Recipe 10.9 Adding a New Class :: Chapter 10. Schema :: Active Directory. Windows server 2003 Windows 2000 :: Server Administration

Recipe 10.9 Adding a New Class

10.9.1 Problem

You want to add a new class to the schema.

10.9.2 Solution

For Windows 2000 Active Directory you need to enable schema modifications before proceeding. See Recipe 10.2 for more information.

10.9.2.1 Using a graphical user interface

Open the Active Directory Schema snap-in.
In the left pane, right-click on the Classes folder and select Create Class . . .
Click the Continue button to confirm that you want to extend the schema.
Enter the information for the new class and click Next.
Enter any mandatory and optional attributes and click Finish.

10.9.2.2 Using a command-line interface

You can create new classes by using ldifde and an LDIF file that contains the properties to be set on the class. The following text shows an example LDIF file called create_class.ldf that creates a class called rallencorp-SalesUser:

dn: cn=rallencorp-SalesUser,cn=schema,cn=configuration,<ForestRootDN>
changetype: add
objectclass: classSchema
lDAPDisplayName: rallencorp-SalesUser
governsId: 1.3.6.1.4.1.999.1.1.28.4
objectClassCategory: 3
subClassOf: top
description: Auxiliary class for Sales user attributes
adminDescription: Auxiliary class for Sales user attributes
mayContain: rallencorp-Building
mayContain: rallencorp-Theatre

Then run the following command:

> ldifde -v -i -f create_class.ldf

10.9.2.3 Using VBScript

' This code creates a class in the schema called rallencorp-SalesUser.
' It is assumed that the script is being run by a member of Schema Admins

set objRootDSE = GetObject("LDAP://RootDSE")
set objSchemaCont = GetObject("LDAP://" & _ 
                              objRootDSE.Get("schemaNamingContext") )
set objClass = objSchemaCont.Create("classSchema", _
                                    "cn=rallencorp-SalesUser")
objClass.Put "lDAPDisplayName", "rallencorp-SalesUser"
objClass.Put "governsId", "1.3.6.1.4.1.999.1.1.28.4"
objClass.Put "objectClassCategory", 3
objClass.Put "subClassOf", "top"
objClass.Put "adminDescription", "Languages a user speaks"
objClass.Put "mayContain", Array("rallencorp-Building","rallencorp-Theatre")
objClass.SetInfo
WScript.Echo "Class created"

10.9.3 Discussion

To create a new class, you need to create a classSchema object in the Schema container. The important attributes to set include:

governsId: Defines the OID for the class
objectClassCategory: Defines the class type
subClassOf: Defines the parent class
mayContain and mustContain: Defines any optional and mandatory attributes for instantiated objects of the class

The lDAPDisplayName also needs to be set and should be equal to the common name (cn) as a general rule. Even though many of the default classes do not use the same name for the common name and LDAP display name, using the same name is highly recommended to avoid confusion when referencing the class. Another best practice is to set the schemaIDGUID of the class, which is especially important if you are doing anything with extended rights. The See Also section contains references to recipes that cover some of these topics in more depth.

10.9.4 See Also

Introduction in Chapter 10 for attributes of classSchema objects, Recipe 10.3 for generating an OID, Recipe 10.4 for generating a GUID, Recipe 10.17 for more on object class type, Recipe 10.19 for setting the default security for a class, and Recipe 10.22 for reloading the schema cache