LDAP V3 schema

Use the following sections for information about the LDAP V3 schema.

Dynamic schema

IBM® Verify Directory, version 6.0 and later versions of C-Client SDK require that the schema defined for a server is stored in the subschemasubentry directory.

To access the schema, you must first determine the

subschemasubentry
DN

, which is obtained by searching the root DSE. To obtain this information from the command-line, issue the following command:

    ldapsearch -h hostname -p 389 -b "" -s base "objectclass=*"

The root DSE information that is returned from an LDAP V3 server, such as the IBM Directory server, includes the following subentry:

    subschemasubentry=cn=schema

where

subschemasubentry
DN

is "cn=schema".

Using the

subschemasubentry
DN

returned by searching the root DSE, schema information can be accessed with the following command-line search:

ldapsearch -h hostname -p 389 -b "cn=schema" -s base "objectclass=subschema"

The schema contains the following information:

Object class: A collection of attributes. A class can inherit attributes from one or more parent classes.
Attribute types: Contain information about the attribute, such as the name, oid, syntax, and matching rules.
IBM attribute types: The IBM LDAP directory implementation-specific attributes, such as database table name, column name, SQL type, and the maximum length of each attribute.
Syntaxes: Specific LDAP syntaxes available for attribute definitions.
Matching rules: Specific matching rules available for attribute definitions.

Schema queries

The ldapsearch utility can be used to query the subschema entry. This search can be run by any application by using the ldap_search APIs.

To retrieve all the values of one or more selected attribute types, specify the specific attributes that are wanted for the LDAP search. Schema-related attribute types include the following values:

objectclass
objectclasses
attributetypes
ldapsyntaxes
ibmattributetypes
matchingrules

For example, to retrieve all the values for ldapsyntaxes, specify:

ldapsearch -h host -b "cn=schema" -s base objectclass=* ldapsyntaxes

which returns something like:

cn=schema
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.10 DESC 'Certificate Pair' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.11 DESC 'Country String' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.12 DESC 'DN' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.14 DESC 'Delivery Method' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.15 DESC 'Directory String' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.16 DESC 'DIT Content Rule 
        Description' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.17 DESC 'DIT Structure Rule 
        Description' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.21 DESC 'Enhanced Guide' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.22 DESC 
       'Facsimile Telephone Number' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.23 DESC 'Fax' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.24 DESC 'Generalized Time' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.25 DESC 'Guide' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.26 DESC 'IA5 String' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.27 DESC 'INTEGER' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.28 DESC 'JPEG' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.3 DESC 'Attribute Type 
        Description' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.30 DESC 'Matching Rule 
        Description' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.31 DESC 'Matching Rule Use 
        Description' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.33 DESC 'MHS OR Address' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.34 DESC 'Name And Optional UID' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.35 DESC 'Name Form 
        Description' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.36 DESC 'Numeric String' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.37 DESC 'Object Class 
        Description' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.38 DESC 'OID' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.39 DESC 'Other Mailbox' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.40 DESC 'Octet String' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.41 DESC 'Postal Address' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.42 DESC 'Protocol Information' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.43 DESC 'Presentation Address' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.44 DESC 'Printable String' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.49 DESC 'Supported Algorithm' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.5 DESC 'Binary' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.50 DESC 'Telephone 
        Number' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.51 DESC 
       'Teletex Terminal Identifier' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.52 DESC 'Telex Number' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.53 DESC 'UTC Time' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.54 DESC 'LDAP Syntax 
        Description' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.58 DESC 'Substring Assertion' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.6 DESC 'Bit String' )
ldapsyntaxes=( 1.3.6.1.4.1.1466.115.121.1.7 DESC 'Boolean' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.8 DESC 'Certificate' )
ldapSyntaxes=( 1.3.6.1.4.1.1466.115.121.1.9 DESC 'Certificate List' )
ldapsyntaxes=( IBMAttributeType-desc-syntax-oid DESC 'IBM Attribute 
        Type Description' )

Similarly, to obtain the values for matching rules, specify:

 ldapsearch -h host -b "cn=schema" -s base objectclass=* matchingrules

which returns something like:

