Extending LDAP schema

Dear all,
I have directory server 2005Q4 configured with idsconfig for naming authentication, i.e. providing replacement for NIS environment.
The question is what would be the proper procedure to extend the schema (something else?) to provide capabilities for Messaging Server 2005Q4 to use existing DS and existing user profiles?
Thank you for your help,
Andrei

Messaging Server provides it's own script (comms-dssetup ???) that adds the schema required by Messaging Server to DS. To extent the DS schema for
other applications/users take a look at the DS Admin Guide.
http://docs.sun.com/source/817-7613/schema.html

Similar Messages

I need to extend the schema for iPlanet Dir. 5.0 and add custom objectclasses and atributes. I do this by adding entries in the 99user.ldif file. Its not working. Any ideas?

Hi
I need to extend the schema for iPlanet Dir. 5.0 and I do not want to do so from the console. As per the documentation, I need to either add entries in the 99user.ldif file or define my own custom [00-99]myname.ldif file. I tried this but its not working.
I have made the assumption that there is no explicit import step for the 'user defined' schema files (as it is for user data ldif files). I assume that on start (or on opening the console), I'd be able to see the new schema after the server has read the schema file.
I have verified that entering new objectclasses and attributes from the console adds entries into the 99user.ldif file. So why is the reverse process not working. Can anybody throw some light on this? Also in case my assumptions are faulty, please let me know.
I did not change the aci entries in the existing ldif file. Is any modification needed there? I was logged in as the Directory Manager during this testing process.
regards
Sikka ([email protected])

Hi Sikka,
The server reads its schema configuration on startup. If you manually modify the schema files while the server is running, it will not have any effect. You have to restart the server.
The console adds the new schema elements over LDAP (you could do that as well, you only have to modify the cn=schema entry), so the server is aware of the changes immediately and thus restarting is not needed.
I hope this helps.
Bertold

Extending AD schema - any hidden gotchas?

I've had a fairly positive experience with the triangle (up until 10.6 anyway), but I'm considering ditching the Xserve and going the schema route.
Any major caveats to watch out for? Possible things to go wrong?
TIA!
FZ

FZ I'm a complete mac noob - I only got into the whole mac thing just a month ago. So I am very, very green and I can only relay to you what I have read. So I am no expert - perhaps someone could verify my comments.
I've read that you could loose access to the files on a windows share by switching from OD attributes to the other AD attributes. Pls can someone verify my statement.
My Notes
you have 3 choices to managing preferences
1. Ad+ OD
2. Third party
3. Extend schema
Windows 2003 already contains the basic schema extensions of RFC2307 for Unix posix compatibility uidNumber - however I think this and other RFC2307 fields are empty and need populating within AD through scripts or imports. Anyone able to help me find such a script or define an import method?
So the question is if you have windows 2003 or better do you really need to extend the schema? And even if you have windows2003 or better by extending the schema what do you get? My guess is native mac attributes added to the windows AD that remove the need for OD.
Notes that need verify.
1. You could use the standard RFC 2307 attributes in Windows 2003 or better. They will need to be filled. You could then link/map those in Workgroup manager??
2. Extend AD schema with apple attributes, populate (scripts) and use workgroup manager to talk to AD to manage preferences. Anyone able to help me find an AD script or define an import method?
As I'm typing the fog of misunderstanding is still rolling over me. Which leads to ask these questions too:
1. What are the attributes in RFC 2307. Googling I get these:
RFC 2307 Using LDAP as a Network Information Service March 1998
uidNumber
gidNumber
gecos
homeDirectory
loginShell
shadowLastChange
shadowMin
shadowMax
shadowWarning
shadowInactive
shadowExpire
shadowFlag
memberUid
memberNisNetgroup
nisNetgroupTriple
ipServicePort
ipServiceProtocol
ipProtocolNumber
oncRpcNumber
ipHostNumber
ipNetworkNumber
ipNetmaskNumber
macAddress
bootParameter
bootFile
nisMapName
nisMapEntry
I'm assuming that these are them.
The peachpit books seem a great resource and there are references to eseminars the links have changed and I've now found them - http://www.seminars.apple.com/cgi-bin/WebObjects/ASPRegistration.woa/wa/sol but won't be able to access them until later tonight (offpeak)
Regards
SMonkey

