his appendix describes the schema elements most commonly used in the directory server. Most of the schema elements used in the directory server are part of the standard LDAP protocol, which is in turn based on the X.500 standard. However, some of the directory server's object classes and attributes are extensions created by Netscape® for use with its implementation of LDAP. If an object class or attribute was created by Netscape and is not part of the standard LDAP schema, a note is made in the description of that object or attribute.
This chapter includes
http://www.netscape.com/eng/server/directory/1.0/dsextension.html
http://developer.netscape.com/library/documentation/index.html
(408) 555-5555
408-555-5555
1-408-555-5555
1.408.555.5555
555-5555
(408) 555-5555but you have stored telephone numbers in the format
1.408.555.5555then the user may have difficulty locating the actual entry for which she is searching. For these two reasons, it is important that you be as consistent as possible when storing data in your directory tree. Pick a format and stick with it. When managing the data in your directory tree, keep in mind not so much what the directory server requires, but rather what your LDAP clients and the users of your directory expects to find there. Doing so will vastly improve the usability of your directory data.
NSHOME/slapd-server/config/slapd.oc.conf file, where NSHOME is the directory where you installed your server.
cnis the abbreviation for
commonNameIf an attribute has an abbreviation, the abbreviation is given in the description of the attribute and may be used interchangeably with the full name in the list of attributes for an object class.
groupOfNames
Defines entries for a group of names.
Attributes
Attribute Description
cn
(Required) Defines the group's common name
member
(Required) Defines a group member in distinguished name format
businessCategory
Defines the type of business in which the group is engaged
description
Provides a text description of the group's purpose
o
Defines the organization in which the group resides
ou
Defines the organizational unit in which the group resides
owner
Defines the group's owner
seeAlso
URL to information relevant to the group
groupOfUniqueNames
Defines entries for a group of unique names.
Attributes
Attribute Description
cn
(Required) Defines the group's common name
uniqueMember
(Required) Defines a unique group member in distinguished name format
businessCategory
Defines the type of business in which the group is engaged
description
Provides a text description of the group's purpose
o
Defines the organization in which the group resides
ou
Defines the organizational unit in which the group resides
owner
Defines the group's owner
seeAlso
URL to information relevant to the group
Replication
The following two object classes define directory servers. The first object class identifies the master or supplier server. The second object class identifies consumer servers and the entries to be supplied to those consumers. The two object classes are LDAPServer and LDAPReplica.
LDAPServer
Identifies the local server. This object class is an extension to the standard LDAP
schema.
LDAPReplica
Identifies entries in the local server that are replicated to a remote server, and identifies the remote server to which the entries are replicated. This object class is an extension to the standard LDAP schema.
Locations
The following two object classes describe locations in the directory tree. Each object class contains attributes that describe a location, such as the country name and description. The two object classes described here are country and locality.
country
Defines entries that represent countries.
| Attributes | Attribute Description |
|---|---|
|
c
|
(Required) Defines the entry's country name
|
|
description
| Provides a text description of the country |
locality
Defines entries that represent localities or geographic areas.
Organizations
The following two object classes describe entries representing organizations in the directory tree. Each object class contains attributes that describe an organization, such as its name and description. The two object classes described here are organization and organizationalUnit.
organization
Defines entries that represent organizations. An organization is generally assumed to be a large, relatively static grouping within the larger corporation or organization.
organizationalUnit
Defines entries that represent organizational units. An organizational unit is generally assumed to be a relatively static grouping within the larger organization
People
The following four object classes describe entries representing people in the directory. Each object class contains attributes that describe a person, such as name, telephone number, and address. The four object classes described here are person, organizationalPerson, inetOrgPerson, and NTUser.
person
Defines entries that represent people generically. This object class is the base class for the organizationalPerson object class.
| Attributes | Attribute Description |
|---|---|
|
cn
|
(Required) Defines the person's common name
|
|
sn
|
(Required) Defines the person's surname, or last name
|
|
description
| Provides a text description of the person |
|
seeAlso
| URL to information relevant to the person |
|
telephoneNumber
| Identifies the person's telephone number |
|
userPassword
| Identifies the password with which the person can bind to the directory |
organizationalPerson
Defines entries for people employed by or in some other important way associated with an organization. The organizationalPerson object class is an extension of the person object class.
inetOrgPerson
Defines entries representing people organization's intranet. This object class is a Netscape extension to the standard LDAP schema.
NTUser
Defines entries that are to be synchronized between a directory server and a Windows® NT® network. The attributes defined by NTUser assist in NT Synchronization. This is a Netscape extended object class for use with the Netscape LDAP implementation.
Note
All NTUser attributes are read-only, except for NTUserCreateNewAccount, NTUserDomainId,
and NTUserDeleteAccount. Any modifications you make to read-only
NTUser attributes will be deleted and the original values will be replaced when the
next NT Synchronization occurs.