cn=schema
     MatchingRules= ( 1.3.6.1.4.1.1466.109.114.3 NAME \
       'caseIgnoreIA5SubstringsMatch' SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )
     MatchingRules= ( 2.5.13.5 NAME 'caseExactMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) 
     MatchingRules= ( 2.5.13.2 NAME 'caseIgnoreMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 
     MatchingRules= ( 2.5.13.7 NAME 'caseExactSubstringsMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )     
     MatchingRules= ( 2.5.13.6 NAME 'caseExactOrderingMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) 
     MatchingRules= ( 2.5.13.4 NAME 'caseIgnoreSubstringsMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.58)     
     MatchingRules= ( 2.5.13.3 NAME 'caseIgnoreOrderingMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
     MatchingRules= ( 1.3.18.0.2.4.405 NAME 'distinguishedNameOrderingMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) 
     MatchingRules= ( 2.5.13.1 NAME 'distinguishedNameMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 ) 
     MatchingRules= ( 2.5.13.28 NAME 'generalizedTimeOrderingMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) 
     MatchingRules= ( 2.5.13.27 NAME 'generalizedTimeMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 ) 
     MatchingRules= ( 1.3.6.1.4.1.1466.109.114.2 NAME 'caseIgnoreIA5Match' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) 
     MatchingRules= ( 1.3.6.1.4.1.1466.109.114.1 NAME 'caseExactIA5Match' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) 
     MatchingRules= ( 2.5.13.29 NAME 'integerFirstComponentMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) 
     MatchingRules= ( 2.5.13.10 NAME 'numericStringSubstringsMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )
     MatchingRules= ( 2.5.13.11 NAME 'caseIgnoreListMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.41 )
     MatchingRules= ( 2.5.13.12 NAME 'caseIgnoreListSubstringsMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )
     MatchingRules= ( 2.5.13.13 NAME 'booleanMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 )
     MatchingRules= ( 2.5.13.14 NAME 'integerMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 ) 
     MatchingRules= ( 2.5.13.15 NAME 'integerOrderingMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
     MatchingRules= ( 2.5.13.16 NAME 'bitStringMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.6 )
     MatchingRules= ( 2.5.13.17 NAME 'octetStringMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.5 ) 
     MatchingRules= ( 2.5.13.18 NAME 'octetStringOrderingMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )     
     MatchingRules= ( 2.5.13.0 NAME 'objectIdentifierMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) 
     MatchingRules= ( 2.5.13.30 NAME 'objectIdentifierFirstComponentMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.38 ) 
     MatchingRules= ( 2.5.13.21 NAME 'telephoneNumberSubstringsMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.58 )     
     MatchingRules= ( 2.5.13.20 NAME 'telephoneNumberMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.50 ) 
     MatchingRules= ( 2.5.13.22 NAME 'presentationAddressMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.43 )
     MatchingRules= ( 2.5.13.23 NAME 'uniqueMemberMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.34 )
     MatchingRules= ( 2.5.13.24 NAME 'protocolInformationMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.42 )
     MatchingRules= ( 2.5.13.25 NAME 'uTCTimeMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.53 ) 
     MatchingRules= ( 2.5.13.8 NAME 'numericStringMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )
     MatchingRules= ( 2.5.13.9 NAME 'numericStringOrderingMatch' \
       SYNTAX 1.3.6.1.4.1.1466.115.121.1.36 )

Dynamic schema changes

To run a dynamic schema change, use LDAP modify with a DN of "cn=schema". It is permissible to add, delete, or replace only one schema entity, for example, an attribute type or an object class, at a time.

To delete a schema entity, you can provide the oid in parentheses:

( oid )

A full description might also be provided. In either case, the matching rule that is used to find the schema entity to delete is objectIdentifierFirstComponentMatch as mandated by the LDAP V3 protocol.

To add or replace a schema entity, you must provide the LDAP V3 definition and you can provide the IBM definition.

In all cases, you must provide only the definitions of the schema entity that you want to affect. For example, to delete the attribute type cn (its OID is 2.5.4.3), call ldap_modify() with:

      LDAPMod  attr;
      LDAPMod *attrs[] = { &attr, NULL };
      char    *vals [] = { "( 2.5.4.3 )", NULL };
      attr.mod_op      = LDAP_MOD_DELETE;
      attr.mod_type    = "attributeTypes";
      attr.mod_values  = vals;
      ldap_modify_s(ldap_session_handle, "cn=schema", attrs);

To add an attribute type foo with OID 20.20.20 which is a NAME of length 20 chars:

      char    *vals1[] = { "( 20.20.20 NAME 'foo' SUP NAME )", NULL };
      char    *vals2[] = { "( 20.20.20 LENGTH 20 )", NULL };
      LDAPMod  attr1;
      LDAPMod  attr2;
      LDAPMod *attrs[] = { &attr1, &attr2, NULL };
      attr1.mod_op = LDAP_MOD_ADD;
      attr1.mod_type = "attributeTypes";
      attr1.mod_values = vals1;
      attr2.mod_op = LDAP_MOD_ADD;
      attr2.mod_type = "IBMattributeTypes";
      attr2.mod_values = vals2;
      ldap_modify_s(ldap_session_handle, "cn=schema", attrs);

To change the object class top so it allows a MAY attribute type called foo. It assumes that the attribute type foo is defined in the schema:

      LDAPMod  attr;
      LDAPMod *attrs[] = { &attr, NULL };
      attr.mod_op = LDAP_MOD_REPLACE;
      attr.mod_type = "objectClasses";
      attr.mod_values = "( 2.5.6.0 NAME 'top' ABSTRACT "
                         "MUST objectClass MAY foo )";
      ldap_modify_s(ldap_session_handle, "cn=schema", attrs);