SLAPO-RWM(5) File Formats Manual SLAPO-RWM(5) (NAME) slapo-rwm - / (Rewrite/Remap overlay) slapd (SYNOPSIS) /etc/openldap/slapd.conf (DESCRIPTION) rwm slapd(8) DN/ objectClass/attributeType . (virtual views) slapd-ldap(5) slapd-relay(5). (experimental) . (MAPPING) rwm objectClass attributeType ( ) . rwm-map . rwm-map {attribute | objectclass} [ | *] { | *} attributeType objectClass slapd . slapd . `*' . . `*' `*' . objectClasses attributeTypes attributeType objectClass . back-ldap (slapd-ldap(5)) back- meta (slapd-meta(5)) subschemaSubentry . attributeType distinguishedName attributeType . (REWRITING) . DN DN attributeType attributeType DN . attributeType distinguishedName . DN ( DN ) nameAndOptionalUID . . rwm pcache . rwm-normalize-mapped-attrs . rwm-normalize-mapped-attrs {yes|no} rwm "yes" . "no" . rwm-drop-unrequested-attrs {yes|no} rwm "yes" . "no" rwm . . "yes" . (SUFFIX MASSAGING) rwm / (suffix massaging) rwm-suffixmassage . slapd-ldap(5) slapd-meta(5) slapd-relay(5) . DN . DN ("") DN subschemaSubentry ( "cn=subschema") DSE DSA . rwm-suffixmassage [] DN bindDN searchDN searchFilterAttrDN compareDN compareAttrDN addDN addAttrDN modifyDN modifyAttrDN modrDN newSuperiorDN deleteDN exopPasswdDN searchEntryDN searchAttrDN matchedDN . searchFilter referralAttrDN referralDN . rwm-suffixmassage suffix . rwm-suffixmassage rwm-rewriteEngine ON . (REWRITING) . (REWRITING) << >> (rewrite context) . POSIX ( <<>> extended) (map resolution) . / . ::= [...] ::= [] slapd ( LDAP ): (Passes) rewriteRules . . . ( ) . " " . rwm-rewriteMaxPasses " " . . (map) . " " " " . (Pattern Matching Flags) `C' ( ) `R' <<>> POSIX ( <<>> ) `M{n}' n . (Action Flags) `:' ( ) `@' `:' . `#' `unwilling to perform' ( ). `G{n}' n ( !). `G{1}' . `I' . `unwilling to perform' . `U{n}' n `:' `:U{32}' `32' ( noSuchObject) . `@' n `@' `U{0}' . LDAP RFC4511 . . : `IG{2}' `G{2}I' . ( ) . (Pattern Matching) regex(7) / re_format(7) . (Substitution Pattern Syntax) `$' `$$' `$' `$' `' 0 1-9 regex(7) / re_format(7) . `$' `{' . : `$' `{' [ ] `(' `)' `}' : ::= [a-z][a-z0-9]* ( ) ::= `>' `|' `&' `&&' `*' `**' `$' . : > | ( ) & & && * * ** $ bind DN back-ldap back-meta rewriteParam . `$' `\' `\' slapd `\' `.*\.foo\.bar' `.*\\.foo\\.bar' . (Rewrite Context) . ( mod_rewrite ) . : client -> server ( ) server -> client ( ). (client -> server): (default) bindDN (bind) searchDN (search) searchFilter (search) searchFilterAttrDN (search) compareDN (compare) compareAttrDN AVA addDN (add) addAttrDN AVA ( DN "ref") modifyDN (modify) modifyAttrDN AVA ( DN "ref") referralAttrDN / DN ( none) renameDN modrdn ( DN ) newSuperiorDN modrdn ( DN ) newRDN modrdn ( RDN ) deleteDN (delete) exopPasswdDN DN (server -> client): searchEntryDN ( DN ) searchAttrDN AVA ( searchEntryDN DN ) matchedDN ( searchEntryDN) referralDN ( none) (Basic Configuration Syntax) / rwm- . rwm-rewriteEngine { on | off } `on' `off' ( ). rwm-rewriteContext [ alias ] . . . . rwm-rewriteRule [ ] . . (Additional Configuration Syntax) rwm-rewriteMap [ ] . . rwm-rewriteParam `${$paramName}' . rwm-rewriteMaxPasses [] ( ). 