A simple under the covers description of NTLM/Kerberos

I did not write this, but I liked it. All credit to Summit7.

NTLM

NTLM is a Windows challenge/response authentication protocol that leverages the interactive use of a login box that requires the end user to input their network credentials manually. Those credentials would include the users Username, password and domain name if logging into an organizations domain.

Plain English: end users log in by entering a username, password and domain into a login box. That being said we need to understand at least the basics of the process.

1. NTLM authenticates end users by first creating an encrypted one-way hash of the users password, discarding the original password and then sending the user name to the server in plain text.
2. The server responds to the client with a 16-bit challenge called a nonce.
3. The client encrypts the nonce and the hash of the users password and returns them to the server. This is the Response.
4. The server in turn sends three items to the domain controller; the users name, the challenge sent to the client and the clients response to the challenge. The domain controller retrieves the hash of the user name is has received from the Security Account Manager (SAM) database and uses that hash to encrypt the challenge.
5. Once the challenge has been encrypted by the domain controller it is compared to the challenge encrypted by the client and if they match the end user is authenticated successfully.

Plain English: If you enter your password incorrectly the hashes will not match and you won’t be able to log into the network.

Kerberos

The Kerberos security protocol has been a part of Windows since Windows Server 2000 and was intended as a replacement for NTLM. Obviously that hasn’t happened and the two can often be found working together or in a mixture across Windows environments everywhere.

Kerberos is a Windows Security Protocol designed to authenticate users and services on an organisations network and relies on three components; a client, a service and a trusted third party. The trusted third party in most Windows networks would likely be the Key Distribution Center (KDC) which creates the shared secret that is leveraged to allow access to the service. A simple view of the process might look like this:

1. A user account is created in the domain and assigned a password.
2. The Kerberos client adds a text string, or a SALT and the Kerberos version number to the unencrypted password and runs them through a process known as the “string2key” This conversion generates the “shared secret”.
3. At the client the user enters their username and password and requests access to an application or service.
4. When the user submits their username and password the Kerberos client creates the secret key on the client based on that information. Because the client uses the same key to generate the secret key that the KDC does the two will match, or should anyway. If they don’t match authentication fails and access id denied.

Plain English: If you enter your password incorrectly the hashes will not match and you won’t be able to log into the network.

Thanks to Summit7 for this – full link –> http://summit7systems.com/claims-based-authentication-adfs-3-0-and-sharepoint-2013-beginners-guide/

Script to strip out details from phone numbers ( brackets in this example )

 

 

#requires -Modules ActiveDirectory

<#

.SYNOPSIS

    Removes and brackets () from phone number fields of an Active Directory

.EXAMPLE

    .\Remove brackets from phones.ps1

.NOTES

   Developed By:

     n: Dave Colvin

     e: dave.colvin_at_experteq.com

     m : +61411265846

#>

Import-Module ActiveDirectory

clear-host

Get-ADUser -Filter {sAMAccountName -like "dave.colv.in*"} -SearchBase "OU=Users,DC=int" -searchscope subtree -Properties telephoneNumber, facsimileTelephoneNumber, homePhone, ipPhone, displayName |

foreach {

write-host "updating -> " $_.displayName

if ($_.telephoneNumber) {set-aduser -identity $_ -replace @{telephoneNumber=$_.telephoneNumber -replace '[()]',''}}

if ($_.facsimileTelephoneNumber) {set-aduser -identity $_ -replace @{facsimileTelephoneNumber=$_.facsimileTelephoneNumber -replace '[()]',''}}

if ($_.homePhone) {set-aduser -identity $_ -replace @{homePhone=$_.homePhone -replace '[()]',''}}

#if ($_.ipPhone) {set-aduser -identity $_ -replace @{ipPhone=$_.ipPhone -replace '[()]',''}}

            }

Script to read in email addresses and set passwords, enable accounts

Hopefully the blog does not mundge the code… Self explanatory I hope…

 

 

Import-Module activedirectory

# Based on email addresses in file, sets password to common or predefined (choose below) and enable accounts

#

#format of CSV:

#

#importfile.csv

#email,password

#First.Last@ment.gov.au,SecretPassword!1

#dave.colv.in,SecretPassword!1

#Write-Output "Startup "

