[Samba] Properly extending the AD schema

Péter Bertalan Zoltán bp99 at novin.hu
Sat Oct 24 11:36:45 UTC 2020


I’ve been having a lot of trouble extending the schema on our DC. After
a few failed attempts and a few hours of researching the issue, I
decided to seek help here.

For context, I am trying to extend the schema to add a custom attribute
to the Person class that would contain an IMAP login name. It didn’t
seem reasonable to use any of the existing attributes of this class for
this purpose without resorting to something like deciding to use an
arbitrary, unused attribute (such as Comment or Description) to store
this information, which didn’t really sound like a nice solution.

I know that a wiki article exists on the matter:

However, as my first attempt, I tried to extend the schema using the
schema editor in Windows. I managed to successfully create the new
attribute and a new auxiliary class, and indeed, I can see the new
record using ldbsearch:

$ ldbsearch -H /var/lib/samba/private/sam.ldb.d/CN=SCHEMA,CN=CONFIGURATION,DC=INTRANET,DC=MYCOMPANY,DC=COM.ldb ldapDisplayName=mycompanyIMAPLogin

# record 1                                                                                                                                                                                                                             [0/1835]
dn: CN=MyCompany IMAP login name,CN=Schema,CN=Configuration,DC=mycompany,DC=com
adminDescription: A custom schema extension attribute for storing a main IMAP login name
attributeID: 1.2.840.113556.1.8000.2554.30464.42699.19105.17520.37546.2225255.
cn: MyCompany IMAP login name
instanceType: 4
isSingleValued: TRUE
lDAPDisplayName: mycompanyIMAPLogin
msDS-IntId: -1082814050
name: MyCompany IMAP login name
nTSecurityDescriptor: O:S-1-5-21-1186615669-3056255755-2150624875-518G:S-1-5-2
objectCategory: <GUID=448e6129-6385-4b9b-b397-cb5de4bfed4c>;CN=Attribute-Schem
objectClass: top
objectClass: attributeSchema
objectGUID: 6aa7cd26-6bf4-436f-84c4-3ede4e903f6e
oMSyntax: 64
schemaIDGUID: e9c2f500-52ef-4816-b05f-6308d84e2461
uSNCreated: 94188
whenCreated: 20201004095810.0Z
showInAdvancedViewOnly: FALSE
adminDisplayName: mycompanyIMAPLogin
rangeUpper: 1123
rangeLower: 1
whenChanged: 20201013144324.0Z
uSNChanged: 95461
distinguishedName: CN=MyCompany IMAP login name,CN=Schema,CN=Configuration,DC=mycompany,DC=com

At first, I tried adding this attribute directly to the Person class’s
attributes, but later realized that it is probably better to use an
auxiliary class.

However, the *new attribute does not show in Windows’s* users and
computers MMC builtin when viewing the attributes of a person instance.
Thus I cannot set a value for the attribute.

I suppose Samba is not 100% compatible with what Windows does when I
modify the schema like this. Nevertheless I could manually add the
attribute to some objects using ldbedit and also managed to get these
values externally over LDAP (with SOGo, which is why I am trying to add
the attrib in the first place, btw).

It does not seem like a clean solution to just manually set the
attribute in the DB though.


I thought that _maybe_ the problem was that the attribute’s CN contained
space characters, since none of the existing/built-in ones do. I created
a test attribute the same way, but no dice. Still can’t see it when
editing a Person.

As a second attempt, I followed the wiki guide and created two LDIF
files using the template:

dn: CN=mycompanyTestAttribAAAB,CN=Schema,CN=Configuration,DC=mycompany,DC=com
objectClass: attributeSchema
attributeID: 1.2.840.113556.1.8000.2554.30464.42699.19105.17520.37546.2225255.13225547.2.3
lDAPDisplayName: mycompanyTestAttribAAAB
description: Test Attribute AAAB
isSingleValued: TRUE

dn: CN=mycompanyTestClassAAAB,CN=Schema,CN=Configuration,DC=intranet,DC=mycompany,DC=com
objectClass: classSchema
governsID: 1.2.840.113556.1.8000.2554.30464.42699.19105.17520.37546.2225255.13225547.1.3
lDAPDisplayName: mycompanyTestClassAAAB
subClassOf: top
objectClassCategory: 3
description: Test Class AAAB
mayContain: mycompanyTestAttrAAAB

I imported the LDIFs:

$ ldbadd -H /var/lib/samba/private/sam.ldb.d/CN=SCHEMA,CN=CONFIGURATION,DC=MYCOMPANY,DC=COM.ldb mycompanyTestClassAAAB.ldif --option="dsdb:schema update allowed"=true
$ ldbadd -H /var/lib/samba/private/sam.ldb.d/CN=SCHEMA,CN=CONFIGURATION,DC=MYCOMPANY,DC=COM.ldb mycompanyTestClassAAAB.ldif --option="dsdb:schema update allowed"=true

Then decided to restart the samba-ad-dc service, which ended up breaking
everything, as samba would not start any more. I guess this is due to
the schema validation performed at startup mentioned in the wiki

This is what I saw when starting samba manually with `samba -i`:

db_schema_from_db() failed: 1:Operations error: dsdb_schema: failed to search attributeSchema and classSchema [...]

Luckily, I have made an offline backup of the dbs by archiving
/var/lib/samba/ and was able to restore everything.

Could somebody please give me some pointers where this could be going

Thank you for your help in advance!

Best regards

More information about the samba mailing list