Extending Samba 4 schema for OSX GPO support

Aubrey Ekstrom aekstrom at proclivitysystems.com
Tue Nov 23 13:46:22 MST 2010


Hi Karmen,

Thanks! That worked perfectly for all 36 attributes and they were all added and I see them in the schema :)... but it still failed for the 10 classes and 3 modifies for the Apple classes 8(...

When I paste this into the import page of phpLDAPadmin:


# ==================================================================
#  Classes
# ==================================================================

# Class: apple-computer
dn: CN=apple-computer,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.10
ldapDisplayName: apple-computer
adminDescription: computer
objectClassCategory: 3
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: apple-category
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.10.4
# mayContain: apple-computer-list-groups
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.11.4
# mayContain: apple-keyword
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.19
# mayContain: apple-mcxflags
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.10
# mayContain: apple-mcxsettings
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.16
# mayContain: apple-networkview
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.10.3
# mayContain: apple-service-url
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.19.2
# mayContain: apple-xmlplist
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.17.1
# mayContain: macAddress
mayContain: 1.3.6.1.1.1.1.22
# mayContain: ttl
mayContain: 1.3.6.1.4.1.250.1.60

# Class: apple-computer-list
dn: CN=apple-computer-list,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.11
ldapDisplayName: apple-computer-list
adminDescription: computer list
objectClassCategory: 1
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: apple-computer-list-groups
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.11.4
# mayContain: apple-computers
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.11.3
# mayContain: apple-keyword
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.19
# mayContain: apple-mcxflags
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.10
# mayContain: apple-mcxsettings
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.16
possSuperiors: organizationalUnit
possSuperiors: container

# Class: apple-configuration
dn: CN=apple-configuration,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.12
ldapDisplayName: apple-configuration
adminDescription: configuration
objectClassCategory: 1
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: apple-data-stamp
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.12.2
# mayContain: apple-keyword
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.19
# mayContain: apple-xmlplist
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.17.1
# mayContain: ttl
mayContain: 1.3.6.1.4.1.250.1.60
possSuperiors: organizationalUnit
possSuperiors: container

# Class: apple-group
dn: CN=apple-group,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.14
ldapDisplayName: apple-group
adminDescription: group account
objectClassCategory: 3
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: apple-group-homeowner
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.14.2
# mayContain: apple-group-homeurl
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.14.1
# mayContain: apple-keyword
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.19
# mayContain: apple-mcxflags
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.10
# mayContain: apple-mcxsettings
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.16
# mayContain: apple-user-picture
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.12
# mayContain: ttl
mayContain: 1.3.6.1.4.1.250.1.60

# Class: apple-location
dn: CN=apple-location,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.18
ldapDisplayName: apple-location
objectClassCategory: 1
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: apple-dns-domain
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.18.1
# mayContain: apple-dns-nameserver
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.18.2
possSuperiors: organizationalUnit
possSuperiors: container

# Class: apple-neighborhood
dn: CN=apple-neighborhood,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.20
ldapDisplayName: apple-neighborhood
objectClassCategory: 1
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: apple-category
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.10.4
# mayContain: apple-computeralias
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.20.3
# mayContain: apple-keyword
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.19
# mayContain: apple-neighborhoodalias
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.20.2
# mayContain: apple-nodepathxml
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.20.1
# mayContain: apple-xmlplist
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.17.1
# mayContain: ttl
mayContain: 1.3.6.1.4.1.250.1.60
possSuperiors: organizationalUnit
possSuperiors: container

# Class: apple-serverassistant-config
dn: CN=apple-serverassistant-config,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.17
ldapDisplayName: apple-serverassistant-config
objectClassCategory: 1
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: apple-xmlplist
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.17.1
possSuperiors: organizationalUnit
possSuperiors: container

# Class: apple-service
dn: CN=apple-service,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.19
ldapDisplayName: apple-service
objectClassCategory: 1
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mustContain: apple-service-type
mustContain: 1.3.6.1.4.1.63.1000.1.1.1.19.1
# mayContain: apple-dnsname
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.19.4
# mayContain: apple-keyword
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.19
# mayContain: apple-service-location
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.19.5
# mayContain: apple-service-port
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.19.3
# mayContain: apple-service-url
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.19.2
# mayContain: ipHostNumber
mayContain: 1.3.6.1.1.1.1.19
possSuperiors: organizationalUnit
possSuperiors: container

# Class: apple-user
dn: CN=apple-user,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.1
ldapDisplayName: apple-user
adminDescription: apple user account
objectClassCategory: 3
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: apple-imhandle
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.21
# mayContain: apple-keyword
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.19
# mayContain: apple-mcxflags
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.10
# mayContain: apple-mcxsettings
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.16
# mayContain: apple-user-authenticationhint
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.15
# mayContain: apple-user-class
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.7
# mayContain: apple-user-homequota
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.8
# mayContain: apple-user-homesoftquota
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.17
# mayContain: apple-user-mailattribute
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.9
# mayContain: apple-user-picture
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.12
# mayContain: apple-user-printattribute
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.13
# mayContain: apple-webloguri
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.1.22