Import-Csv ".\ChurnReset.csv" | Foreach {

$email = $_.email

$dynamicPW = $_.password     #use this the passwords in the CSV

$setPW = "davecolvin00111!!" #use this for a preset password

#Write-Output "checking user -> $email password -> $dynamicPW"

try {

#Get-ADUser $user

$user = Get-ADUser -Filter {mail -like $email } -SearchBase "DC=dec,DC=int" -searchscope subtree -Properties samAccountName

Set-ADAccountPassword $user -NewPassword (ConvertTo-SecureString $setPW -AsPlainText -force) -Reset

Enable-ADAccount $user

Write-Output "$user, Password reset and enabled"

    } catch

    { Write-Output "$user,Error" }

}   # <-remove if you want a log file instead of screen       | Out-File PassChange.log

Azure Active Directory editions

The Free edition of Azure Active Directory is part of every Azure subscription. There is nothing to license and nothing to install. With it, you can manage user accounts, synchronise with on-premises directories, get single sign-on across Azure, Office 365, and thousands of popular SaaS applications like Salesforce, Google Apps, ServiceNow, Dropbox, etc.

Azure AD premium is what you will need for password self service in the cloud and AD write back.

The Microsoft Enterprise Mobility Suite (EMS) discount makes it the most cost-effective way to acquire the included cloud services:

1. Microsoft Azure Active Directory Premium for hybrid identity management, Microsoft Intune and Microsoft Azure Rights Management for information protection

Features	Free edition	Basic edition	Premium edition
Directory as a service	Up to 500K objects	No object limit	No object limit
User and group management using UI or Windows PowerShell cmdlets	Tick	Tick	Tick
Device registration	Tick	Tick	Tick
Access Panel portal for SSO-based user access to SaaS and custom applications	Tick Up to 10 apps per user	Tick Up to 10 apps per user	No app limit
User-based application access management and provisioning	Tick	Tick	Tick
Self-service password change for cloud users	Tick	Tick	Tick
Azure AD Connect – For syncing between on-premises directories and Azure Active Directory	Tick	Tick	Tick
Standard security reports	Tick	Tick	Tick
Features		Basic edition	Premium edition
High availability SLA uptime (99.9%)		Tick	Tick
Group-based application access management and provisioning		Tick	Tick
Customisation logo and colours to the Sign In and Access Panel pages		Tick	Tick
Self-service password reset for cloud users		Tick	Tick
Application Proxy: Secure Remote Access and SSO to on-premises web applications		Tick	Tick
Features			Premium edition
Advanced application usage reporting			Tick
Self-service group management for cloud users			Tick
Self-service password reset with on-premises write-back			Tick
Microsoft Identity Manager (MIM) user licenses – For on-premises identity and access management			Tick
Advanced anomaly security reports (machine learning-based)			Tick
Cloud app discovery			Tick
Multi-Factor Authentication service for cloud users			Tick
Multi-Factor Authentication server for on-premises users			Tick

Multi-Factor Authentication is included with Premium and can secure access to on-premises applications (VPN, RADIUS, etc.), Azure, Microsoft Online Services like Office 365 etc.

Microsoft Identity Manager (MIM) - Premium comes with the option to grant rights to use a MIM server (and CALs) in your on-premises network to support any combination of Hybrid Identity solutions. This is a great option if you have a variation of on-premises directories and databases that you want to sync directly to Azure Active Directory. There is no limit on the number of FIM servers you can use, however, MIM CALs are granted based on the allocation of an Azure.

 

Note, if you have SSPR on prem too?

Q: Can I synchronise data for security questions from on premises?
A: No, this is not possible today, but Microsoft are considering it.

Note2, locked out account?

Q: Do you unlock the local active directory accounts when users reset their passwords?

A: Yes, when a user resets his or her password and password writeback has been deployed with versions of AADSync 1.0.0485.0222 or later, then that user’s account will be automatically unlocked when that user resets his or her password.

Note3 & 4, worries about hackerz?

Q: Do you prevent users from attempting password reset many times in a short time period?

A: Yes, Users may only try 5 password reset attempts within an hour before being locked out for 24 hours. Users may only try to validate a phone number 5 times within an hour before being locked out for 24 hours. Users may only try a single authentication method 5 times within an hour before being locked out for 24 hours.

Q: For how long are the email and SMS one-time passcode valid?

