about schemacheck

[cellecial@21cn.com]

Hi! 
I have installed openldap1.2.1 on SCO OpenServer5..4 and used for a month.
But I just use some simple manipulations.Now I have some question:
I write a new slapd.conf which add "schemacheck on",and start slapd.
1. I write some unregular attribute to file1,such as:
dn:cn=heehee,o=KingTech,c=MT
cn=heehee
mybox=454
mystreet=XinLin Road
objectclass:person

Objectclass person doesn't allow attributes such as mybox,so I think when
I use "ldapadd -f file1 -D "..." -w ..  " it will prompt error.But it 
didn't! Why? Do I need to copy lines from slapd.oc.conf as below
to slapd.conf so that schemacheck can warn me attributes are incorrect?
objectclass person
	requires cn,sn
	allows userPassword,telephonenumber,seeAlso,description
	
2.When I add a certificate like below:
$ cat e4
dn:cn=orange,ou=sales,o=TongTech,c=CN
cn:orange
userCertificate:/u/yanjie/s512-key.pem
objectclass:strongAuthenticationUser
$ ldapadd -b -f e4 -D "cn=root,o=TongTech,c=CN" -w pw
adding new entry cn=orange,ou=sales,o=TongTech,c=CN
ldap_add: Object class violation

Why schemacheck has effection this time? And this time everything is
conform with slapd.oc.conf!

Below is my slapd.conf:
$cat slapd.conf
include         /usr/local/etc/openldap/slapd.at.conf
include         /usr/local/etc/openldap/slapd.oc.conf
schemacheck     on
#referral       ldap://ldap.itd.umich.edu

pidfile         /usr/local/var/slapd.pid
argsfile        /usr/local/var/slapd.args

#######################################################################
# ldbm database definitions
#######################################################################

database        ldbm
#suffix         "dc=your-domain, dc=com"
suffix          "o=TongTech, c=CN"
directory       /usr/tmp
index           cn      eq,sub,approx
#rootdn         "cn=root, dc=your-domain, dc=com"
rootdn          "cn=root, o=TongTech, c=CN"
rootpw          pw

This is my initial ldif:
$ cat myldif
dn: o=TongTech,c=CN
o:  TongTech
objectclass:organization

dn:ou=sales,o=TongTech,c=CN
ou:sales
objectclass=organizationalUnit

3.I can add entries whose dn like "cn=...,ou=sales,o=TongTech,c=CN",
but I can't add entries like "ou=R&D,o=TongTech,c=CN".
$cat e2
dn:ou=R&D,o=TongTech,c=CN
ou:R&D
objectclass=organizationalUnit
$ ldapadd -f e2 -D "cn=root,o=TongTech,c=CN" -w pw
ldapadd: invalid format (line 3 of entry: ou=R&D,o=TongTech,c=CN
 
 How can I add this entry?

I wish to get your help,thanks a lot.
----------------------------------------------
»¶Ó­Ê¹Óà 21CN µç×ÓÓʼþϵͳhttp://www.21cn.com
Thank you for using 21CN Email system