Anyway, this is the error I get with the attached schema: [abartlet@piglett source]$ sudo /opt/fedora-ds/slapd-piglett/start-slapd Password: [22/Aug/2006:21:03:47 +1000] dse - The entry cn=schema in file /opt/fedora-ds/slapd-piglett/config/schema/01samba4.ldif is invalid, error code 20 (Type or value exists) - attribute type streetAddress: Does not match the OID "1.2.840.113556.1.2.256". Another attribute type is already using the name or OID. [22/Aug/2006:21:03:47 +1000] dse - Please edit the file to correct the reported problems and then restart the server. I can find no other reference (in the schema ldif files) to streetAddress, or that OID.

Kimmo Koivisto wrote: >Andrew Bartlett wrote: >[snip] > > >>Anyway, this is the error I get with the attached schema: >> >>[abartlet@piglett source]$ sudo /opt/fedora-ds/slapd-piglett/start-slapd >>Password: >>[22/Aug/2006:21:03:47 +1000] dse - The entry cn=schema in >>file /opt/fedora-ds/slapd-piglett/config/schema/01samba4.ldif is >>invalid, error code 20 (Type or value exists) - attribute type >>streetAddress: Does not match the OID "1.2.840.113556.1.2.256". Another >>attribute type is already using the name or OID. >>[22/Aug/2006:21:03:47 +1000] dse - Please edit the file to correct the >>reported problems and then restart the server. >> >>I can find no other reference (in the schema ldif files) to >>streetAddress, or that OID. >> >> >> >See 00core.ldif: >attributeTypes: ( 2.5.4.9 NAME ( 'street' 'streetaddress' ) DESC 'Standard >LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC >2256' ) > >Maybe this is what you wan't to remove? > > It would be bad form to remove a standard attribute and replace it with one of the same name but different OID. It would be better to use the standard attribute.

Andrew Bartlett wrote: > On Tue, 2006-08-22 at 10:03 -0700, Pete Rowley wrote: > >> Kimmo Koivisto wrote: >> >> >>> Andrew Bartlett wrote: >>> [snip] >>> >>> >>> >>>> Anyway, this is the error I get with the attached schema: >>>> >>>> [abartlet@piglett source]$ sudo /opt/fedora-ds/slapd-piglett/start-slapd >>>> Password: >>>> [22/Aug/2006:21:03:47 +1000] dse - The entry cn=schema in >>>> file /opt/fedora-ds/slapd-piglett/config/schema/01samba4.ldif is >>>> invalid, error code 20 (Type or value exists) - attribute type >>>> streetAddress: Does not match the OID "1.2.840.113556.1.2.256". Another >>>> attribute type is already using the name or OID. >>>> [22/Aug/2006:21:03:47 +1000] dse - Please edit the file to correct the >>>> reported problems and then restart the server. >>>> >>>> I can find no other reference (in the schema ldif files) to >>>> streetAddress, or that OID. >>>> >>>> >>>> >>>> >>> See 00core.ldif: >>> attributeTypes: ( 2.5.4.9 NAME ( 'street' 'streetaddress' ) DESC 'Standard >>> LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC >>> 2256' ) >>> >>> Maybe this is what you wan't to remove? >>> >>> >>> >> It would be bad form to remove a standard attribute and replace it with >> one of the same name but different OID. It would be better to use the >> standard attribute. >> > > What would go wrong if I did that? > The server might not start, apps might break.

> When I started with OpenLDAP, I initially tried to load standard schema, > then Microsoft's modifications, but very quickly got into a mess: > Because I wanted a reproducible solution, I didn't want to edit these > schema files, but they declared objectClasses that I had to override. > > So I ended up just using the converted AD schema. > > Would it be possible to split the 00core.ldif into 'attributes required > for the operation of the directory' and 'core ldap standards'? Yes. Something like internally used attributes vs. externally used attributes?

> What > will happen if I fail to load the 'attributes required for operation of > the directory'? > Things may break. It's hard to tell without specific attributes or objectclass names or OIDs.

