Modify schema using ldif file and ldapmodify

Question

Suppose I want to create a new attribute and add it to a previously created object class; using an ldif file and ldapmpodify.
It seems that my only option is an ldif file that looks like this:
dn:cn=schema
changetype: modify
replace: objectclasses
objectclasses: (...........MAY 'new attribute'...)
This means that the author of the ldif file has to have prior knowledge of the schema, presumably by doing an ldapsearch.
Am I missing anything?
Basically there is a requirement here that developers be able to modify ldap schema on the test server by themselves. (without asking the ldap admin to do so). They currently can add fields to an SQL database with SQL tools so they want to do the same to LDAP.
Any ideas ?

Answer 1

That is correct, you'll have to add the attribute and then replace the objectclass. However, you may have to disable schema checking to modify the objectclass.
Someone pointed out in another thread, you can give write access to the schema and config to another user via ACIs.
Another thing to keep in mind, adding attributes/objectclasses via ldapmodify will put everything in 99user.ldif. This could get messy if you need to upgrade or rebuild an instance. I reccommend creating a 98myapp.ldif (or whatever you want) and putting your application specific objectclasses/attributes in there. This will require stopping/starting the server, but it will give you a good handle on what's been changed. In fact, you could require the developers to keep this file in RCS (or other version control) and then you could have a nice history of changes and the ability to go back if necessary.
HTH,
Roger S.