Hi Folks, At the moment, I'm investigating using pwm to allow user password reset self service.  pwm requires a schema change to add its own attributes.  I'm afraid I've never been clear on what the correct procedure is for make schema changes and I've been unable to find a blurb on this in the RH IdM docs. There seems to be a couple of possible ways of going about this using ldapmodify or dropping ldif files directly under /etc/dirsrv/slapd-<foo>/schema. However, that requires templating the ldif with server specific changes. Seeing as the files under /usr/share/ipa appear to be templated via ipa-ldap-updater and the man page states:        Additionally, ipa-ldap-updater can update the schema based on LDIF files.  Any missing object classes and attribute types are added, and differing ones are updated to  match  the        LDIF  file.   To  enable this behavior, use the --schema-file options.  Schema files should be in LDIF format, and may only specify attributeTypes and objectClasses attributes of        cn=schema. I attempted to template the pwm schema changes as follows: dn: cn=schema objectclass: top objectclass: ldapSubentry objectclass: subschema cn: schema aci: (target="ldap:///cn=schema")(targetattr !="aci")(version 3.0;acl "anonymous, no acis"; allow (read, search, compare) userdn = "ldap:///anyone";) aci: (targetattr="*")(version 3.0; acl "Configuration Administrators Group"; allow (all) groupdn="ldap:///cn=admins,cn=groups,cn=accounts,$SUFFIX";) aci: (targetattr="*")(version 3.0; acl "Configuration Administrator"; allow (all) userdn="ldap:///uid=admin,cn=users,cn=accounts,$SUFFIX";) aci: (targetattr = "*")(version 3.0; acl "SIE Group"; allow (all) groupdn = "ldap:///fqdn=$FQDN,cn=computers,cn=accounts,$SUFFIX";) attributetypes: ( 1.3.6.1.4.1.35015.1.2.1 NAME 'pwmEventLog'  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.2 NAME 'pwmResponseSet'  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.3 NAME 'pwmLastPwdUpdate'  SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.4 NAME 'pwmGUID'  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.4 NAME 'pwmToken'  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.6 NAME 'pwmOtpSecret'  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' ) attributetypes: ( 1.3.6.1.4.1.35015.1.2.7 NAME 'pwmData'  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 X-ORIGIN 'user defined' ) objectclasses: ( 1.3.6.1.4.1.35015.1.1.1 NAME 'pwmUser' DESC '' SUP top AUXILIARY MAY ( pwmEventLog $ pwmResponseSet $ pwmLastPwdUpdate $ pwmGUID $ pwmToken $ pwmOtpSecret $ pwmData ) X-ORIGIN 'user defined' ) However, trying to use `ipa-ldap-updater` in this manner suggested by the manpage fails: # ipa-ldap-updater --schema-file ./99pwm.ldif Unexpected error - see /var/log/ipaupgrade.log for details: IOError: [Errno socket error] [Errno -2] Name or service not known The ipa-ldap-updater command failed. See /var/log/ipaupgrade.log for more information The error message is complaining about the socket... which I've confirmed from the ipaupgrade.log is the correct path to the dirsrv socket (and dirsrv is otherwise functioning). Is this an abuse of, or bug in, ipa-ldap-updater?  Is it possible to simply drop templated ldif files under /usr/share/ipa/ and have them be processed similarly to /usr/share/ipa/updates/? Any guidance would be greatly appreciated. -Josh --