Extending eDirectory schema for OIF Federation Data Store

Since I couldn't find ldif files specifically for eDirectory (Novell Directory Server), I tried extending the schema using the OpenLDAP and GENERIC schema files. Both attempts failed for file format reasons.
Has anyone been succesfull updating their eDirectory schema?
Thanks

I hope you know that eDirectory is not supported - http://www.oracle.com/technology/software/products/ias/files/idm_certification_101401.html#BABHFBCC
Like any LDAP-compliant server eDirectory has its own idiosyncracies and you might hit issues because OIF using eDir as the federation data store has not been QA-ed by Oracle.
-Vinod

Steps to extend the schema if I have no access to the web console

Hello,
I am usin DS 6.2. The web console is not applicable in my case. So I must extend the schema manually.
I want to add an attribute type and an objectclass. I do have a test server and I did
ldapsearch -L -b "cn=schema" objectclass='*'
and then took what I need:
dn: cn=schema
changetype: add
attributeTypes: ( 1.3.6.1.4.1.42.2.27.9.1.333 NAME 'orclnetdescstring' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
objectClasses: ( orclservice-oid NAME 'orclservice' SUP top STRUCTURAL MUST cn MAY orclnetdescstring X-ORIGIN 'user defined' )
When I do:
ldapadd -c -h hostname -p 389 -D "cn=Directory manager" -w password -f myldif
adding new entry cn=schema
ldap_add: Object class violation
I tried to add these lines
attributeTypes: ( 1.3.6.1.4.1.42.2.27.9.1.333 NAME 'orclnetdescstring' SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' )
objectClasses: ( orclservice-oid NAME 'orclservice' SUP top STRUCTURAL MUST cn MAY orclnetdescstring X-ORIGIN 'user defined' )
to 99users.ldif and restarted the server. No progress.
any idea please?

You can either use 2 "changetype:modify" operations (not changetype:add since you're trying to modify an existing entry), or you can stop you DS, then edit the 99user.ldif by hand and start it again .

Extending ovd schema with 10.1.4.3 release on linux

We are trying to apply Note 739067.1 but $OVD_HOME/tools/ldapmodify is not available in 10.1.4.3 release. There are some script to use a java ImportLDIF class but in windows format. Is there some procedure to extend ovd schema from command line in linux?
We are using ovd in front of Oracle Internet Directory.
Regards

I don't think so. I remember for certain patchsets on Solaris (Sparc), to be able to apply the patchset - I had to download an interim patch to update the OUI version. It was necessary to apply that particular patchset. And I got that from Metalink, it was documented in the patchset help file. I guess, you should try the Metalink. The OUI version 10.1.0.4 I was referring to actually comes with iAS 10g R2. For the database version, 10g R2 - OUI version is 10.2.
Message was edited by:
zaferaktan

Regarding Extended star schema

Hi Friends,
In Extended star schema,master data will load separately ,which will connect through sid's to dimension table .
My question is.. This master data tables can be used other than this cube ?
Please tell me i am in confusion.
Thanks in advace,
Regards,
ramnaresh.

