Red Hat Training

A Red Hat training course is available for Red Hat Directory Server

12.5. Managing Schema Using ldapmodify

As with the Directory Server Console, ldapmodify can be used to add, edit, and delete custom schema elements. ldapmodify also modifies the default custom schema file for a Directory Server instance, 99user.ldif.

12.5.1. Creating Attributes

A custom attribute entry is itself an attributetypes entry for the cn=schema entry. The attributetypes attribute has the format: 
attributetypes: ( definition )
The definition contains five components:
  • An OID, usually a dot-separated number
  • A unique name, in the form NAME name
  • A description, in the form DESC description
  • The OID for the syntax of the attribute values, discussed in Section 12.3, “Directory Server Attribute Syntaxes”, in the form SYNTAX OID
  • Optionally, the source where the attribute is defined
The attribute definition is added to the custom schema file, 99user.ldif, by running an LDAP command and modifying the cn=schema entry. For example: 
# ldapmodify -D "cn=Directory Manager" -W -x -v

dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.2.3.4.5.6.1 NAME 'dateofbirth' DESC 'For employee birthdays' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUED X-ORIGIN 'Example defined')

12.5.2. Creating Object Classes

An object class definition is an objectclasses attribute for the cn=schema entry. The objectclasses attribute has the format: 
objectclasses: ( definition )
The object class definition contains several components:
  • An OID, usually a dot-separated number
  • A unique name, in the form NAME name
  • A description, in the form DESC description
  • The superior, or parent, object class for this object class, in the form SUP object_class; if there is no related parent, use SUP top
  • The word AUXILIARY, which gives the type of entry to which the object class applies; AUXILIARY means it can apply to any entry
  • A list of required attributes, preceded by the word MUST; to include multiple attributes, enclose the group in parentheses and separate with attributes with dollar signs ($)
  • A list of allowed attributes, preceded by the word MAY; to include multiple attributes, enclose the group in parentheses and separate with attributes with dollar signs ($)
The object class definition is added to the custom schema file, 99user.ldif, by by running an LDAP command and modifying the cn=schema entry. For example: 
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x -v

dn: cn=schema
changetype: modify
add: objectclasses
objectclasses: ( 2.16.840.1133730.2.123 NAME 'examplePerson' DESC 'Example Person Object Class' SUP inetOrgPerson AUXILIARY  MUST cn MAY (exampleDateOfBirth $ examplePreferredOS) )

12.5.3. Deleting Schema

Warning

Never delete default schema elements. Those are required by the Directory Server to run.
  1. Remove the unwanted attributes from any entries which use them, then from any object classes in the schema file which accept that attribute. Likewise, to remove an object class, remove it from any entries.
  2. Run ldapmodify to remove the attribute. For example: 
    # ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x

dn: cn=schema
changetype: modify
delete: objectclasses
objectclasses: ( 2.16.840.1133730.2.123 NAME 'examplePerson' DESC 'Example Person Object Class' SUP inetOrgPerson AUXILIARY MUST cn MAY (exampleDateOfBirth $ examplePreferredOS) )

    Warning

    Be sure to specify the exact object class or attribute to remove; using only the attributetypes or objectclasses attribute without the value will delete every user-defined attribute or object class in the file.
If the custom attribute or object class is in a custom schema file other than 99user.ldif, edit the file directly. Neither the Directory Server Console nor LDAP tools can edit a schema file other than 99user.ldif.