[Date Prev][Date Next]
Re: NT Domain backend
Discussion moved from -core to -devel:
At 11:53 AM 11/17/99 -0500, Mark Valence wrote:
>I've finished the first cut at an NT domain backend. It is currently
>"read-only" although I will be adding editing capabilities later. It
>does users and groups, works only when running slapd on WinNT, and
>only does binds when running as a service (this is a silly NT
>I am using oc's of person, organizationalPerson, and groupOfNames
>(yes, these should be configurable). I also added new oc's to
>slapd.oc.conf, with corresponding new attributes, to support some
>information that is specific to NT users and groups.
A few more details: the domain backend can handle multiple domains,
each of which is in it's own OU. Also, users and groups can be put
into separate OUs. So you can get dns that look like:
cn=John Doe, ou=People, ou=MyDomain, o=MyCo, c=US
That's all configurable, but you get the idea.
If at all possible, use standard-track schema.
If reasonable, I would like to see back-passwd and back-ntd
share the same base schema.
I've used attributes already defined in person, organizationalPerson,
and groupOfNames. The new oc's are just for NT-specific stuff. I
also loked at things like umichPerson, residentialPerson, etc. to see
if I could use attributes from those oc's instead of adding new ones.
I agree that back-domain and back-passwd should share where possible,
especially if we cannot get a list of the oc's/attributes that MS
>My question is: Should I just use these new oc's and attributes or
>should they be added to the formal list? What OIDs should I use?
We should distribute defs for any schema items we depend upon.
However, I'd prefer we avoid depending upon non-standard track
schema. If some cases, it may be necessary to rely on published
as "informational". In all cases, any schema we publish should
be well documented and stable.
I've attached the basic objectclass defs at the bottom of this
message. Please send any comments, especially if you know of an
existing person or group attribute that could be used instead of the
>I've tried to find a list of the oc's and attribute names that
>Microsoft uses in Active Directory, but haven't had any luck. I do
>know that MS's objectclass for users is "User", but that I have not
>found a comprehensive list of the attributes of a User object.
AD scares me... I believe it documented less than OpenLDAP :-)
(at least we are documented by source).
Yet another place where NDS shines (relative to AD).
>Anyone have experience with AD? Anyone interested in using the
>domain backend? I'll be committing it RSN.