Several directory server attributes correspond directly to NT user account fields.
When you create a new person entry in a directory server that is to be synchronized
with NT, the directory server attributes will be assigned to NT user account fields as
follows:
directory server attribute
NT user account field
cn or commonName
full_name
description
comment
userid
name
userid
password
Netscape Suitespot extensions
The following object classes are used by Netscape to integrate Suitespot 3.0 servers with the directory. The object classes described here are nginfo, mailRecipient, mailGroup, groupOfMailEnhancedUniqueNames, netscapeServer, and nsLicenseUser.
nginfo
Object class used by the collabra server to store discussion (news) group information. nginfo is a Netscape extension to the standard LDAP schema.
Object classes of this type are stored in a separate subtree off your directory's root point. The branch point is represented by the ngcomponent=. entry. Thus, if your directory's suffix is o=Ace Industry, c=US, then all discussion group information is stored in the subtree:
ngcomponent=., o=Ace Industry, c=US
mailRecipient
Object class is used as an enhancement to inetOrgPerson. mailRecipient is a Netscape extension used by the Messaging Server to define a person who is a user of the Netscape Messaging Server. mailRecipient represents a mail account.
mailGroup
Object class is used as an enhancement to groupOfUniqueNames. mailGroup is a Netscape extension used by the Messaging Server to define a group of mailRecipient. mailGroup is used to store Messaging Server mailing lists.
groupOfMailEnhancedUniqueNames
Netscape extension is used by the Messaging Server and is reserved for future use.
netscapeServer
Object class used to identify entries used by Netscape servers to bind to the directory when performing directory access. netscapeServer is a Netscape extension to the standard LDAP schema.
nsLicenseUser
Object class used to track licenses for Netscape Servers that are licensed on a per-client basis. This object class is a Netscape extension to the standard LDAP schema. It is intended to be used with the inetOrgPerson object class. The contents of this object class can be managed by the User and Group area of the Netscape Administration Server 3.0.
Attribute definitions
The following define the most common attributes used to describe an entry in the directory tree. To determine which attributes are required and allowed for each object class, see "Object Class Definitions."
Each attribute has a corresponding syntax definition that describes the nature of the attribute information. This syntax is important only when the directory server is sorting and pattern matching; there is nothing to otherwise prevent you from, for example, placing a telephone number on an attribute that expects a distinguished name. For more information about attributes and attribute values, see "A note about attribute values."
The possible attribute syntaxes are
administratorContactInfo
Provides a URL to information about the person responsible for administering the Netscape server. This attribute is a Netscape extension used by the netscapeServer object class. Normally this attribute and this attribute value is written to the directory when a Netscape server is initially installed. For example,
administratorContactInfo: ldap://uid=ssarette,
o=Ace Industry, c=US
Syntax: cis
adminURL
Provides the URL to the administration server through which you can manage the Netscape server. This attribute is a Netscape extension used by the netscapeServer object class. Normally this attribute and this attribute value is written to the directory when a Netscape server is initially installed. For example,
adminURL: http://twain.aceindustry.com:2468
Syntax: cis
businessCategory
Identifies the type of business in which the entry is engaged. This should be a broad generalization, such as is made at the corporate division level.
For example,
businessCategory: Engineering
Syntax: cis
carLicense
Identifies the entry's automobile license plate number. For example,
carLicense: 6ABC246
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
changeLogMaximumAg e
Identifies the maximum age in seconds for entries in the change log. Entries are discarded once they become older than the maximum age specified. For example,
changeLogMaximumAge: 86000
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
changeLogMaximumSiz e
Identifies the maximum size in bytes for the change log file. Entries are discarded from this file once it reaches the maximum size. For example,
changeLogMaximumSize: 2400000
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
commonName
When in reference to an object class other than LDAPReplica or LDAPServer, cn identifies the entry's common name, or full name. For example,
commonName: Bill Anderson
or:
cn: Bill Anderson
When in reference to the LDAPReplica or LDAPServer object classes, it identifies the converted DNS name of the server and root of the replicated directory tree into distinguished name format. For example,
commonName: replicater.netscape.com:17430/o%3Dace%20industry
%2Cc%3us
or:
cn: replicater.netscape.com:17430/o%3Dace%20industry%2Cc%3us
Abbreviation: cn
Syntax: cis
countryName
Identifies the name of a country. For example,
countryName: Ireland
Abbreviation: c
Syntax: cis
departmentNumber
Identifies the entry's department number. For example,
departmentNumber: 2604
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
description
Describes the entry. For people and organizations this often includes their role or work assignment. For example,
description: Quality control inspector for the ME2873 product line
Syntax: cis
employeeNumber
Identifies the entry's employee number. For example,
employeeNumber: 15300
Syntax: cis
This attribute was created by Netscape for use with its LDAP implementation.
employeeType
Identifies the entry's type of employment. For example,
employeeType: Full time
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
facsimileTelephoneNumber
Identifies the fax number at which the entry can be reached. For example,
facsimileTelephoneNumber: 415-555-1212
or:
fax: 415-555-1212
Abbreviation: fax
Syntax: tel
generation
Identifies a byte vector assigned to the server to distinguish it from any other generation or version of the server. The generation attribute is used only for replica synchronization.
