Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to change core schema (cn={0}core,cn=schema,cn=config)? In lpadmodify im getting Insufficient access (50) though i'm using olcRootDn from olcDatabase={0}config. Apache DS just went timeout. And i believe changing the LDAP entry cn={0}core,cn=schema,cn=config from Apache DS will break openldap service at all.

Can anyone please point out to some decent tutorial (as detailed as possible as im new to LDAP and linux as well) if it is possible to change the default schema at all.

What i want is to add attribute type and change several object classes to include uniqueidentifier as MAY attribute.

Say include uniqueidentifier attribute to organization, device, posixAccount object classes. Create attribute hwNumber.


ok, now i can change it with ldapmodify. my ldif:

dn: cn={0}core,cn=schema,cn=config
changetype: modify
add: olcAttributeTypes
olcAttributeTypes: {52}( NAME 'roleMember' DESC 'Reference' SUP uniqueidentifier)

And i can see attribute is created, and can add attribute to entity.

But when i restart the server, slapd fail to start.

share|improve this question
up vote 1 down vote accepted

Do not change the core schema. As the name implies, it's the core of the LDAP implementation. If you need more or changed attributes, create a local schema instead.

share|improve this answer
Yep, already did, thanks – Felix Jun 27 '13 at 22:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.