I recently setup centralized authentication system using OpenLDAP. Now I need to extend the users that are defined in the database to include a new object class that contains some security related data about them. How can I modify the existing entries to add this new object class? I'm pretty new to LDAP so don't bite my head off if I managed to ask a stupid question :P Thanks!


You can run ldapmodify to modify one or more entries, you just need to feed to the program the credentials and a file containing all the changes you want to do

As an example (taken straight from openldap manual), if your file contains this it'll add/modify all those fields

dn: uid=john.doe,ou=People,dc=example,dc=com
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
uid: john.doe
givenName: John
sn: Doe
cn: John Doe
mail: john.doe@example.com
userPassword: password
| improve this answer | |
  • Thanks it worked like a charm, after I figured out how to defined the adding operation, of course (it differs for adding an attribute). It goes like this (perhaps somebody has a use for it also): dn: uid=john.doe,ou=People,dc=example,dc=com changetype: add add: objectClass objectClass: person -- snip -- – crazybyte Jan 22 '11 at 22:00

Here is an example LDIF file to add the objectClass posixAccount to an existing entry uid=testuser,ou=people,dc=example,dc=com of e.g. objectClass inetOrgPerson:

dn: uid=testuser,ou=people,dc=example,dc=com
changetype: modify
add: objectClass
objectClass: posixAccount
add: homeDirectory
homeDirectory: /home/testuser
add: uidNumber
uidNumber: 1000
add: gidNumber
gidNumber: 1000

The - are important to separate the add blocks. One has to make sure that all necessary attributes (for posixAccount homeDirectory, uidNumber, gidNumber) are added in the same file.

The LDIF file can be added e.g. with

ldapmodify -x -D 'cn=root,dc=example,dc=com' -W -f filename.ldif
| improve this answer | |

OpenLdap Schema and ObjectClass are easy to extend. Look inside bundled schema if there is the object of your needs (located, on a debian filesystem is /etc/ldap/schema)

After you can modify your ldap entities and attached to them new objectClass (and, by extension, new attribute types).

If you want to build your own attribute type and/or your own objectClass you need to request an OID object number (OID Registration).

Then follow this schema :

objectIdentifier YOUR_OID <IANA NUMBER>

Then define your attribute type:

attributetype( YOUR_ATTRIBUTETYPE:1 NAME "your attribute name"
    DESC "quick description"
    EQUALITY typoofequality
    SYNTAX valid syntax

And your object class:

objectclass(YOUR_OBJECTCLASSS:1 NAME "your objectclass name"
    DESC "quick description"
    SUP top #or another objectclass inheritence
    MUST (list of must attributes, separated by "$")
    MAY (list of may attributes, separated by "$") )

The number following the YOUR_ATTRIBUTETYPE/YOUR_OBJECTCLASS must be unique (ie : one number for each attribute)

For reference, have a look at Open LDAP Schema Specification

| improve this answer | |
  • The issue was that I didn't know how to attach/add a new objectClass to an already existing entry/entries. – crazybyte Jan 22 '11 at 21:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.