Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We wish to store some data in 389 Directory Server LDAP that doesn't fit that well into the standard set of schema's that come with the product. Nothing too amazing, things like:

  • when the customer joined
  • are they currently active
  • customer certificate[1]
  • which environment they are using

My question is this: should we register with OID and start writing up our own custom schema OR is there a standard schema definition not provided by Directory Server that we can download and use that would fit our needs? Should we munge/hack existing attributes and store the data among there (I'm strongly opposed to this, but would be interested in arguments about why its better than extending)?

[1] I know there is a field for this userCertificate but we don't want to use it to authenticate the user for the purposes of binding

Using CentOS 5.5 with 389 Directory Server 8.1

share|improve this question
up vote 2 down vote accepted

Unless there are existing ObjectClasses that have the attributes you want you need to extend your LDAP server's schema to support these new attributes in a sane way (preferable to munging/recycling existing attributes for new purposes, and more flexible).
If there are already ObjectClasses that meet your requirements it's better to make your entities members of all the ObjectClasses they need to be in to have the attributes you require.

If you are creating new fields/objects and your organization does not already have one you will need to register an Private Enterprise Number ( to put your LDAP OIDs under.

See your LDAP server's documentation for more information on extending the schema (For 389 Directory Server, the Deployment guide, section 3.4 is a good starting place).

share|improve this answer
Thanks. This is what I thought but I just thought I would check with the community, much appreciated. We have applied for a PEN. – hellomynameisjoel Feb 11 '11 at 1:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.