1

I have problem with creating my own attribute (eg. dateOfExpire-generalized time) and then with adding this attribute to own ObjecClass (eg. dormitory) and after that add this attribute with ObjectClass to existed schema inetorgperson.

This is what I added to inetorgperson.ldif file:

olcAttributeTypes: ( 2.5.18.1 NAME 'dateOfExpire' DESC 'RFC4512: indicated the date of account expiry' EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SINGLE-VALUE USAGE directoryOperation  SUBSTR cas eIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )

and this to inetorgperson.schema file:

attributetype ( 2.5.18.1 NAME 'dateOfExpire'
    DESC 'RFC4512: indicated the date of account expiry'
    EQUALITY generalizedTimeMatch
    ORDERING generalizedTimeOrderingMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
    SINGLE-VALUE
    USAGE directoryOperation )

objectclass ( 2.5.6.6.1 NAME 'dormitory'
    DESC 'RFC2256: a person'
    SUP person
    STRUCTURAL
    MUST ( sn $ cn $ dateOfExpire $ name $ uid )
    MAY ( userPassword $ telephoneNumber $ seeAlso $ description ) )

After that I add this schema with this command:

ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif

But I got only this error:

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"
ldap_add: Other (e.g., implementation specific) error (80)
additional info: olcAttributeTypes: "2.5.18.1" is operational
1

You've marked the attribute as operational (with USAGE directoryOperation), hence the error.

Operational attributes are not supposed to be modifiable by users; they require code running within OpenLDAP to update them based on some sort of event.

Also, I would recommend against altering the standard schemas, such as inetOrgPerson, etc. you should create your own schema.

  • I removed this line with USAGE directoryOperation, but now I'm getting this error: additional info: olcAttributeTypes: Inconsistent duplicate attributeType: "2.5.18.1" But in that file isn't any other atribute with attributeType: "2.5.18.1" – user1928543 May 8 '17 at 16:11
  • Where did you get the OID 2.5.18.1 from? You can't just make it up as it has to be globally unique; I can find that OID listed in microsoft.std.schema on my Mac so I don't believe it's unique. See zytrax.com/books/ldap/ch3/#attributes which explains why reusing an existing OID is a bad idea; you should request your own enterprise number from IANA and place all of the objects and attributes in your schema under this new enterprise number. – bodgit May 8 '17 at 16:20
  • This OID was only my choice, so you think that best solution is request it from IANA? How long can take this request? And what after that - change all OIDs on my LDAP server regarding this new enterprise number or this enterprise number will be only for new attributes etc.? – user1928543 May 8 '17 at 17:51
  • You only need to use your new enterprise number for custom attributes and objects you define in your own custom schema. Existing attributes and objects defined in schemas such as inetorgperson, cosine, etc. are fine to leave as-is, (and should be left alone). – bodgit May 8 '17 at 21:37
  • @user1928543: You can use for development purpose an OID which is not registered officially while you wait for the production one, the OID, technically speaking, need to be unique only in the directory where it is used. If you never intend to publish in any way your custom schema, then nobody will ever encountered error because of a dupplicate OID – Esteban May 15 '17 at 14:35
0

Each attribute type and object class must have unique OIDs assigned.

You're reusing OID 2.5.18.1 which is assigned to standard attribute createTimestamp.

You've also used OID 2.5.6.6.1 which is an OID arc you should not use because others might assign OIDs therein.

See also: OpenLDAP FAQ: Do I need to assign an OID to each schema item?

Your object class dormitory is of kind STRUCTURAL. It will not be possible to add this to existing entries. Use kind AUXILIARY instead.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.