Hi
InfoCubes are made up of a number of InfoObjects. All InfoObjects (characteristics and key figures) are available independent of the InfoCube. Characteristics refer to master data with their attributes and text descriptions.
An InfoCube consists of several InfoObjects and is structured according to the star schema. This means there is a (large) fact table that contains the key figures for the InfoCube, as well as several (smaller) dimension tables which surround it. The characteristics of the InfoCube are stored in these dimensions.
An InfoCube fact table only contains key figures, in contrast to a DataStore object, whose data part can also contain characteristics. The characteristics of an InfoCube are stored in its dimensions.
The dimensions and the fact table are linked to one another using abstract identification numbers (dimension IDs) which are contained in the key part of the particular database table. As a result, the key figures of the InfoCube relate to the characteristics of the dimension. The characteristics determine the granularity (the degree of detail) at which the key figures are stored in the InfoCube.
Characteristics that logically belong together (for example, district and area belong to the regional dimension) are grouped together in a dimension. By adhering to this design criterion, dimensions are to a large extent independent of each other, and dimension tables remain small with regards to data volume. This is beneficial in terms of performance. This InfoCube structure is optimized for data analysis.
The fact table and dimension tables are both relational database tables.
Characteristics refer to the master data with their attributes and text descriptions. All InfoObjects (characteristics with their master data as well as key figures) are available for all InfoCubes, unlike dimensions, which represent the specific organizational form of characteristics in one InfoCube.
Integration
You can create aggregates to access data quickly. Here, the InfoCube data is stored redundantly and in an aggregated form.
You can either use an InfoCube directly as an InfoProvider for analysis and reporting, or use it with other InfoProviders as the basis of a MultiProvider or InfoSet.
See also:
Checking the Data Loaded in the InfoCube
If the above info is useful, please grant me points

Extending AD schema to sync to Office365

Hi, we currently are running a fresh AD environment that has never been exposed to Exchange. We are running DirSync to sync AD to Office365 (one way). We're currently unable to manage several attributes due to not ever having an Exchange installation, so
we simply need to extend our AD schema to add the necessary attributes. This seems to be a somewhat common problem, but there doesn't seem to be any official documentation/procedure for fixing. Here's a few things that really need clarification, for anyone
looking to extend their schema for Office365 purposes:
1. Which Exchange installation to use to extend schema?
2. The objects that were synced to Office365 initially had some of the attributes we're now missing. Should we be concerned about overwriting these attributes with null values after the schema extension? What is the best method to address these concerns?
Is there a list of attributes provided by the schema extension so we can check what may be overwritten?
Thanks and please help!

1. Which Exchange installation to use to extend schema?
I always used Exchange Server 2013.
2. The objects that were synced to Office365 initially had some of the attributes we're now missing.
Should we be concerned about overwriting these attributes with null values after the schema extension?
If something is wrong with the sync then you should be able to see it on DirSync after the sync attempt. The list of synced attributes is mentioned here: http://social.technet.microsoft.com/wiki/contents/articles/19901.dirsync-list-of-attributes-that-are-synced-by-the-azure-active-directory-sync-tool.aspx
Of course, the data are synced from AD to Office 365 so you need to take in consideration that your data will be overwritten. The good approach would be to populate these attributes in AD before running the sync.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

DPM 2012 End User Recovery - Extending AD Schema tool crashes with error

Hi everyone,
I deployed SCDPM 2012 R2 in my test environment, but it is an issue. When I'm trying to extend AD Schema by DPMADSchemaExtensionTool.exe, it stops to working with an appcrash message:
Problem signature:
Problem Event Name: APPCRASH
Application Name: dpmdsacl.exe
Application Version: 4.2.1092.0
Application Timestamp: 51b1e89d
Fault Module Name: KERNELBASE.dll
Fault Module Version: 6.3.9600.16384
Fault Module Timestamp: 5215fa76
Exception Code: e0434352
Exception Offset: 0000000000008384
OS Version: 6.3.9600.2.0.0.272.7
Locale ID: 1033
Additional Information 1: 7644
Additional Information 2: 7644cee486badc818e8a96bb7aba3bfd
Additional Information 3: 2ddc
Additional Information 4: 2ddcde93bf91b9ddbb6e1a89fb9b5892
When I'm trying to do the same with cmd I get an error:
C:\diagEUR>dpmdsacl.exe sc.local CN=MS-ShareMapConfiguration,CN=System,DC=sc,DC=
local /A sc\dpm$
Unhandled Exception: System.IO.FileLoadException: Could not load file or assembl
y 'dpmdsacl, Version=1.0.523.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35
' or one of its dependencies. Strong name validation failed. (Exception from HRE
SULT: 0x8013141A) ---> System.Security.SecurityException: Strong name validation
failed. (Exception from HRESULT: 0x8013141A)
--- End of inner exception stack trace ---
How can I fix this error?

