly intended for use with
       local storage backends. The maintenance operations it performs are
       internal to the server on which the overlay is configured and are
       never replicated. Replica servers should be configured with their own
       instances of the memberOf overlay if it is desired to maintain these
       memberOf attributes on the replicas.  Note that slapo-memberOf is not
       compatible with syncrepl based replication, and should not be used in
       a replicated environment. An alternative is to use slapo-dynlist to
       emulate slapo-memberOf behavior.

FILES         top

              default slapd configuration file

SEE ALSO         top

       slapd.conf(5), slapd-config(5), slapd(8).  The slapo-memberof(5)
       overlay supports dynamic configuration via back-config.


       This module was written in 2005 by Pierangelo Masarati for SysNet

COLOPHON         top

       This page is part of the OpenLDAP (an open source implementation of
       the Lightweight Directory Access Protocol) project.  Information
       about the project can be found at ⟨⟩.  If you
       have a bug report for this manual page, see
       ⟨⟩.  This page was obtained from the
       project's upstream Git repository
       ⟨git://⟩ on 2019-03-06.  (At that time,
       the date of the most recent commit that was found in the repository
       was 2019-02-28.)  If you discover any rendering problems in this HTML
       version of the page, or you believe there is a better or more up-to-
       date source for the page, or you have corrections or improvements to
       the information in this COLOPHON (which is not part of the original
       manual page), send a mail to

OpenLDAP LDVERSION               RELEASEDATE               SLAPO-MEMBEROF(5)

Pages that refer to this page: slapd.overlays(5)slapo-memberof(5)