Andrew Bartlett wrote: >On Tue, 2006-08-22 at 16:06 -0600, Richard Megginson wrote: > > >>Andrew Bartlett wrote: >> >> >>>On Tue, 2006-08-22 at 10:03 -0700, Pete Rowley wrote: >>> >>> >>> >>>>Kimmo Koivisto wrote: >>>> >>>> >>>> >>>> >>>>>Andrew Bartlett wrote: >>>>>[snip] >>>>> >>>>> >>>>> >>>>> >>>>> >>>>>>Anyway, this is the error I get with the attached schema: >>>>>> >>>>>>[abartlet@piglett source]$ sudo /opt/fedora-ds/slapd-piglett/start-slapd >>>>>>Password: >>>>>>[22/Aug/2006:21:03:47 +1000] dse - The entry cn=schema in >>>>>>file /opt/fedora-ds/slapd-piglett/config/schema/01samba4.ldif is >>>>>>invalid, error code 20 (Type or value exists) - attribute type >>>>>>streetAddress: Does not match the OID "1.2.840.113556.1.2.256". Another >>>>>>attribute type is already using the name or OID. >>>>>>[22/Aug/2006:21:03:47 +1000] dse - Please edit the file to correct the >>>>>>reported problems and then restart the server. >>>>>> >>>>>>I can find no other reference (in the schema ldif files) to >>>>>>streetAddress, or that OID. >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>See 00core.ldif: >>>>>attributeTypes: ( 2.5.4.9 NAME ( 'street' 'streetaddress' ) DESC 'Standard >>>>>LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC >>>>>2256' ) >>>>> >>>>>Maybe this is what you wan't to remove? >>>>> >>>>> >>>>> >>>>> >>>>> >>>>It would be bad form to remove a standard attribute and replace it with >>>>one of the same name but different OID. It would be better to use the >>>>standard attribute. >>>> >>>> >>>> >>>What would go wrong if I did that? >>> >>> >>> >>The server might not start, apps might break. >> >> > >Do apps read the OID? I thought they just query by name. (The syntax is >identical in this case). > > > Typically a careful client would request attributes by OID, change the OID and you break the good apps.

>I was kind of hoping someone might be able to give me that list, so I >can split the 00core.ldif. Once I know that list, I can place them into >my excludes file, and not have the AD schema replace them. > > Why not deal with the specific problems that arise when /adding/ the AD schema? I'm guessing that would be a shorter list?

Andrew Bartlett wrote: On Tue, 2006-08-22 at 15:35 -0700, Pete Rowley wrote: >>Why not deal with the specific problems that arise when /adding/ the AD >> >> >>schema? I'm guessing that would be a shorter list? >> >> > >Because the AD schema is a whole schema, not just some extra >attributes/objectClasses, I need to be able to replace 'person', and >many other classes that Microsoft has modified. > >Once I start replacing classes, I need to know the list of 'if I replace >this, bad things happen'. > > The problem is the list of broken things is open ended. Perhaps we should drill down on a specific example (like the "person" objectclass and associated attributes) and look at what is different. At least that will make sure we are all talking about the same thing and the folks on the list might have more targetted suggestions. Though, I thought the plan was to make the DS look like AD through Sambas lens? Are we just talking about an interim development situation until you add the "lens"? If so, I say break what you like. Otherwise I would have big concerns about integration with existing DS deployments.

Andrew Bartlett wrote: >On Tue, 2006-08-22 at 10:03 -0700, Pete Rowley wrote: > >When I started with OpenLDAP, I initially tried to load standard schema, >then Microsoft's modifications, but very quickly got into a mess: >Because I wanted a reproducible solution, I didn't want to edit these >schema files, but they declared objectClasses that I had to override. > > I do understand your pain. The MS schema that is derived from the standards is actually not compliant to them - MS made some modifications.

>So I ended up just using the converted AD schema. > > This is OK to get by for now, but I would strongly suggest an approach that is more accomodating to the standards and also existing deployments - few major deployers will want to change the standard schema.

>Would it be possible to split the 00core.ldif into 'attributes required >for the operation of the directory' and 'core ldap standards'? > Sure, all of the schema files are just split as a matter of convenience and managability. > What >will happen if I fail to load the 'attributes required for operation of >the directory'? > > The directory won't operate? :)

Andrew Bartlett wrote: [snip] > Anyway, this is the error I get with the attached schema: > > [abartlet@piglett source]$ sudo /opt/fedora-ds/slapd-piglett/start-slapd > Password: > [22/Aug/2006:21:03:47 +1000] dse - The entry cn=schema in > file /opt/fedora-ds/slapd-piglett/config/schema/01samba4.ldif is > invalid, error code 20 (Type or value exists) - attribute type > streetAddress: Does not match the OID "1.2.840.113556.1.2.256". Another > attribute type is already using the name or OID. > [22/Aug/2006:21:03:47 +1000] dse - Please edit the file to correct the > reported problems and then restart the server. > > I can find no other reference (in the schema ldif files) to > streetAddress, or that OID. > See 00core.ldif: attributeTypes: ( 2.5.4.9 NAME ( 'street' 'streetaddress' ) DESC 'Standard LDAP attribute type' SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 X-ORIGIN 'RFC 2256' ) Maybe this is what you wan't to remove?