Hi Seth,
I think your script will be useful, please share them
Here it is. It does the same items that the DPM tool does to the domain, with a few extra steps noted at the top.
We create a group that has the permissions on the container, with the hope that one day, this feature will be available (DCR submitted). In our support model, we would rather delegate permissions to support personnel to modify group membership than
modify ACLs on system containers.    Your opinion on this may differ, so, feel free to remove it.
It also gives our support personnel permissions to modify the sharemap container - so they can enable DPM EUR servers later.
Both of these have been working fine for preparing a domain / enabling EUR. Preparing the domain is run by domain admin, then, we leave enabling EUR to our support staff.
Remember, this is not supported, this just makes the same changes that the EUR tool does. You should use the EUR tool from Microsoft.
#Requires -version 2.0
# File:      DPMEndUserDomainPrep.ps1
# Version:   0.1
# Purpose:   Domain Preparation for DPM End User Recovery
# Tasks compelted by this script:
#      -Create MS-ShareMapConfiguration container in System container of the domain
#            -Create the security group (NETBIOS Domain Name) DPM End User Recovery servers
#      -Give Create,Delete MS-srvShareMappingObjects, ListChildren permissions for the newly created group, on the new MS-ShareMapConfiguration container
#      -Find <SUPPORT GROUP> group in the forest root, and grant full permissions to the MS-ShareMapConfiguration container
Param(
[string]$domain
if ($domain -eq "")
write-host ""
write-host "Script Usage" -foreground cyan
write-host "-----------------" -foreground cyan
write-host "./DPMEndUserDomainPrep.ps1 -domain domain.com" -foreground cyan
write-host ""
exit
$Title = "DPM End User Recovery Domain Prep"
$Message = "Do you want to continue with domain prep for " + $domain + "?"
$Yes = new-object system.management.automation.host.choicedescription "&Yes","Continue with Domain Prep for $domain"
$No = new-object system.management.automation.host.choicedescription "&No","Exit the script"
$options = [System.Management.Automation.Host.ChoiceDescription[]]($yes, $no)
$result = $host.ui.PromptForChoice($title, $message, $options, 0)
If ($result -eq 1){exit}
# Load the AD module
Import-Module ActiveDirectory
# Figure out our domain
$root = (Get-ADRootDSE -server $domain).defaultNamingContext
#Get netbios domain name
$domainname = (Get-ADDomain -Identity $domain).NetBIOSName
#SchemaIDGuid for MS-SrvShareMapping Class
$ShareMapGUID = new-object guid c356f65b-5540-4d85-9aef-3a7ecae7a878
$guidNull = new-object Guid 00000000-0000-0000-0000-000000000000
        $guidGroupObject = new-object Guid BF967A9C-0DE6-11D0-A285-00AA003049E2
# Get or create the MS-ShareMapConfiguration container
$ou = $null
try
     $ou = Get-ADObject "CN=MS-ShareMapConfiguration,CN=System,$root"
catch
     Write-host "MS-ShareMapConfiguration container does not currently exist." -foreground yellow
if ($ou -eq $null)
     $ou = New-ADObject -Type Container -name "MS-ShareMapConfiguration" -Path "CN=System,$root" -Passthru
     write-host "Created Container $ou" -foreground yellow
     start-sleep -s 10
#Create DPM End User Recovery servers group
write-host "Creating group $domainname DPM End User Recovery Servers" -foreground yellow
new-adgroup -path "cn=builtin,$root" -name "$domainname DPM End User Recovery Servers" -groupscope universal -groupcategory security -description "Members of this group are delegated permissions to change contents of the System\MS-ShareMapConfiguration
container"
        start-sleep -s 10
$ServerGroup = get-adgroup "$domainname DPM End User Recovery Servers"
$ServerGroupsid = [system.security.principal.securityidentifier] $ServerGroup.sid
write-host ""
write-host "Created group $ServerGroup" -foreground yellow
#Get <SUPPORT GROUP>in Forest Root
$forestname = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest().Name
#Check to see if <SUPPORT GROUP> group exists
$SupportGroup = $null
$SupportGroup = get-adgroup -server $forestname "<SUPPORT GROUP>"
if ($SupportGroup -eq $null)
  write-host ""
  write-host "WARNING - <SUPPORT GROUP> Group does not exist in the forest root" -foreground red
  write-host "Permissions must be manually assigned to the MS-ShareMapConfiguration Container for the <SUPPORT GROUP>" -foreground red
  write-host ""
$SupportGroupSID = [system.security.principal.securityidentifier] $SupportGroup.sid
#Get current ACL for the MS-ShareMapConfiguration Container
$OUacl = get-acl "ad:cn=ms-sharemapconfiguration,cn=system,$root"
#Create ACE for adding permissions to newly created group to MS-ShareMapConfiguration container
$ace1 = new-object system.directoryservices.activedirectoryaccessrule $ServerGroupsid, "CreateChild,DeleteChild", Allow, $sharemapguid,"all"
$ace2 = new-object system.directoryservices.activedirectoryaccessrule $ServerGroupsid, "ListChildren", Allow,$guidNull,"all"
$ace3 = new-object system.directoryservices.activedirectoryaccessrule $SupportGroupsid, "GenericAll", Allow,$guidNull,"all"
$OUacl.addaccessrule($ace1)
$OUacl.addaccessrule($ace2)
$OUacl.addaccessrule($ace3)
#Apply ACL
write-host ""
write-host "Setting ACLs on cn=ms-sharemapconfiguration,cn=system,$root" -foreground yellow
set-acl -aclobject $OUacl "ad:cn=ms-sharemapconfiguration,cn=system,$root"
#Get current ACL for the DPM End User Recovery Servers group
$ServerGroupDN = $servergroup.distinguishedname
$Groupacl = get-acl "ad:$servergroupdn"
$groupace = new-object system.directoryservices.activedirectoryaccessrule $SupportGroupsid, "GenericAll", Allow,$guidNull,"all"
$Groupacl.addaccessrule($groupace)
write-host ""
write-host "Setting ACLs on $servergroupdn" -foreground yellow
set-acl -aclobject $Groupacl "ad:$servergroupdn"
write-host ""
write-host "Script Complete" -foreground yellow
Seth Cohen