Syntax: ces
This attribute is a Netscape extension to the standard LDAP schema.
givenName
Identifies the entry's given, or first, name. For example,
givenName: Bill
Syntax: cis
homeTelephoneNumber
Identifies the entry's home phone number. For example,
homeTelephoneNumber: 415-555-1212
or:
homePhone: 415-555-1234
Abbreviation: homePhone
Syntax: tel
homePostalAddress
Identifies the entry's home mailing address. This field is intended to include multiple lines, but each line within the entry should be separated by a dollar sign ($). For example,
homePostalAddress: 1234 Ridgeway Drive$Santa Clara, CA$99555
To represent an actual dollar sign ($) or backslash (\) within this text, use the escaped hex values \24 and \5c respectively. For example, to represent the string:
The dollar ($) value can be found
in the c:\cost file.
provide the string:
The dollar (\24) value can be found$in the c:\5ccost file.
Syntax: cis
initials
Identifies the entry's initials. For example,
initials: BFA
Syntax: cis
installationTimeStam p
Identifies the date and time in zulu format when the Netscape server was installed. This attribute is a Netscape extension used by the netscapeServer object class. Normally this attribute and this attribute value is written to the directory when a Netscape server is initially installed. For example,
installationTimeStamp: 199703261517z
Syntax: cis
jpegPhoto
Defines a JPEG photo of the entry.
Syntax: bin
labeledURI
Specifies a Uniform Resource Identifier (URI) that is relevant in some way to the entry. Values placed in the attribute should consist of a URI (currently only URLs are supported) optionally followed by one or more space characters and a label. For example,
labeledURI: http://home.netscape.com [Netscape corporations's
home page]
Syntax: cis
localityName
Identifies the county, city, or other geographical area in which the entry is located or in some other way associated with. For example,
localityName: Santa Clara
or:
l: Santa Clara
Abbreviation: l
Syntax: cis
Identifies the entry's email address. For example,
mail: banderson@aceindustry.com
Syntax: cis
mailAccessDomain
Identifies the domain or IP address from which the user can perform a POP/IMAP logon. This attribute is a Netscape extension used by the Messaging Server. For example,
mailAccessDomain: aceindustry.com
Syntax: cis
mailAlternateAddress
Identifies an alternative mail address for a mail user. This attribute is a Netscape extension used by the Messaging Server to match a mail address to a user. A mail account can have as many instances of this attribute as the user has alternate mail addresses. For example,
mailAlternateAddress: Babs_Jensen@aceindustry.com
mailAlternateAddress: Bjensen@aceindustry.com
Syntax: cis
mailAutoReplyMode
Identifies the mail auto reply mode for the mail user. This attribute is a Netscape extension used by the Messaging Server. Zero or one (0-1) instances of this attribute are expected per mail user account. Valid keywords for this attribute are
For example,
mailAutoReplyMode: vacation
Syntax: cis
mailAutoReplyText
Provides auto reply text for a mail user. This attribute is a Netscape extension used by Messaging Server. When represented in LDIF format, each line should be separated by a dollar sign ($). The Messaging Server expects 0 or 1 occurrences of this attribute per mail account. For example,
mailAutoReplyText: On vacation$Back in the office on Monday.
To represent an actual dollar sign ($) or backslash (\) within this text, use the escaped hex values \24 and \5c respectively. For example, to represent the string:
The dollar ($) value can be found
in the c:\cost file.
provide the string:
The dollar (\24) value can be found$in the c:\5ccost file.
Syntax: cis
mailDeliveryOption
Identifies the mail delivery mechanism to be used for the mail user. This attribute is a Netscape extension used by the Messaging Server. Zero to three (0-3) instances of this attribute are expected per mail user account. However, if no instance of this attribute exists on the mail user entry, then at least one mailForwardingAddress attribute must exist on the entry. Valid keywords for this attribute are
For example,
mailDeliveryOption: mailbox
Syntax: cis
mailEnhancedUniqueMember
Netscape extension used by the Messaging Server. Reserved for future use.
