knowing which schema(s) to use

[Prentice Bisbal <pbisbal@pppl.gov>]

Over the past few days or weeks, I've asked a number of questions 
related to schemas as I move my LDAP directory to a newer OS and newer 
version of OpenLDAP. As has happened in the past, I have run into schema 
issues when importing the database (LDIF file) into the new directory 
with slapadd.

This time I got the following errors:
1. Kerberos attributes in "new" kerberos schema start with 'krb' instead 
of 'krb5'
2. I got a schema structural error because user accounts have both 
objectclasses "account" and "krbPrincipal", which is not good.
3. We were using solaris.schema on the old system, which CentOS 6 
doesn't provide, but it does provide duaconf.schema, which seemed be be 
similar if not identical to solaris.schema.

Both of these are easy to fix - just use sed to change 'krb5' to 'krb', 
and then change 'krbPrincipal' to 'krbPrincipalAux', but is this really 
the best/safest way to make these changes. Also, what happens to apps 
that are looking for the 'krb5' instead of 'krb' and vice-versa?

I think many system admins would say just copy the schemas from the old 
server to the new server and forget about it, but I don't think this is 
a good approach. After doing that several times, I imagine the newer 
applications  on the newer OS versions will be looking for different 
objectclass or attribute names (like krb instead of krb5), and things 
will eventually break, anyway.

So my questions are this:

1. How do the rest of you handle situations like this?
2. Who/what is the authoritative source for current schema definitions? 
Are they all defined in RFCs?

In an earlier e-mail, regarding my kerberos schema issues, Michael 
Ströder wrote
> You should use the current schema file shipped with your particular Kerberos installation.

That's exactly what I'm trying to do, which led to the kerberos schema 
issues.  And in the past there have been times when the current version 
of the OS didn't provide the same schemas as the old version, and I was 
left searching the Internet to find the modern equivalent of the schema 
from the old system.


--
Prentice