Wat is the use of sid in extended star schema rather than linking masterdat

hi bw gurus,
wat is the use of sid in extended star schema rather than linking masterdata with dimention tables?
thanx in advace,
i will assign points,
srinivas

hi,
the sid are used instead of the data in order to avoid the redunduncy of data.
and reduce the datastorage size.
the data will be present in the sid table and the data is linked used the corerponding sid in the dimension.
regards

Ldap schema extension to control which users / group are imported

Hello,
would like to have your opinion:
would it be a good idea to implement ldap schema extensions to control
which users / group are imported and controlled from ldap in a ldap
mastered installation?
e.g. we could implement the following schema extension for users:
attributetype ( 1.3.6.1.4.1.<iana-org-id>.1.1 NAME ( 'BogusisBeehiveUser' )
     DESC ''
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
SINGLE-VALUE )
# BogusinetOrgPerson
# The BogusinetOrgPerson is derived from inetOrgPerson
objectclass     ( 1.3.6.1.4.1.<iana-org-id>.1
NAME 'BogusinetOrgPerson'
     DESC 'RFC2798: Internet Organizational Person, plus Bogus Extensions'
SUP inetOrgPerson
STRUCTURAL
     MAY (
          BogusisBeehiveUser )
Then we could control the inclusion in beehive by simply switching
BogusisBeehiveUser on or off.