Syntax: dn
mailForwardingAddress
Identifies a mail address to which mail is forwarded. This attribute is a Netscape extension used by the Messaging Server to forward incoming mail to the correct location. For example,
mailForwardingAddress: bjensen@royalairways.com
Syntax: cis
mailHost
Identifies the DNS hostname of the host on which the user's mail account resides. This attribute is a Netscape extension used by the Messaging Server to route incoming mail to the correct location. The Messaging Server expects one and only one instance of this attribute per mailRecipient entry, or zero or one instances of this attribute on a mailGroup entry. The value specified on this attribute must be the host's fully qualified domain name. For example,
mailHost: mars.aceindustry.com
Syntax: cis
mailMessageStoreIdentifies the absolute path on the user's mail host to the location under which the user's mailbox resides. This attribute is a Netscape extension used by the Messaging Server and this attribute is applicable only if the user's mailDeliveryOption is set to mailbox. The Messaging Server expects zero or one (0 or 1) instances of this attribute. If no instances of this attribute exist on the user's entry, then the default configured on the user's Messaging Server is used. For example,
mailMessageStore: /disk2/mail
Syntax: ces
mailProgramDeliveryInfo
Identifies one or more commands, delimited by $, to be used for programmed mail
delivery. This attribute is a Netscape extension used by the Messaging Server. The
Messaging Server expect zero or one (0-1) instances of this attribute per user account.
This attribute is meaningful only if all of the following conditions are true:
program. For example,
mailProgramDeliveryInfo: /usr/local/bin/procmail -f-
Syntax: ces
mailQuota
Identifies the maximum disk space in bytes that may be consumed by the user's mailbox. This attribute is a Netscape extension used by the Messaging Server and this attribute is applicable only if the user's mailDeliveryOption is set to mailbox. The Messaging Server expects zero or one (0 or 1) instances of this attribute. If no instances of this attribute exist on the user's entry, then the default configured on the user's Messaging Server is used. For example,
mailQuota: 1000000
Note that if this attribute is set to zero, then no limit is set on the disk space quota.
Syntax: cis
manager
Identifies the distinguished name of the person's manager. For example,
manager: cn=Jane Doe, ou=Quality Control, o=Ace Industry, c=US
Syntax: dn
member
Identifies the distinguished names for each member of the group. For example,
member: cn=John Doe, o=Netscape Communications Corp., c=US
Syntax: dn
mgrpAllowedBroadcaster
Identifies mail users allowed to send messages to the mail group. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists. If no instances of this attribute exist on the mailGroup entry, then there are no restrictions on who can send messages to the mail group unless the mgrpAllowedDomain attribute is used.
The Messaging Server expects this attribute to contain either a distinguished name or a rfc822address. If a distinguished name is used, it must represent a mailable entry or entries of type group or groupOfUniqueNames. The distinguished name must be represented in the form of a LDAP URL as described in RFC1959, An LDAP URL format.
For example,
mgrpAllowedBroadcaster: ldap://uid=bjensen, o=Ace Industry, c=US
mgrpAllowedBroadcaster: mailto:sys50@aceindustry.com
Syntax: ces
mgrpAllowedDomain
Identifies domains from which users are allowed to send messages to the mail group. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists. If no instances of this attribute exist on the mailGroup entry, then there are no restrictions on who can send messages to the mail group unless the mgrpAllowedBroadcaster attribute is used.
By default this is a wildcard value because a value of "aceindustry.com" will match any user sending from "*.aceindustry.com"
For example,
mgrpAllowedDomain: aceindustry.com
Syntax: cis
mgrpDeliverTo
Alternative method of specifying mail group membership. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists. The Messaging Server expects this attribute to contain an LDAP URL using the format described in RFC1959, An LDAP URL format. Any entries returned by the resulting LDAP search are members of the mailing group. For example,
mgrpDeliverTo: ldap:///ou=Accounting,o=Netscape,c=US??sub?(&
(objectClass=mailRecipient)(objectClass=inetOrgPerson))
Syntax: ces
mgrpErrorsTo
Identifies a mailing address to send error messages to for notification of mail delivery problems, such as bounced mails or members of the mailing group that lack a mailing address. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists. If no instances of this attribute exist on the mailGroup entry, then error handling is managed according to the default set in the Messaging Server.
The Messaging Server expects this attribute to contain either a distinguished name or a rfc822address. If a distinguished name is used, it must represent a mailable entry or entries of type group or groupOfUniqueNames. The distinguished name must be represented in the form of a LDAP URL as described in RFC1959, An LDAP URL format.
For example,
mgrpErrorsTo: ldap://uid=bjensen, o=Ace Industry, c=US
mgrpErrorsTo: mailto:sys50@aceindustry.com
Syntax: ces
mgrpModerator
Identifies a mailing address to send rejected messages to. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists. This is the address to which the rejected mail from a mailing list is sent.The Messaging Server may reject mail either because it is received from an unauthorized domain (as defined by the mgrpAllowedDomain attribute) or is received from an mail address that is not a member of the mgrpAllowedBroadcaster attribute. The Messaging Server will only forward mail to the address(es) identified by this attribute if the mgrpMsgRejectAction attribute includes toModerator. If no instances of this attribute exist on the mailGroup entry and mgrpMsgRejectAction attribute is set to toModerator, then rejected mail that is supposed to be sent to the moderator is dumped (it is deleted from the mail system with no further human interaction).
