2 ## schema file for OpenLDAP 2.0.x
3 ## Schema for storing Samba's smbpasswd file in LDAP
4 ## OIDs are owned by the Samba Team
6 ## Prerequisite schemas - uid (cosine.schema)
7 ## - displayName (inetorgperson.schema)
9 ## 1.3.6.1.4.1.7165.2.1.x - attributetypes
10 ## 1.3.6.1.4.1.7165.2.2.x - objectclasses
13 ########################################################################
15 ########################################################################
20 #attributetype ( 1.3.6.1.4.1.7165.2.1.1 NAME 'lmPassword'
21 # DESC 'LanManager Passwd'
22 # EQUALITY caseIgnoreIA5Match
23 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
25 #attributetype ( 1.3.6.1.4.1.7165.2.1.2 NAME 'ntPassword'
27 # EQUALITY caseIgnoreIA5Match
28 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
31 ## Account flags in string format ([UWDX ])
33 #attributetype ( 1.3.6.1.4.1.7165.2.1.4 NAME 'acctFlags'
34 # DESC 'Account Flags'
35 # EQUALITY caseIgnoreIA5Match
36 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE )
39 ## Password timestamps & policies
41 #attributetype ( 1.3.6.1.4.1.7165.2.1.3 NAME 'pwdLastSet'
42 # DESC 'NT pwdLastSet'
43 # EQUALITY integerMatch
44 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
46 #attributetype ( 1.3.6.1.4.1.7165.2.1.5 NAME 'logonTime'
48 # EQUALITY integerMatch
49 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
51 #attributetype ( 1.3.6.1.4.1.7165.2.1.6 NAME 'logoffTime'
52 # DESC 'NT logoffTime'
53 # EQUALITY integerMatch
54 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
56 #attributetype ( 1.3.6.1.4.1.7165.2.1.7 NAME 'kickoffTime'
57 # DESC 'NT kickoffTime'
58 # EQUALITY integerMatch
59 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
61 #attributetype ( 1.3.6.1.4.1.7165.2.1.8 NAME 'pwdCanChange'
62 # DESC 'NT pwdCanChange'
63 # EQUALITY integerMatch
64 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
66 #attributetype ( 1.3.6.1.4.1.7165.2.1.9 NAME 'pwdMustChange'
67 # DESC 'NT pwdMustChange'
68 # EQUALITY integerMatch
69 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
74 #attributetype ( 1.3.6.1.4.1.7165.2.1.10 NAME 'homeDrive'
76 # EQUALITY caseIgnoreIA5Match
77 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
79 #attributetype ( 1.3.6.1.4.1.7165.2.1.11 NAME 'scriptPath'
80 # DESC 'NT scriptPath'
81 # EQUALITY caseIgnoreIA5Match
82 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE )
84 #attributetype ( 1.3.6.1.4.1.7165.2.1.12 NAME 'profilePath'
85 # DESC 'NT profilePath'
86 # EQUALITY caseIgnoreIA5Match
87 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE )
89 #attributetype ( 1.3.6.1.4.1.7165.2.1.13 NAME 'userWorkstations'
90 # DESC 'userWorkstations'
91 # EQUALITY caseIgnoreIA5Match
92 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE )
94 #attributetype ( 1.3.6.1.4.1.7165.2.1.17 NAME 'smbHome'
96 # EQUALITY caseIgnoreIA5Match
97 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )
99 #attributetype ( 1.3.6.1.4.1.7165.2.1.18 NAME 'domain'
100 # DESC 'Windows NT domain to which the user belongs'
101 # EQUALITY caseIgnoreIA5Match
102 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )
105 ## user and group RID
107 #attributetype ( 1.3.6.1.4.1.7165.2.1.14 NAME 'rid'
109 # EQUALITY integerMatch
110 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
112 #attributetype ( 1.3.6.1.4.1.7165.2.1.15 NAME 'primaryGroupID'
113 # DESC 'NT Group RID'
114 # EQUALITY integerMatch
115 # SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
118 ## The smbPasswordEntry objectclass has been depreciated in favor of the
119 ## sambaAccount objectclass
121 #objectclass ( 1.3.6.1.4.1.7165.2.2.1 NAME 'smbPasswordEntry' SUP top AUXILIARY
122 # DESC 'Samba smbpasswd entry'
123 # MUST ( uid $ uidNumber )
124 # MAY ( lmPassword $ ntPassword $ pwdLastSet $ acctFlags ))
126 #objectclass ( 1.3.6.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL
127 # DESC 'Samba Account'
129 # MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
130 # logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
131 # displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
132 # description $ userWorkstations $ primaryGroupID $ domain ))
134 #objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY
135 # DESC 'Samba Auxilary Account'
137 # MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $
138 # logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $
139 # displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $
140 # description $ userWorkstations $ primaryGroupID $ domain ))
142 ########################################################################
143 ## END OF HISTORICAL ##
144 ########################################################################
146 #######################################################################
147 ## Attributes used by Samba 3.0 schema ##
148 #######################################################################
153 attributetype ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword'
154 DESC 'LanManager Password'
155 EQUALITY caseIgnoreIA5Match
156 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
158 attributetype ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword'
159 DESC 'MD4 hash of the unicode password'
160 EQUALITY caseIgnoreIA5Match
161 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE )
164 ## Account flags in string format ([UWDX ])
166 attributetype ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags'
168 EQUALITY caseIgnoreIA5Match
169 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE )
172 ## Password timestamps & policies
174 attributetype ( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet'
175 DESC 'Timestamp of the last password update'
176 EQUALITY integerMatch
177 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
179 attributetype ( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange'
180 DESC 'Timestamp of when the user is allowed to update the password'
181 EQUALITY integerMatch
182 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
184 attributetype ( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange'
185 DESC 'Timestamp of when the password will expire'
186 EQUALITY integerMatch
187 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
189 attributetype ( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime'
190 DESC 'Timestamp of last logon'
191 EQUALITY integerMatch
192 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
194 attributetype ( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime'
195 DESC 'Timestamp of last logoff'
196 EQUALITY integerMatch
197 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
199 attributetype ( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime'
200 DESC 'Timestamp of when the user will be logged off automatically'
201 EQUALITY integerMatch
202 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
208 attributetype ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive'
209 DESC 'Driver letter of home directory mapping'
210 EQUALITY caseIgnoreIA5Match
211 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE )
213 attributetype ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript'
214 DESC 'Logon script path'
215 EQUALITY caseIgnoreMatch
216 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
218 attributetype ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath'
219 DESC 'Roaming profile path'
220 EQUALITY caseIgnoreMatch
221 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
223 attributetype ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations'
224 DESC 'List of user workstations the user is allowed to logon to'
225 EQUALITY caseIgnoreMatch
226 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE )
228 attributetype ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath'
229 DESC 'Home directory UNC path'
230 EQUALITY caseIgnoreMatch
231 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
233 attributetype ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName'
234 DESC 'Windows NT domain to which the user belongs'
235 EQUALITY caseIgnoreMatch
236 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} )
242 attributetype ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID'
244 EQUALITY caseIgnoreIA5Match
245 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
249 ## Primary group SID, compatible with ntSid
252 attributetype ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID'
253 DESC 'Primary Group Security ID'
254 EQUALITY caseIgnoreIA5Match
255 SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE )
258 ## group mapping attributes
260 attributetype ( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType'
262 EQUALITY integerMatch
263 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
266 ## Store info on the domain
269 attributetype ( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid'
270 DESC 'Next NT rid to give our for users'
271 EQUALITY integerMatch
272 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
274 attributetype ( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid'
275 DESC 'Next NT rid to give out for groups'
276 EQUALITY integerMatch
277 SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
280 #######################################################################
281 ## objectClasses used by Samba 3.0 schema ##
282 #######################################################################
284 ## The X.500 data model (and therefore LDAPv3) says that each entry can
285 ## only have one structural objectclass. OpenLDAP 2.0 does not enforce
286 ## this currently but will in v2.1
289 ## added new objectclass (and OID) for 3.0 to help us deal with backwards
290 ## compatibility with 2.2 installations (e.g. ldapsam_compat) --jerry
292 objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY
293 DESC 'Samba 3.0 Auxilary SAM Account'
294 MUST ( uid $ sambaSID )
295 MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $
296 sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $
297 sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $
298 displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $
299 sambaProfilePath $ description $ sambaUserWorkstations $
300 sambaPrimaryGroupSID $ sambaDomainName ))
303 ## Group mapping info
305 objectclass ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' SUP top AUXILIARY
306 DESC 'Samba Group Mapping'
307 MUST ( gidNumber $ sambaSID $ sambaGroupType )
308 MAY ( displayName $ description ))
311 ## Whole-of-domain info
313 objectclass ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' SUP top STRUCTURAL
314 DESC 'Samba Domain Information'
315 MUST ( sambaDomainName $ sambaNextGroupRid $ sambaNextUserRid $