Using slapschema
Discover how to effectively implement slapschema to enhance data structuring and streamline information retrieval in your projects.
Updated at March 3rd, 2026
Table of Contents
Date: 11-04-2022
slapschema is a database integrity verification utility that reads your database directly (bypassing slapd.) It validates each entry against your active schema. It detects invalid attribute syntaxes, missing MUST attributes, illegal objectClass combinations, ensuring that your entries conform to the attribute syntaxes, objectClass rules, and structural constraints enforced by your loaded schema. It helps detect issues before replication or after LDIF imports (e.g., after slapadd).
Syntax
slapschema [options]Common options
| Option | Description |
|---|---|
-f <file> |
Use a specific slapd.conf config file |
-F <dir> |
Use the dynamic configuration directory (cn=config) |
-b <base> |
Validate only the subtree under a specific base DN |
-n <index> |
Validate a specific database by numeric index (e.g., -n 1) |
-l <file> |
Log invalid entries to a file instead of stdout |
-v |
Verbose output (shows each entry being validated) |
Example 1
Validate the entire main database:
slapschema -F /opt/symas/etc/openldap/slapd.d -n 1 -vThis runs through the entire first (main) database under /opt/symas/var/openldap-data, checking every entry for schema violations.
Example output:
entry dn="uid=jdoe,ou=People,dc=example,dc=com"
objectClass 'inetOrgPerson' requires attribute 'sn'The entry violates schema because it lacks a required sn (surname).
You can also validate only one subtree. It would look like this:
slapschema -F /opt/symas/etc/openldap/slapd.d -b "ou=People,dc=example,dc=com"This is useful when validating a specific branch before replication or export.
The -l can also be used to log the entries to a file as well.
Example 2
Use with slapd.conf:
slapschema -f /opt/symas/etc/openldap/slapd.conf -b "dc=example,dc=com" -vWhat slapschema Checks
| Validation Type | Description |
|---|---|
| ObjectClass rules | Ensures all MUST attributes are present |
| Syntax enforcement | Ensures attribute values match declared SYNTAX
|
| Attribute duplication | Detects duplicate attribute definitions in entries |
| DIT structure rules | Ensures entries follow allowed parent/child class structure |
| Unknown attributes | Flags attributes not defined in any loaded schema |
Limitations
For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. It is always safe to run slapschema with the slapd-mdb(5), and slapd-null(5) backends.
For more information, please see slapschema Man Page.