The Messaging Server expects this attribute to contain either a distinguished name or a rfc822address. If a distinguished name is used, it must represent a mailable entry or entries of type group or groupOfUniqueNames. The distinguished name must be represented in the form of a LDAP URL as described in RFC1959, An LDAP URL format.
For example,
mgrpErrorsTo: ldap://uid=bjensen, o=Ace Industry, c=US
mgrpErrorsTo: mailto:sys50@aceindustry.com
Syntax: ces
mgrpMsgMaxSize
Identifies the maximum message size in bytes that is allowed to be sent to the mail group. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists. The Messaging Server expects one and only one instance of this attribute to exist for every mailGroup entry. For example,
mgrpMsgMaxSize: 2000
Syntax: cis
mgrpMsgRejectAction
Identifies the action to be taken when a mail sent to a mail group is rejected. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists.
The Messaging Server may reject mail either because it is received from an unauthorized domain (as defined by the mgrpAllowedDomain attribute), a mail address that is not a member of the mgrpAllowedBroadcaster attribute, or is larger than the size permitted on mgrpMsgMaxSize.
The Messaging Server expects from zero to two (0-2) instances of this attribute per mailGroup entry. If no instances of this attribute exist on the mailGroup entry, then reply is used by default. Valid keywords for this attribute are
For example,
mgrpMsgRejectAction: bounce
Syntax: cis
mgrpMsgRejectText
Identifies the text to be sent by the Messaging Server when mail sent to a mail group is rejected and the mgrpMsgRejectAction attribute is set to either bounce or reply. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists.
The Messaging Server expects from zero to one (0-1) instances of this attribute to exist per mailGroup entry. Multiline text may be delimited using $ when represented in LDIF format. If no instances of this attribute exist on the mailGroup entry, then the default text set in the Messaging Server is used for rejected mail.
For example,
mgrpMsgRejectText: The mail you have sent to the Crazed Bikers$
mailing list has been rejected because$you are not a recognized
member of the Crazed Bikers group.$Please contact Big Daddy Biker
at rsweeny@aceindustry.com for information on how to become$a
crazed biker.
Syntax: ces
mgrpRFC822Mail Member
Identifies recipients of mail sent to a mailGroup that are not actually members of the mail group. Conceptually, these mail addresses can be thought of as "CC recipients." This attribute is used to represent mail recipients that cannot be expressed as distinguished names or who are to be sent mail from this group but who do not have the full privileges of a unique group member. This attribute is a Netscape extension used by the Messaging Server to manage mailing lists.
The Messaging Server expects this attribute to contain rfc822 mail addresses using the following form:
rfc822MailAddress [ % 'full' name] [ %1 (group parameter #1)]
[ %2 (group parameter #2)]...
where
bjensen@aceindustry.com
For example,
mgrpRFC822MailMember: bjensen@aceindustry.com%Babs Jensen
Syntax: cis
mobileTelephoneNumber
Identifies the entry's mobile or cellular phone number. For example,
mobileTelephoneNumber: 415-555-4321
or:
mobile: 415-555-4321
Abbreviation: mobile
Syntax: tel
multiLineDescription
Provides descriptive text for a mail user. This attribute is a Netscape extension used by Messaging Server. When represented in LDIF format, each line should be separated by a dollar sign ($). The Messaging Server expects 0 or 1 occurrences of this attribute per mail account. For example,
multiLineDescription: Account Administrator and$directory manager.
Syntax: cis
To represent an actual dollar sign ($) or backslash (\) within this text, use the escaped hex values \24 and \5c respectively. For example, to represent the string:
The dollar ($) value can be found
in the c:\cost file.
provide the string:
The dollar (\24) value can be found$in the c:\5ccost file.
ngcomponent
Identifies a part of the newsgroup name. This attribute is a Netscape extension to the standard LDAP schema. It is used by the collabra server on nginfo entries to uniquely identify news groups. The format and nature of the information placed on this attribute by the Netscape Collabra® Server is subject to change without notice.
For example, the ngcomponent attributes put in place for the comp.sys.mac newsgroup would be
dn: ngcomponent=mac, ngcomponent=sys, ngcomponent=comp,
ngcomponent=., o=Ace Industry, c=US
objectclass: top
objectclass: nginfo
ngcomponent=mac
ngcomponent=sys
ngcomponent=comp
ngcomponent=.
Syntax: cis
nsLicensedFor
Identifies the Netscape server that the user is licensed to use. The Netscape Administration server expects each nsLicenseUser entry to contain zero or more instances of this attribute. Valid keywords for this attribute are currently:
For example,
nsLicensedFor: slapd
Syntax: cis
nsLicenseStartTime
Reserved for future use.
Syntax: cis
nsLicenseEndTime
Reserved for future use.
