Adding additional schema - objectClass: value #1 invalid per syntax

[Ed Greenberg <edg@greenberg.org>]

Hi folks,

I added the following to my schema directory:
dn: cn=schema
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' DESC 'User(s) 
who may run sudo' EQUALITY caseExactIA5Match SUBSTR 
caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
X-ORIGIN 'SUDO' )
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' DESC 'Host(s) 
who may run sudo' EQUALITY caseExactIA5Match SUBSTR 
caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 
X-ORIGIN 'SUDO' )
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' DESC 
'Command(s) to be executed by sudo' EQUALITY caseExactIA5Match SYNTAX 
1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAs' DESC 'User(s) 
impersonated by sudo' EQUALITY caseExactIA5Match SYNTAX 
1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
attributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoOption' DESC 
'Options(s) followed by sudo' EQUALITY caseExactIA5Match SYNTAX 
1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'SUDO' )
objectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top 
STRUCTURAL DESC 'Sudoer Entries' MUST ( cn ) MAY ( sudoUser$ sudoHost $ 
sudoCommand $ sudoRunAs $ sudoOption $ description ) X-ORIGIN 'SUDO' )

and referenced it in slapd.conf as:
include         /etc/openldap/schema/sudoers.schema

When I try to add this:
dn: cn=SU_WGADMIN,ou=SUDOers,dc=geni,dc=com
sudoHost: +srv-web
sudoHost: +srv-rs
sudoHost: +srv-memc
sudoHost: +srv-db
sudoHost: +srv-admin
sudoHost: +srv-office
sudoHost: +srv-solr
sudoHost: +srv-sn
sudoCommand: /bin/su - wgadmin
sudoCommand: /bin/su -l wgadmin
sudoCommand: /bin/su -l qa
sudoCommand: /bin/su - qa
sudoOption: !authenticate
objectClass: top
objectClass: sudoRole
cn: SU_WGADMIN
sudoUser: +ppl-eng
sudoUser: +fp-automation

I get the error:
add sudoHost:
      +srv-web
      +srv-rs
      +srv-memc
      +srv-db
      +srv-admin
      +srv-office
      +srv-solr
      +srv-sn
add sudoCommand:
      /bin/su - wgadmin
      /bin/su -l wgadmin
      /bin/su -l qa
      /bin/su - qa
add sudoOption:
      !authenticate
add objectClass:
      top
      sudorole
add cn:
      SU_WGADMIN
add sudoUser:
      +ppl-eng
      +fp-automation
adding new entry "cn=SU_WGADMIN,ou=SUDOers,dc=geni,dc=com"
modify complete
ldap_add: Invalid syntax (21)
      additional info: objectClass: value #1 invalid per syntax

Trimming things down to just
dn: cn=SU_WGADMIN,ou=SUDOers,dc=geni,dc=com
objectClass: top
objectClass: sudoRole
cn: SU_WGADMIN
produces the same error, which makes sense. Reversing top and sudoRole 
migrates the error from value #1 to value #0, which also makes sense.


On reviewing the list of available objectClasses with the GQ 
application, I can't find the objectClass sudoRole, although I _can_ 
find the five attributes, in the attribute list.

I can't find a log that might tell me what is being loaded, and slapd 
starts without error.

I also can't figure out how to dump the schemas with ldapsearch or any 
other command, so I can check to see for myself what's in there.

Can anybody tell me what might be wrong, or how to continue to 
investigate the problem?

Thanks,

</edg>