sure; that's pretty much what is talked about in the Install Guide for LDAP Integration under the "inclusion and exclusion" section, about here:
http://download.oracle.com/docs/cd/E14897_01/bh.100/e14830/ldap.htm#CHDEFFJF
that doesn't go into the specifics of how you might want to design your objectClass schemas, though, as beehive is agnostic to that.
If you don't want to provision all users that match a certain existing rule (like everyone under dn=foo, or everyone where userType=employee), then adding a new attribute and building the profile inclusion rule around it is a valid thing to do.
richard

LDAP Schema Designer

I am looking for a kind of LDAP Schema Designer , utility that can check consistency of my schema , detect redundancies ....
Any suggestions?
Thanks

I don't know of any tool like that. The problem is actually not quite that simple, since LDAP does not implement a relational database per se, or have concepts about 1st, 2nd, 3rd, etc normal forms.
If you want me to review and refine your schema for you, then you can hire me as a consultant. I have extensive experience in designing schema and modeling directory objects and DIT.
Click my handle for my email address if interested.
podzap

X.509 PKI LDAP Schema for OID

Hi,
my question is about availability X.509 PKI LDAP Schema for OID. Does anyone know if it is possible to import already predefined schema into OID?
Is it neccessary to folow RFC2587 and define the schema by hand?
Any response and advice appreciated.
Petr
P.S.
I am quite new in the area of OID so some my questions may seem incomrehensible.

Hello Petr:
You most certainly can load your own custom schema items into OiD. A few things to keep in mind when you do this.
Make sure you load the attributes first.
Then your objectclasses.
Then your Catolog/indexes if you have any.
Then load your directory entries.
And last load any ACI's you may have.
If you give me a few of your schema definitions I would be happy to give you an example of how to do this.
There are many PKI venders out there and not all of them store certificates the same way. Some use standard schema attributes and others add their own custom attribute.

What LDAP schema should I use with JMQ 2.0?

I've just downloaded the JMS 2.0 beta for Solaris and trying to set up a admin objects store with LDAP server (NES 4.12). However I cannot find a LDAP schema file to import into the LDAP server in your release. Would it be possible to send me a copy?

As far as I know, you don't need to import any LDAP schema into
Netscape Directory Server 4.12 (I assume this is what you
are using) to store the administered objects.
Are you seeing "schema violation" errors when you use jmqobjmgr ?
If that is the case, what lookup name are you using ? Does
your lookup name have the form:
"cn=myLookupName"
In most cases (it can be overriden), LDAP servers require lookup names
to have the above format.

Extended Star Schema

Hi
Right now I'm trying to implement SAP HR Infotypes into SAP BW. I try to combine 10 infotypes (all Personal Administration) into one infocube. The confusing one is that when I see my dimension, there something strange (please see below)
Dimension 1 (from PA0016)
ZDATEFROM16
ZDATETO16
ZXXX (60 character, don't have master date attribute or text)
ZYYY (30 character, don't have master date attribute or text)
ZAAA(3 character, only master data text)
Dimension 2 (from PA0023)
ZDATEFROM23
ZDATETO23
ZCCC (60 character, don't have master date attribute or text)
ZBBB (30 character, don't have master date attribute or text)
ZDDD (20 character, don't have master date attribute or text)
If i see my dimension, it seems strange because most of them don't have master data (text,attr,hierarchy).
Is this violate the extended star schema design? Thank you.
Regards,
Satria

You can use characteristics such as ZXXX without master data (text, attr, hier) in extended star schema. It is not a violation. This means in business, for this characteristic you really don't need its text, attribute or hierarchy.
When perform data modeling for you HR cube, please do consider the design, can some characteristic be attribute of another one? Will you use hierarchy such organization level for some characteristic? characteristic with text, attribute or hierachy can provide more flexibility in reporting.

Extending LDAP schema

Similar Messages

Maybe you are looking for