The LDAP directory schema is different from the NDS directory schema. In an NDS directory, an object has a base class. The base class is part of a class hierarchy. The base class is a subclass of other classes and inherits the classes for which it is subclassed. Only a single base class can be associated with the object. The object can contain or inherit only the attributes associated with that class.
In NDS, to add more functionality (attributes) to the object, you must extend the class by adding more attributes to the class definition. In an LDAP directory, standard classes are static and cannot be extended. However, the LDAP schema allows an object to belong to more than one class and to inherit attributes from more than one class. This association of multiple classes is called auxiliary class support.
Although the NDS schema does not allow multiple class associations, LDAP Services for NDS can emulate auxiliary class support for the following selected subset of LDAP classes:
LDAP Services for NDS extends the NDS schema to allow User objects to have an auxiliary class of strongAuthenticationUser and Organization or Organizational Unit objects to have an auxiliary class of certificationAuthority. To emulate auxiliary class support for other NDS object classes, use the NDS ManagerTM utility to extend the schema for the NDS object class with the appropriate LDAP class. For example, an optional attribute called LDAP UserCertificate could be added with NDS Manager to a group object that would map to the LDAP User Certificate. Future versions of NDS will more fully support auxiliary classes.
The strongAuthenticationUser and certificationAuthority auxiliary classes provide security features. They can be used to support a Public Key Infrastructure to maintain and store the digital keys necessary for secure applications such as secure e-mail and electronic commerce. For example, the strongAuthenticationUser class contains a User Certificate attribute. This attribute holds the user's public key. This public key can be accessed and used to encrypt data and initiate a secure session with the user.
NOTE: Although the mappings for these object classes don't appear in the NetWare Administrator LDAP Group object Class Map page, you cannot remap these object classes.