Following up on my own post: It turns out that I can add attributes like uidNumber/gidNumber/homeDirectory/loginShell anyway, WITHOUT adding the posixAccount objectclass! Apparently those attribs are already implied by the existing objectclass hierarchy? Is this how it it supposed to work? Not that I am complaining :-)