SLAPO-ALIAS(5)

NAME
slapo-alias - expose an attribute under a different name

SYNOPSIS
olcOverlay=alias

DESCRIPTION
The alias overlay to slapd(8) allows migrations for existing attributes exposed through a name that is now deprecated where using slapo-rwm(5) is not applicable. For this reason, the aliased attributes are not writable in any way. In particular:

    Search
        Instances of the aliased attribute in the Search request filter are replaced by the source attribute. If the attribute is requested, the values are copied from the source attribute, however unlike with slapo-rwm(5), if the source attribute is also requested, both will be returned.

    Compare
        The request is mapped to the source attribute before processing.

    Add, Modify, ModRDN
        Requests affecting aliased attributes are rejected with a Constraint Violation.

CONFIGURATION LAYOUT
The overlay has to be instantiated under a database adding an entry of olcOverlay=alias with objectClass of olcAliasConfig. These are the available options:

    olcAliasMapping: <source-attribute> <aliased-attribute>
        Any time aliased-attribute is requested (explicitly or through * + shorthands), the values of source-attribute are returned. The attributes need to be compatible i.e. both have to be operational or neither should, same with the SINGLE-VALUE option, syntax or matching rules. The slapd.conf(5) equivalent is alias_attribute. It can be provided multiple times.

EXAMPLE
The following is an example of a configured overlay, substitute $DATABASE for the DN of the database it is attached to and {x} with the desired position of the overlay in the overlay stack.
dn: olcOverlay={x}alias,$DATABASE
objectClass: olcAliasConfig
olcOverlay: alias
olcAliasMapping: source-attribute aliased-attribute
The slapd.conf(5) equivalent of the above follows:
overlay alias
alias_attribute source-attribute aliased-attribute

NOTES
When mapping an operational attribute, you might need to use slapo-dsaschema(5) contrib module to provide its definition into the schema.

BUGS AND LIMITATIONS
Setting ACLs that differ between the aliased and its source attribute is not supported, they have to match or risk information disclosure. It is also expected that the aliased attributes are never physically present in the database.

FILES

ETCDIR/slapd.conf
    default slapd configuration file

ETCDIR/slapd.d
    default slapd configuration directory

SEE ALSO
slapd-config(5), slapd.conf(5), slapd.overlays(5), slapo-dsaschema(5), slapd(8)

ACKNOWLEDGEMENTS
This module was developed in 2023 by Ondřej Kuzník for Symas Corp.