Entry Validation
Relevant source files
The following files were used as context for generating this wiki page:
Entry Validation in the flext-ldif project is a comprehensive system designed to ensure that LDAP Data Interchange Format (LDIF) entries comply with RFC standards (specifically RFC 2849, RFC 4512, and RFC 4514) and server-specific business rules. The system is built on Clean Architecture principles, utilizing domain models for state capture and specialized services for rule execution.
The validation process involves checking Distinguished Name (DN) syntax, attribute descriptions, mandatory field presence, and schema consistency. Instead of immediate rejection, the system focuses on capturing violations within specialized metadata to allow for audit trails and "best-effort" recovery during complex migrations.
Sources: src/flext_ldif/_models/domain_entry.py:465-470, src/flext_ldif/services/analysis.py:84-88
Validation Architecture and Flow
The validation logic is distributed between the FlextLdifAnalysis service and the Entry domain model itself. While the Entry model performs immediate structural validation upon instantiation, the Analysis service orchestrates large-scale validation of entry sequences, returning aggregated statistical results.
The following flowchart illustrates the high-level logic for validating a single entry:
The diagram represents the sequential checks performed by the validation service to determine entry compliance.
Sources: src/flext_ldif/services/analysis.py:49-75, src/flext_ldif/_models/domain_entry.py:515-538
Core Validation Components
RFC Compliance Checks
The system implements strict checks for RFC compliance as defined in FlextLdifUtilitiesEntry. These utilities are invoked both during model initialization and by the Analysis service.
| Rule Reference | Requirement Description |
|---|---|
| RFC 2849 § 2 | DN and at least one attribute must be present in content records. |
| RFC 4514 § 2.3 | DN components (RDNs) must follow specific formatting/escaping rules. |
| RFC 4512 § 2.5 | Attribute descriptions must start with a letter and contain only allowed characters. |
| RFC 4512 § 2.3 | The entry should contain the naming attribute defined in its RDN. |
| RFC 2849 § 5.2 | Binary values must be flagged with the ;binary option. |
Sources: src/flext_ldif/_utilities/entry.py:165-274, src/flext_ldif/_models/domain_entry.py:465-475
Entry Statistics and Metadata
Validation results are persisted within the EntryStatistics and ValidationMetadata models. This allows the system to track exactly why an entry failed without losing the entry data itself.
- EntryStatistics: Tracks the lifecycle, including
was_validated,was_rejected, and specificrejection_reason. - ValidationMetadata: A specialized container inside
ServerMetadatathat holdsrfc_violations,server_specific_violations, and acontextmap for diagnostic data.
Sources: src/flext_ldif/_models/domain_entry.py:34-80, src/flext_ldif/_models/domain_metadata.py:31-50
Analysis Service Logic
The FlextLdifAnalysis service provides the validate_entries method, which acts as the primary API for validating batches of LDIF entries.
The sequence shows how the service iterates through entries and utilizes shared utilities to populate validation metadata.
Sources: src/flext_ldif/services/analysis.py:84-118, src/flext_ldif/_models/domain_entry.py:480-505
Implementation Detail: Attribute Validation
The service checks every attribute name against allowed LDAP syntaxes:
for attr_name in entry.attributes.attributes:
attr_result = validation_service.validate_attribute_name(attr_name)
if attr_result.failure or not attr_result.value:
errors.append(f"Entry {dn_str}: Invalid attribute name '{attr_name}'")
valid = False
Sources: src/flext_ldif/services/analysis.py:24-29
Server-Specific Validation
Beyond RFC standards, entries can be validated against server-specific rules (e.g., OID or OUD requirements) injected via ServerMetadata. This is handled by the validate_server_specific_rules hook in the domain model.
Key Server Rules:
- requires_objectclass: Enforces that all non-schema entries must have at least one
objectClass. - requires_naming_attr: Enforces that the RDN attribute must exist in the attribute list.
- requires_binary_option: Enforces strict
;binarytagging for non-printable ASCII values.
Sources: src/flext_ldif/_utilities/entry.py:322-386, src/flext_ldif/_models/domain_entry.py:515-535
Validation Pipeline Example
In practice, validation is often used in a "Railway" pattern where entries are parsed, validated, and analyzed in a single functional chain.
def parallel_validation() -> p.Result[m.Ldif.ValidationResult]:
api = ldif()
# Generate/Load entries
entries = generate_test_dataset(100, error_rate=0.1)
# Validate in one call
validate_result = api.validate_entries(entries)
# Analyze patterns
return analyze_validation_results(validate_result.unwrap())
Sources: examples/03_validation_analysis.py:64-75
Summary
Entry Validation in flext-ldif serves as a high-fidelity diagnostic layer. By separating structural RFC checks from server-specific business logic and utilizing a non-destructive metadata approach, it enables complex LDAP migration workflows where data quality issues are surfaced as actionable statistics rather than fatal errors.
Sources: src/flext_ldif/_models/domain_entry.py:465-470, examples/03_validation_analysis.py:110-120