Reference

Using slapschema

Tags: slapschema, utility

Date: 11-04-2022

slapschema is a database integrity verification utility that reads your database directly (bypassing slapd.) It validates each entry against your active schema. It detects invalid attribute syntaxes, missing MUST attributes, illegal objectClass combinations, ensuring that your entries conform to the attribute syntaxes, objectClass rules, and structural constraints enforced by your loaded schema. It helps detect issues before replication or after LDIF imports (e.g., after slapadd).

Syntax

slapschema [options]

Common options

Option	Description
`-f`	Use a specific `slapd.conf` config file
`-F`	Use the dynamic configuration directory (`cn=config`)
`-b`	Validate only the subtree under a specific base DN
`-n`	Validate a specific database by numeric index (e.g., `-n 1`)
`-l`	Log invalid entries to a file instead of stdout
`-v`	Verbose output (shows each entry being validated)

Example 1

Validate the entire main database:

slapschema -F /opt/symas/etc/openldap/slapd.d -n 1 -v

This runs through the entire first (main) database under /opt/symas/var/openldap-data, checking every entry for schema violations.

Example output:

entry dn="uid=jdoe,ou=People,dc=example,dc=com"
   objectClass 'inetOrgPerson' requires attribute 'sn'

The entry violates schema because it lacks a required sn (surname).

You can also validate only one subtree. It would look like this:

slapschema -F /opt/symas/etc/openldap/slapd.d -b "ou=People,dc=example,dc=com"

This is useful when validating a specific branch before replication or export.

The -l can also be used to log the entries to a file as well.

Example 2

Use with slapd.conf:

slapschema -f /opt/symas/etc/openldap/slapd.conf -b "dc=example,dc=com" -v

What `slapschema` Checks

Validation Type	Description
ObjectClass rules	Ensures all `MUST` attributes are present
Syntax enforcement	Ensures attribute values match declared `SYNTAX`
Attribute duplication	Detects duplicate attribute definitions in entries
DIT structure rules	Ensures entries follow allowed parent/child class structure
Unknown attributes	Flags attributes not defined in any loaded schema

Limitations

For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. It is always safe to run slapschema with the slapd-mdb(5), and slapd-null(5) backends.

For more information, please see slapschema Man Page.