Re: schema design and schema restrictions

[Buchan Milne <bgmilne@staff.telkomsa.net>]

On Wednesday 26 November 2008 17:03:55 Mansour Al Akeel wrote:
> Michael Ströder wrote:
> > Mansour Al Akeel wrote:
> >> Hello all,
> >> I an new to LDAP, and I have a need to migrate the existing system to
> >> ldap as this will ease a bit the management for the new system
> >> implementation. I need to authenticate users for a web site, and for
> >> the internal system ( linux, windows stations .... etc). Now the
> >> available account objectclass is structural so I can not user
> >> inetorgperson with account as both are structural. In this case I
> >> decided to extend inetOrgPerson, and add username and password as a
> >> MUST attributes. This is because all the users have access to the web
> >> site and they need authentication, but some users will need to have
> >> access to the machines. In this case I will create a new objectClass
> >> (ie.  accountInfo)  which containts the info I need (home directory,
> >> shell, loginScript, .... etc).
> >
> > I'd recommend to use inetOrgPerson together with posixAccount for the
> > users which need shell access.
> >
> > Ciao, Michael.
>
> Thank you Michael, but posixAccount doesn't require the password, which
> makes it not suitable for authentication.

But, inetOrgPerson (as it inherits from person) allows userPassword, so this 
is irrelevant.

You only need account (or hostObject) if you want the host attribute.

Regards,
Buchan