Syntax: cis
nsaclrole
Identifies the access for individual newsgroup roles (for example, manager, poster, reader, etc). This attribute is a Netscape extension to the standard LDAP schema. It is used by the Collabra Server on nginfo entries to identify access control for individual newsgroups. This attribute is used only on the branch point of the ngcomponent subtree. The format and nature of the information placed on this attribute by the Collabra Server is subject to change without notice.
For example,
nsaclrole: admin:aprv
Syntax: cis
nscreator
Identifies the creator of a newsgroup. This attribute is a Netscape extension to the standard LDAP schema that is used by the Collabra Server on nginfo entries to identify a newsgroup creator's uid. The format and nature of the information placed on this attribute by the Collabra Server is subject to change without notice.
For example,
nscreator: admin
Syntax: cis
nsflags
Reserved for future use.
Syntax: cis
nsprettyname
Identifies the pretty name, or display name, for the newsgroup. This attribute is a Netscape extension to the standard LDAP schema that is used by the Collabra Server on nginfo entries to identify individual newsgroups. The format and nature of the information placed on this attribute by the Collabra Server is subject to change without notice.
For example,
nsprettyname: MKTG FOR RACHU
Syntax: cis
nsnewsACL
Identifies the access control set for individual newsgroups. This attribute is a Netscape extension to the standard LDAP schema. It is used by the Collabra Server on nginfo entries to identify access control for individual newsgroups. The format and nature of the information placed on this attribute by the Collabra Server is subject to change without notice.
For example,
nsnewsACL: 2:*:a:D::admin:bpolk::d:*:a:D::manager:admin::d:
Syntax: cis
NTUserAcctExpire s
Indicates when the entry's Windows NT account will expire. This value is stored as a string in GMT format. For example,
NTUserAcctExpires: 19961015203415Z
Syntax: cis
NTUserAuthFlags
Identifies an unsigned long integer that contains the entry's operator privileges on the Windows network. For example,
NTUserAuthFlags: AAAAAA==
Syntax: bin
NTUserBadPwCount
Identifies the number of attempts to logon to the Windows account using an incorrect password. A value of 0xFFFFFFFF represents that the value is unknown. For example,
NTUserBadPwCount: AAAAAA==
Syntax: bin
NTUserCodePage
Code page for the user's language of choice. For example,
NTUserCodePage: AAAAAA==
Syntax: bin
NTUserComment
ASCII string representing a description or comments about this entry. For example,
NTUserComment: Quality control inspector for the ME2873
product line
Syntax: cis
NTUserCountryCode
Indicates the country code for the user's language of choice. For example,
NTUserCountryCode: AAAAAA==
Syntax: cis
NTUserCreateNewAccount
Indicates whether a corresponding NT user account should be created for the new person entry in the directory server. NTUserCreateNewAccount can be edited from directory server. If NTUserCreateNewAccount is set to True and an NT account does not exist for the specified user name, an NT account will be created. If the attribute is set to False and an NT account does not exist, an error will be logged. If an NT account exists and the attribute is set to False, the existing NT account will be updated. For example,
NTUserCreateNewAccount: true
Syntax: cis
NTUserDeleteAccount
Indicates whether the NT user account should be deleted when the entry is deleted from the directory server. NTUserDeleteAccount can be edited from directory server. If the attribute is set to true, the NT user account will be deleted if the entry is deleted from the directory server. If the attribute is set to false, the NT user account will not be deleted. See "NTUser" for more information on deleting NTUser entries. For example,
NTUserDeleteAccount: true
Syntax: cis
NTUserDomainId
Identifies the NT domain name and user name of the entry in the form NT-domain- name:NT-username. NTUserDomainId can be edited from the directory server. For example,
NTUserDomainId: workgroup:jsmith
Syntax: cis
NTUserFlags
Identifies values that determine several features about the user and their account. For example,
NTUserFlags: AQIBAA==
Syntax: bin
NTUserHomeDir
ASCII string that represents the path of the user's home directory. The string can be null. For example,
NTUserHomeDir: c:\u\d78\jsmith\
Syntax: cis
NTUserHomeDirDrive
ASCII string that represents the drive letter assigned to the user's home directory. For example,
NTUserHomeDirDrive: c:
Syntax: cis
NTUserLastLogoff
Identifies the time of the last logoff. This value is stored as a string in GMT format. For example,
NTUserLastLogoff: 19961015203415Z
Note that if security logging is turned on, then this attribute is updated on synchronization only if some other aspect of the user's entry has changed.
Syntax: cis
NTUserLastLogon
Identifies the time of the last logon. This value is stored as a string in GMT format. For example,
NTUserLastLogon: 19961015203415Z
Note that if security logging is turned on, then this attribute is updated on synchronization only if some other aspect of the user's entry has changed.
