Re: LDAP entry metadata

[Hallvard B Furuseth <h.b.furuseth@usit.uio.no>]

Rob Shepherd writes:
> Is it possible to make queries to internal data, as well as directory
> entry attributes?

Yes.

If you want a search to return internal data for an entry, aka
operational attributes, you must explicitly ask for them.

As an OpenLDAP extension, asking for "+" requests all operational
attributes.  And remember that asking for any attribute cancels the
default "*", so if you want both all operational and user attributes,
ask for both "*" and "+".

> I want to query when an attribute was added to the directory, without
> having to make an external repository for this info, in another
> database or file, or supplementary descriptive

$ ldapsearch -xLLLh ldap.uio.no -b dc=uio,dc=no "(uid=hbf)" modifyTimestamp
dn: uid=hbf,cn=people,dc=uio,dc=no
modifyTimestamp: 20070329084312Z

> Is there a backend way to make attributes expire?

man slapo-dds and (for passwords) slapo-ppolicy.

-- 
Regards,
Hallvard