# Class: mount
dn: CN=apple-mount,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: add
objectClass: classSchema
governsID: 1.3.6.1.4.1.63.1000.1.1.2.8
ldapDisplayName: mount
objectClassCategory: 1
# subclassOf: top
subclassOf: 2.5.6.0
# rdnAttId: cn
rdnAttId: 2.5.4.3
# mayContain: mountDirectory
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.8.1
# mayContain: mountDumpFrequency
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.8.4
# mayContain: mountOption
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.8.3
# mayContain: mountPassNo
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.8.5
# mayContain: mountType
mayContain: 1.3.6.1.4.1.63.1000.1.1.1.8.2
possSuperiors: organizationalUnit
possSuperiors: container

dn: 
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

# Add the new class to the user object
dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: modify
add: auxiliaryClass
auxiliaryClass: apple-user
-

# Add the new class to the computer object
dn: CN=Computer,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
changetype: modify
add: auxiliaryClass
auxiliaryClass: apple-computer
-

# Add the new class to the group object
dn: CN=Group,CN=Schema,CN=Configuration,DC=corp,DC=xxx
changetype: modify
add: auxiliaryClass
auxiliaryClass: apple-group
-

# ==================================================================
#  Updating present elements
# ==================================================================


I get these errors for all 10 classes:

Adding... CN=apple-computer,CN=Schema,CN=Configuration,DC=corp,DC=core Failed
Error code: 21
Description: Invalid syntax

and when I click for more details:

Error
No such entry: CN=apple-computer,CN=Schema,CN=Configuration,DC=corp,DC=core

And this on the modify entries at the end:

LDAP said: Invalid syntax
Error number: 0x15 (LDAP_INVALID_SYNTAX)
Description: An invalid attribute value was specified.

But no specific invalid attribute is mentioned... only the generic error. If you or anyone has any thoughts it is greatly appreciated. All these entries are the one that Apple says you need to import into MS A/D for managing Macs via GPO, and formatted exactly as Apple recommends. It would be great to get this working with Samba 4. I know your priority is to make the Microsoft users happy first, but Apple is definitely making in-roads into Windows dominated corporate networks, and all those administrators would be thrilled to be able to manage their Macs with GPO. Extending MS A/D schema is often something Windows admins don't want to do, but having the option to extend a Samba 4 A/D schema that works in their Windows A/D environment would be a big score for everyone :).

Thanks again for the help!

Cheers,

Aubrey Ekstrom | Systems Administrator | Proclivity Systems
22 West 19th St., Ninth Floor, New York, NY 10011 | 646-237-3727
http://www.proclivitysystems.com 


This message is the property of Proclivity Systems, Inc. and is intended
only for the use of the addressee(s), and may contain material that is
confidential and privileged for the sole use of the intended recipient.  If
you are not the intended recipient, reliance or forwarding without express
permission is strictly prohibited; please contact the sender and delete all
copies.

----- Original Message -----
From: "Kamen Mazdrashki" <kamenim at samba.org>
To: "Aubrey Ekstrom" <aekstrom at proclivitysystems.com>
Cc: samba-technical at lists.samba.org
Sent: Tuesday, November 23, 2010 2:56:50 PM
Subject: Re: Extending Samba 4 schema for OSX GPO support

Hi Aubrey,

On Tue, Nov 23, 2010 at 20:11, Aubrey Ekstrom
<aekstrom at proclivitysystems.com> wrote:
> Hi Mat,
>
> Thanks for the reply.
>
> Attached is the .ldif file, which when I import it through phpLDAPadmin I get no errors, but no schema is added either. I also tried pasting single entries like this:
>
> dn: CN=apple-category,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
> changetype: ntdsschemaadd
You should use 'changetype: add' as we don't support 'ntdsschemaadd'

> objectClass: attributeSchema
> attributeId: 1.3.6.1.4.1.63.1000.1.1.1.10.4
> ldapDisplayName: apple-category
'ldapDisplayName: appleCategory' is more ldapDisplayName-ish too :)

> attributeSyntax: 2.5.5.12
> adminDescription: Category for the computer or neighborhood
> oMSyntax: 64
> systemOnly: FALSE
>
> That is where phpLDAPadmin gives the error:
>
> LDIF text import
> Could not add object: CN=apple-category,CN=Schema,CN=Configuration,DC=xxx,DC=xxx
> LDAP said: LDAP_NO_SUCH_ATTRIBUTE
> That entry does not contain the attribute specified.
>


-- 
CU,
Kamen Mazdrashki
Samba Team                                            http://samba.org
http://gitweb.samba.org/?p=kamenim/samba.git;a=summary
---------
This message is the property of Proclivity Systems, Inc. and is intended
only for the use of the addressee(s), and may contain material that is
confidential and privileged for the sole use of the intended recipient.
If you are not the intended recipient, reliance or forwarding without
express permission is strictly prohibited; please contact the sender and
delete all copies.



More information about the samba-technical mailing list