Syntax: cis
NTUserLogonHours
Identifies the times during which the user may logon. Time is represented by a one-to- one correspondence between the hour of the week and a bit within the string. For example, bit 0 word 0 is Sunday, 0:00 to 0:59. Bit 1 word 0 is Sunday, 1:00 to 1:59, etc. For example,
NTUserLogonHours: ///1000011100000101111111...
Note that if security logging is turned on, then this attribute is updated on synchronization only if some other aspect of the user's entry has changed.
Syntax: bin
NTUserLogonServer
ASCII string that represents the name of the server to which the user's logon requests are sent. Server names should be preceded by two backslashes (\\). Server names of \\* indicate that the logon request can be handled by any logon server. A null string represents that requests are sent to the domain controller. For example,
NTUserLogonServer: \\firefly
Syntax: cis
NTUserMaxStorage
Maximum amount of disk space the user may use. For example,
NTUserMaxStorage: ///////W==
Syntax: bin
NTUserNumLogons
Identifies the number of successful logons to this account. A value of 0xFFFFFFFF indicates the value is unknown. For example,
NTUserNumLogons: WwAAAA==
Syntax: bin
NTUserParms
Unicode string that is set aside for use by applications. For example,
NTUserParms: Temp date is today
Syntax: cis
NTUserPasswordExpired
Identifies if the user's NT password has expired. The value will be zero if the password has not expired or nonzero if it has. For example,
NTUserPasswordExpired: AAAAAA==
Syntax: bin
NTUserPrimaryGroupId
Identifies the relative ID (RID) of the Primary Global Group for the user. For example,
NTUserPrimaryGroupId: AQJAAA==
Syntax: bin
NTUserPriv
Identifies the user's level of privilege on the Window's Network. For example,
NTUserPriv: AgAAAA==
Syntax: bin
NTUserProfile
Identifies a path to the user's profile. For example,
NTUserProfile: c:\u\d78\jsmith\profile.txt
Syntax: cis
NTUserScriptPath
ASCII string that represents the path to the user's logon script. For example,
NTUserScriptPath: c:\u\d78\jsmith\lscript.bat
Syntax: cis
NTUserUniqueId
Identifies the relative ID (RID) of the user. The RID uniquely identifies the user to SAM within the domain. For example,
NTUserUniqueId: 6AMAAA==
Syntax: bin
NTUserUnitsPerWeek
Identifies the number of equal length time units to divide the week into in order to compute the length of NTUserLogonHours. For example,
NTUserUnitsPerWeek: qAAAAA==
Syntax: bin
NTUserUsrComment
ASCII string representing a description or comments about this entry. For example,
NTUserComment: Quality control inspector for the ME2873
product line
Syntax: cis
NTUserWorkstation s
ASCII string that represents the names of workstations from which the user may log on. Up to eight workstations may be specified by separating each with a comma. Use null to allow the user to log on from any workstation. For example,
NTUserWorkstations: firefly
Syntax: cis
organizationName
Identifies the name of the organization. For example,
organizationName: Ace Industries, Inc.
or
o: Ace Industries, Inc
Abbreviation: o
Syntax: cis
organizationalUnitName
Identifies the name of an organizational unit. For example,
organizationUnitName: Marketing
or
ou: Marketing
Abbreviation: ou
Syntax: cis
owner
Identifies the distinguished name (DN) of the person responsible for the entry. For example,
owner: cn=John Smith, o=Netscape Communications Corp., c=US
Syntax: dn
pagerTelephoneNumber
Identifies the entry's pager phone number. For example,
pagerTelephoneNumber: 415-555-6789
or:
pager: 415-555-6789
Abbreviation: pager
Syntax: tel
physicalDeliveryOfficeName
Identifies the name of the city or village where a physical delivery office is located. For example,
physicalDeliveryOfficeName: Santa Clara
Syntax: cis
postalAddress
Identifies the entry's mailing address. This field is intended to include multiple lines. When represented in LDIF format, each line should be separated by a dollar sign ($). For example,
postalAddress: 1234 Ridgeway Drive$Santa Clara, CA$99555
Syntax: cis
To represent an actual dollar sign ($) or backslash (\) within this text, use the escaped hex values \24 and \5c respectively. For example, to represent the string:
The dollar ($) value can be found
in the c:\cost file.
provide the string:
The dollar (\24) value can be found$in the c:\5ccost file.
postalCode
Identifies the entry's ZIP Code® in the United States. For example,
postalCode: 95050
Syntax: cis
postOfficeBox
Identifies the entry's P.O. Box. For example,
postOfficeBox: P.O. Box 1234
Syntax: cis
preferredDeliveryMethod
Identifies the entry's preferred contact or delivery method. For example,
preferredDeliveryMethod: telephone
Syntax: cis
replicaBinddn
Identifies the DN that the server uses when communicating with a replica server. This DN can be assigned privileges. For example,
replicaBinddn: cn=replicator o=Netscape Communications Corp.,
c=US
Syntax: dn
This attribute is a Netscape extension to the standard LDAP schema.
