SLAPD-SQL(5) File Formats Manual SLAPD-SQL(5) (NAME) slapd-sql - SQL slapd (SYNOPSIS) /etc/openldap/slapd.conf (DESCRIPTION) slapd(8) (PRESENT) (RDBMS) LDAP ( SQL ;) ). ( ISP) RDBMS LDAP ( ). RDBMS / LDAP . ... LMDB RDBMS ( MDB ) . http://www.openldap.org/faq/index.cgi?file=378 ( OpenLDAP FAQ-O-Matic/General LDAP FAQ/Directories vs. conventional databases) . ( ) (meta-information) LDAP SQL (relational schema) . SQL LDAP ( ) . SQL ( ) . ODBC RDBMS SQL RDBMS RDBMS . (experimental) . (CONFIGURATION) slapd.conf SQL "database sql" "backend" "database" . slapd.conf(5) . (DATA SOURCE CONFIGURATION) dbname ODBC . dbhost dbpasswd dbuser dbname . . RDBMS (: dbhost ). (SCOPING CONFIGURATION) SQL . subtree_cond where (subtree) (dn="(.+,)?$"). SQL ( ). DN ( "(ldap_entries.dn) LIKE CONCAT('%',?)") " " upper_func upper_needs_cast concat_pattern strcast_func . children_cond where (children) (dn=".+,$"). SQL ( ). DN ( "(ldap_entries.dn) LIKE CONCAT('%,',?)") " " upper_func upper_needs_cast concat_pattern strcast_func . use_subtree_shortcut { YES | no } searchBase (suffix) subtree subtree . SQL (STATEMENT CONFIGURATION) SQL ldap_entries . subtree_cond . slapd "-d 5" . . oc_query objectClass ldap_oc_mappings " " . : "SELECT id, name, keytbl, keycol, create_proc, delete_proc, expect_return FROM ldap_oc_mappings". at_query attributeType ldap_attr_mappings " " . : "SELECT name, sel_expr, from_tbls, join_where, add_proc, delete_proc, param_order, expect_return FROM ldap_attr_mappings WHERE oc_map_id=?". id_query DN ldap_entries " " . : "SELECT id,keyval,oc_map_id,dn FROM ldap_entries WHERE " DN ( "dn=?" "(dn)=?" ) " " upper_func upper_needs_cast concat_pattern strcast_func . insentry_stmt ldap_entries " " . : "INSERT INTO ldap_entries (dn, oc_map_id, parent, keyval) VALUES (?, ?, ?, ?)". delentry_stmt ldap_entries " " . : "DELETE FROM ldap_entries WHERE id=?". delobjclasses_stmt ldap_objclasses " " . : "DELETE FROM ldap_entry_objclasses WHERE entry_id=?". (HELPER CONFIGURATION) RDBMS . DN . LDAP ( ) RDBMS (case-sensitive) upper_func DN . RDBMS ( ) (cast) upper_needs_cast . strcast_func . (concatenation) concat_pattern . upper_func . RDBMS . SQL ( UCASE UPPER ). . upper_needs_cast { NO | yes } upper_func (literal strings) (cast) yes . CAST ( AS VARCHAR()) back-sql BACKSQL_MAX_DN_LEN ( slapd SLAP_LDAPDN_MAXLEN ). . strcast_func . "SELECT DISTINCT" RDBMS ( PostgreSQL) . . concat_pattern . '?' . CONCAT(?,?) ( IBM db2 PostgreSQL) ?||? (cast) : CAST(?||? AS VARCHAR()). RDBMS ( IBM db2 MSSQL) ?+? . RDBMS . . aliasing_keyword (aliasing) . RDBMS "AS" () . aliasing_quote . RDBMS () . has_ldapinfo_dn_ru { NO | yes } dn_ru ( DN ) ldap_entries . ( PostgreSQL/unixODBC ). . fail_if_no_mapping { NO | yes } yes LDAP SQL . . objectClass structuralObjectClass ldap_oc_mappings SQL add fail_if_no_mapping " " . . allow_orphans { NO | yes } yes ( ) . RDBMS . baseObject [ ] baseObject RDBMS . () LDIF(5) extensibleObject RDN baseObject . ldap_entries (view) union objectClass . " " . . create_needs_select { NO | yes } ldap_entries select . fetch_attrs fetch_all_attrs { NO | yes } . ACL . . hasSubordinates entryDN slapd . . check_schema { YES | no } structural objectClass . yes . sqllayer [...] DN LDAP SQL . . . (API) . autocommit { NO | yes } (autocommit) (off) . (METAINFORMATION USED) servers/slapd/back-sql/rdbms_depend/ OpenLDAP Oracle MS SQL Server MySQL ( PostgreSQL IBM db2) . (object classes) LDAP RDBMS . objectClass ER . ( ISP) . SQL . inetOrgPerson . LDAP ( ) SQL . (SEARCH) . : : PERSONS PHONES ---------- ------------- id integer id integer first_name varchar pers_id integer references persons(id) last_name varchar phone middle_name varchar ... ( PHONES ). PHONES pers_id ( PHONES pers_id ). objectclass LDAP : person ------- MUST cn MAY telephoneNumber $ firstName $ lastName ... cn : SELECT CONCAT(persons.first_name,' ',persons.last_name) AS cn FROM persons WHERE persons.id=? telephoneNumber : SELECT phones.phone AS telephoneNumber FROM persons,phones WHERE persons.id=phones.pers_id AND persons.id=? LDAP (telephoneNumber=123*) : SELECT ... FROM persons,phones WHERE persons.id=phones.pers_id AND persons.id=? AND phones.phone like '%1%2%3%' ( telephoneNumber (wildcard) telephoneNumber ). (join) WHERE SQL . ( ): ldap_oc_mappings (some columns are not listed for clarity) --------------- id=1 name="person" keytbl="persons" keycol="id" objectclass ( "name" ) . (person) "person" (persons phones) persons.id ( ) . Keytbl keycol "persons" ( ) "id" ( ) . ldap_attr_mappings (some columns are not listed for clarity) ----------- id=1 oc_map_id=1 name="cn" sel_expr="CONCAT(persons.first_name,' ',persons.last_name)" from_tbls="persons" join_where=NULL ************ id= oc_map_id=1 name="telephoneNumber" sel_expr="phones.phone" from_tbls="persons,phones" join_where="phones.pers_id=persons.id" LDAP SQL . LDAP (attribute types) "cn" "person" "cn" ( LDAP ). oc_map_id oc_mappings . SQL . sel_expr SELECT FROM . FROM WHERE . (aliases) ( ). where ( ) (join) ( ). NULL ( cn ). ( SQL ) ( ) . . ldap_entries ------------ id=1 dn= oc_map_id=... parent= keyval= DN LDAP . ( parent id ) . objectclass keyval (tuple) LDAP DN . ( SQL ) : (integer) . ;) (patch) OpenLDAP ITS . . ldap_entries (view) ( Robin Elfrink): CREATE VIEW ldap_entries (id, dn, oc_map_id, parent, keyval) AS SELECT 0, UPPER('o=MyCompany,c=NL'), 3, 0, 'baseObject' FROM unixusers WHERE userid='root' UNION SELECT (1000000000+userid), UPPER(CONCAT(CONCAT('cn=',gecos),',o=MyCompany,c=NL')), 1, 0, userid FROM unixusers UNION SELECT (2000000000+groupnummer), UPPER(CONCAT(CONCAT('cn=',groupname),',o=MyCompany,c=NL')), 2, 0, groupnummer FROM groups; RDBMS union objectClass ldap_entries baseObject baseObject . SQL (TYPICAL SQL BACKEND OPERATION) SQL ( ) . ldap_objclasses . : (telephoneNumber=123*) ( ): SELECT ldap_entries.id,persons.id, 'person' AS objectClass, ldap_entries.dn AS dn FROM ldap_entries,persons,phones WHERE persons.id=ldap_entries.keyval AND ldap_entries.objclass=? AND ldap_entries.parent=? AND phones.pers_id=persons.id AND (phones.phone LIKE '%1%2%3%') ( ONELEVEL) "... AND dn=?" ( BASE) "... AND dn LIKE '%?'" ( SUBTREE) : SELECT phones.phone AS telephoneNumber FROM persons,phones WHERE persons.id=? AND phones.pers_id=persons.id ()test_filter API LDAP ( LDAP SQL ) . ADD DELETE MODIFY MODRDN ( add_proc ) . SQL (stored procedure) keyval ( -- PostgreSQL ORACLE MSSQL - MySQL ). ldap_oc_mappings ldap_attr_mappings ( create_proc add_proc del_proc ) . . (COMMON TECHNIQUES) LDAP (referrals) . . SQL : ldap_entry_objectclasses(entry_id,oc_name). . SQL "objectclass" . inetOrgPerson "person" ... (referrals) "ref" "referral" ldap_entry_objclasses. "referral" . "referral" ldap_oc_mappings ( "ou" "cn") "ref" (url) url url . "extensibleObject" ldap_entry_objclasses . (CAVEATS) (gateway) RDBMS LDAP . hasSubordinates back-sql . ( ) (!(hasSubordinates=TRUE)) ... AND NOT (1=1) . (hasSubordinates=FALSE) . directoryString "__First___Last_" ( 0x20 ) "First_Last" RDBMS back- sql back-sql . (BUGS) ldap_entry_objclasses objectClass . . (PROXY CACHE OVERLAY) (proxy cache overlay) (caching) LDAP () . slapo-pcache(5) . (EXAMPLES) SQL slapd/back-sql/rdbms_depend/ OpenLDAP . (ACCESS CONTROL) sql slapd.access(5) ( disclose ). (FILES) /etc/openldap/slapd.conf slapd (SEE ALSO) slapd.conf(5) slapd(8). OpenLDAP 2.6.13 2026/03/09 SLAPD-SQL(5)