100 . . `M{n}' (override) . (MAPS) (builtin) . : LDAP [bindwhen=] [version=] [binddn=] [credentials=] LDAP LDAP . URI attrs ( DN entryDN ). . bindwhen . now later everytime . (cache) . . binddn credentials DN (simple bind) (anonymous) . version 2 3 . 3 . slapd slapd LDAP . URI ldap:/// ( URI LDAP ). LDAP attrs . escape [escape2dn|escape2filter|unescapedn|unescapefilter]... escape DN . . : escape2dn DN escape2filter unescapedn DN unescapefilter escape escape . (REWRITE CONFIGURATION EXAMPLES) # `off' rwm-rewriteEngine on # "suffixmassage" rwm-rewriteEngine on # DN rwm-rewriteContext default rwm-rewriteRule "(.+,)?$" "$1" ":" # rwm-rewriteContext searchFilter # rwm-rewriteContext searchEntryDN rwm-rewriteRule "(.+,)?$" "$1" ":" rwm-rewriteContext searchAttrDN alias searchEntryDN rwm-rewriteContext matchedDN alias searchEntryDN # rwm-rewriteContext referralAttrDN rwm-rewriteContext referralDN # `default' . # `dc=home,dc=net' # `dc=OpenLDAP, dc=org' rwm-rewriteRule "(.+,)?dc=home,[ ]?dc=net$" "$1dc=OpenLDAP, dc=org" ":" # DN / # rdn ( `,') : rwm-rewriteRule "(.+,)?dc=home,dc=net$" "$1dc=OpenLDAP,dc=org" ":" # ( ). # DN . rwm-rewriteContext addBlanks rwm-rewriteRule "(.*),([^ ].*)" "$1, $2" # rwm-rewriteContext eatBlanks rwm-rewriteRule "(.*), (.*)" "$1,$2" # # . # `addBlanks' rwm-rewriteContext default rwm-rewriteRule ".*" "${>addBlanks($0)}" ":" # `default'. rwm-rewriteContext searchDN alias default # DN # `dc=home,dc=net' . rwm-rewriteContext searchEntryDN rwm-rewriteRule "(.*[^ ],)?[ ]?dc=OpenLDAP,[ ]?dc=org$" "${>eatBlanks($1)}dc=home,dc=net" ":" # DN rwm-rewriteMap escape dn2filter unescapedn escape2filter # DN : ldap # DN ( # URI ) rwm-rewriteMap ldap attr2dn "ldap://host/dc=my,dc=org?dn?sub" # DN # `mail=someone@example.com' # # . # DN # bindDN . # # # Bind DN . rwm-rewriteContext bindDN rwm-rewriteRule "^(mail=)([^,]+@[^,]+)$" "${attr2dn($1${dn2filter($2)})}" ":@I" # . # . # bind DN `binddn' # : rwm-rewriteContext bindDN rwm-rewriteRule ".+" "${&&binddn($0)}$0" ":" # `uid=' # DN (bind) . # DN # AVA `uid=' # . `<>' DN . # DN `ou=admin' OR # `uid=' `cn=' . # auth_ldap-1.4 # `uid' `cn' # `cn=Web auth,ou=admin,dc=home,dc=net' . rwm-rewriteContext searchFilter rwm-rewriteRule "(.*\\()uid=([a-z0-9_]+)(\\).*)" "${**binddn}<>${&prefix($1)}${&arg($2)}${&suffix($3)}" ":I" rwm-rewriteRule "^[^,]+,ou=admin,dc=home,dc=net$" "${*prefix}|(uid=${*arg})(cn=${*arg})${*suffix}" ":@I" rwm-rewriteRule ".*<>$" "${*prefix}uid=${*arg}${*suffix}" ":" # DN # DN # "ou=People,dc=example,dc=com" # . # . rwm-rewriteContext searchEntryDN rwm-rewriteRule ".+,ou=People,dc=example,dc=com$" "$0" ":@" rwm-rewriteRule ".*" "" "#" (MAPPING EXAMPLES) `groupOfNames' `groupOfUniqueNames' `member' `uniqueMember' : map objectclass groupOfNames groupOfUniqueNames map attribute uniqueMember member : map attribute cn * map attribute sn * map attribute manager * map attribute description * map attribute * cn sn manager description ( LDAP) "" . . (FILES) /etc/openldap/slapd.conf slapd (SEE ALSO) slapd.conf(5) slapd-config(5) slapd-ldap(5) slapd-meta(5) slapd-relay(5) slapd(8) regex(7) re_format(7). (AUTHORS) Pierangelo Masarati / back-ldap Howard Chu Pierangelo Masarati. OpenLDAP 2.6.13 2026/03/09 SLAPO-RWM(5)