наложение динамического списка на slapd (Dynamic List overlay to slapd)
Имя (Name)
slapo-dynlist - Dynamic List overlay to slapd
Синопсис (Synopsis)
ETCDIR/slapd.conf
Описание (Description)
The dynlist overlay to slapd(8) allows expansion of dynamic
groups and more. Any time an entry with a specific objectClass
(defined in the overlay configuration) is being returned, the
LDAP URI-valued occurrences of a specific attribute (also defined
in the overlay configuration) are expanded into the corresponding
entries, and the values of the attributes listed in the URI are
added to the original entry. No recursion is allowed, to avoid
potential infinite loops.
The resulting entry must comply with the LDAP data model, so
constraints are enforced. For example, if a SINGLE-VALUE
attribute is listed, only the first value found during the list
expansion appears in the final entry. All dynamic behavior is
disabled when the manageDSAit control (RFC 3296) is used. In
that case, the contents of the dynamic group entry is returned;
namely, the URLs are returned instead of being expanded.
Конфигурация (Configuration)
The config directives that are specific to the dynlist overlay
must be prefixed by dynlist-, to avoid potential conflicts with
directives specific to the underlying database or to other
stacked overlays.
overlay dynlist
This directive adds the dynlist overlay to the current
database, or to the frontend, if used before any database
instantiation; see slapd.conf(5) for details.
This slapd.conf configuration option is defined for the dynlist
overlay. It may have multiple occurrences, and it must appear
after the overlay directive.
dynlist-attrset <group-oc> [<URI>] <URL-ad> [[<mapped-
ad>:]<member-ad>[+<memberOf-ad[@<static-oc>[*]] ...]
The value group-oc is the name of the objectClass that
triggers the dynamic expansion of the data.
The optional URI restricts expansion only to entries
matching the DN, the scope and the filter portions of the
URI.
The value URL-ad is the name of the attributeDescription
that contains the URI that is expanded by the overlay; if
none is present, no expansion occurs. If the intersection
of the attributes requested by the search operation (or
the asserted attribute for compares) and the attributes
listed in the URI is empty, no expansion occurs for that
specific URI. It must be a subtype of labeledURI.
The value member-ad is optional; if present, the overlay
behaves as a dynamic group: this attribute will list the
DN of the entries resulting from the internal search. In
this case, the attrs portion of the URIs in the URL-ad
attribute must be absent, and the DNs of all the entries
resulting from the expansion of the URIs are listed as
values of this attribute. Compares that assert the value
of the member-ad attribute of entries with group-oc
objectClass apply as if the DN of the entries resulting
from the expansion of the URI were present in the group-oc
entry as values of the member-ad attribute. If the
optional memberOf-ad attribute is also specified, then it
will be populated with the DNs of the dynamic groups that
an entry is a member of. If the optional static-oc
objectClass is also specified, then the memberOf attribute
will also be populated with the DNs of the static groups
that an entry is a member of. If the optional * character
is also specified, then the member and memberOf values
will be populated recursively, for nested groups. Note
that currently nesting is only supported for Search
operations, not Compares.
Alternatively, mapped-ad can be used to remap attributes
obtained through expansion. member-ad attributes are not
filled by expanded DN, but are remapped as mapped-ad
attributes. Multiple mapping statements can be used. The
memberOf-ad option is not used in this case.
The dynlist overlay may be used with any backend, but it is
mainly intended for use with local storage backends. In case the
URI expansion is very resource-intensive and occurs frequently
with well-defined patterns, one should consider adding a
proxycache later on in the overlay stack.