replicaBindMethod
Identifies the method of replication to be used. This attribute does not need to be present. If it is present it must be set to "simple." If it is not set to "simple" a warning is printed and replication will proceed as if it were "simple." For example,
replicaBindMethod: simple
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
replicaCredentials
Identifies the password to be used with the replicaBinddn sent to the consumer server. It is highly recommended that this attribute be specified with strict access controls. For example,
replicaCredentials: bogusPassword
Syntax: bin (plain text)
This attribute is a Netscape extension to the standard LDAP schema.
replicaHost
Identifies the hostname of the consumer server. For example,
replicaHost: master.netscape.com
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
replicaPort
Identifies the portnumber of the consumer server. For example,
replicaPort: 9872
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
replicaRoot
Identifies the DN for the subtree that is being replicated to the consumer machine. For example,
replicaRoot: o=Netscape Communications Corp., c=US
Syntax: dn
This attribute is a Netscape extension to the standard LDAP schema.
replicaUpdateFailedAt
Identifies the day and time in zulu format when an update failed to complete successfully. If all updates have been successful, replicaUpdateFailedAt is blank. For example,
replicaUpdateFailedAt: 199603261300z
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
replicaUpdateReplayed
Identifies the change number of the last change propagated to the consumer server. This value is used internally between servers only.
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
replicaUpdateSchedule
Identifies the update schedule for the consumer server. If this attribute is not present, the consumer will be updated immediately. For example,
replicaUpdateSchedule: 0100-0400
replicaUpdateSchedule: * 06
replicaUpdateSchedule: 1145-1300 24
These values mean
1:00 AM - 4:00 AM, daily
all day Saturday and Sunday
11:45 AM -1:00 PM, Tuesday and Thursday
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
replicaUseSSL
Identifies whether SSL will be used to communicate with the consumer server. A non- zero value will cause SSL to be used. For example,
replicaUseSSL: 0
Syntax: cis
This attribute is a Netscape extension to the standard LDAP schema.
roomNumber
Identifies the entry's office number. For example,
roomNumber: 230
Syntax: cis
secretary
Identifies the entry's secretary or administrative assistant. For example,
secretary: Howard Benson
Syntax: cis
seeAlso
Identifies another directory server entry that may contain information related to this entry. For example,
seeAlso: cn=Quality Control Inspectors, ou=manufacturing, o=Ace
Industry, c=US
Syntax: dn
serverHostname
Identifies the name of the host on which the Netscape server is installed. This attribute is a Netscape extension used by the netscapeServer object class. Normally this attribute and attribute value is written to the directory when a Netscape server is initially installed. For example,
serverHostname: twain.aceindustry.com
Syntax: ces
serverProductName
Identifies the type of the installed Netscape server. This attribute is a Netscape extension used by the netscapeServer object class. Normally this attribute and this attribute value is written to the directory when a Netscape server is initially installed. For example,
serverProductName: Netscape Enterprise, FastTrack, or Messaging Server
Syntax: cis
serverRoot
Identifies the fully qualified path to the installation directory for a Netscape server. This attribute is a Netscape extension used by the netscapeServer object class. Normally this attribute and this attribute value is written to the directory when a Netscape server is initially installed. For example,
serverRoot: /usr/ns-home
Syntax: ces
serverVersionNumbe r
Identifies the version number of the installed Netscape server. This attribute is a Netscape extension used by the netscapeServer object class. Normally this attribute and this attribute value is written to the directory when a Netscape server is initially installed. For example,
serverVersionNumber: 3.0
Syntax: cis
stateOrProvinceName
Identifies the state or province in which the entry resides. For example,
stateOrProvinceName: California
or
st: California
Abbreviation: st
Syntax: cis
streetAddress
Identifies the entry's house number and street name. For example,
streetAddress: 1234 Ridgeway Drive
Syntax: cis
subtreeACI
Stores the directory server access control information for this entry. For example,
subtreeACI: -(&(privilege=write)(!(target=ldap:///self)))
Syntax: ces
The subtreeACI attribute cannot contain end-of-line characters.
This attribute is a Netscape extension to the standard LDAP schema.
surname
Identifies the entry's surname, or last name. For example,
surname: Anderson
or
sn: Anderson
Abbreviation: sn
Syntax: cis
telephoneNumber
Identifies the entry's phone number. For example,
telephoneNumber: 415-555-2233
Syntax: tel
title
Identifies the entry's title. For example
title: Senior QC Inspector
Syntax: cis
userid
Identifies the entry's user ID( logon ID). For example,
userid: banderson
or
uid: banderson
Abbreviation: uid
Syntax: cis
userPassword
Identifies the entry's password and encryption method in the following format: {encryption method}encrypted password.
For example,
userPassword: {sha}FTSLQhxXpA05
Syntax: bin