Directory
When deploying a directory, it is possible that not all needs will be met by the schema's deployed with openldap.
For example, Stanford uses a krb5-kdc.schema file for putting in Kerberos attributes for its entries. This schema is not distributed with OpenLDAP.
Stanford also uses custom schemas to create attributes it wants in its entries for internal purposes.
The OpenLDAP Admin guide has information on creating custom schemas.
Basic things to know about schemas:
You will need an OID for your organization, which you can get from IANA. It can take up to 2 weeks. I also suggest reading the OpenLDAP FAQ on OIDs.
There are two basic parts to schemas, attributes and objectclasses.
Attributes can be defined to hold different types of data based on their SYNTAX. You can also specify how they can be indexed and searched on with the EQUALITY, SUBSTR, and ORDERING keywords.
ObjectClasses pull together attributes to define what ones are required ("MUST") in an entry with that objectclass, and which ones are optional ("MAY"). Objectclasses can also be of different types, such as AUXILARY or STRUCTURAL. Objectclasses may also be tied with existing objectclasses via the "SUP" keyword.
It is particularly important to read existing schema's to really develop an undertanding of how they work.