A: The session lifetime for password reset is 105 minutes. This means that from the beginning of the password reset operation, the user has 105 minutes to reset his or her password. The email and SMS one-time passcode are invalid after this time period expires.

 

 

 

 

Azure AD versions: https://msdn.microsoft.com/en-us/library/azure/dn532272.aspx

Azure AD Password writeback: https://msdn.microsoft.com/en-us/library/azure/dn903642.aspx

Setting up SSRP: https://msdn.microsoft.com/en-us/library/azure/dn683881.aspx

Snapshot of Active Directory in Windows Server 2012 R2

Open a PowerShell window and type:

• NTDSUTIL
• SNAPSHOT
• ACTIVATE INSTANCE NTDS
• CREATE

Note the GUID that is created (above mine is 4f54…….), or just leave the CMD prompt open. You can LIST ALL to see the GUIDs later.

QUIT and QUIT to exit from snapshot or you can mount that GUID

If you did quit, use

• NTDSUTIL
• SNAPSHOT
• ACTIVATE INSTANCE NTDS
• LIST ALL

If you  just enter the next command it is

• MOUNT YOUR-GUID-YOU-WANT

QUIT and QUIT to exit from the mount process

To start the ADDS and export files from it find the name of the snapshot with DIR C:\$*.*

Then start it up with

• DSAMAIN /DBPATH C:\$SNAP_date&time_VOLUMEC$\WINDOWS\NTDS\NTDS.DIT /LDAPPORT 6660

Leave DSAMAIN / CMD running in the background

Open Active Directory Users and Computers (or LDIFDE etc) and select CHANGE DOMAIN CONTROLLER YOURCOMPUTERNAME:6660

This is the old Active Directory from the backup.

Note what you need or export what you need etc.

When finished close the command prompt or press CTRL+C to stop DSAMAIN.EXE

To close the open snapshot issue the following commands

• NTDSUTIL
• SNAPSHOT
• ACTIVATE INSTANCE NTDS
• LIST ALL
• UNMOUNT YOUR-GUID
• QUIT, QUIT

Done. Now you just need a daily, weekly task to do the backup.

Active Directory Forest and Domain Levels

 

Features that are available at domain functional levels

The following table shows the features that are available at each domain functional level.

Domain functional level	Available features	Supported domain controller operating systems
Windows 2000 native	All of the default AD DS features and the following directory features are available: Universal groups for both distribution and security groups. Group nesting Group conversion, which allows conversion between security and distribution groups Security identifier (SID) history. Note In Windows Server 2008 R2, the Personal Virtual Desktop feature was introduced. It requires the Windows 2000 native domain functional level	Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 Windows 2000
Windows Server 2003	All the default AD DS features, all the features that are available at the Windows 2000 native domain functional level, and the following features are available: The domain management tool, Netdom.exe, which makes it possible for you to rename domain controllers Logon time stamp updates The lastLogonTimestamp attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain. The ability to set the userPassword attribute as the effective password on inetOrgPerson and user objects The ability to redirect Users and Computers containers. By default, two well-known containers are provided for housing computer and user accounts, namely, cn=Computers,<domain root> and cn=Users,<domain root>. This feature allows the definition of a new, well-known location for these accounts. The ability for Authorisation Manager to store its authorisation policies in AD DS Constrained delegation Constrained delegation makes it possible for applications to take advantage of the secure delegation of user credentials by means of Kerberos-based authentication. You can restrict delegation to specific destination services only. Selective authentication Selective authentication makes it is possible for you to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Windows Server 2008 Windows Server 2003
Windows Server 2008	All of the default AD DS features, all of the features from the Windows Server 2003 domain functional level, and the following features are available: Distributed File System (DFS) replication support for the Windows Server 2003 System Volume (SYSVOL) Last Interactive Logon Information Fine-grained password policies Personal Virtual Desktops	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Windows Server 2008
Windows Server 2008 R2	All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following features: Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorisation based on a user’s logon method. Automatic SPN management for services running on a particular computer under the context of a Managed Service Account when the name or DNS host name of the machine account changes.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2
Windows Server 2012	The KDC support for claims, compound authentication, and Kerberos armoring KDC administrative template policy has two settings (Always provide claims and Fail unarmored authentication requests) that require Windows Server 2012 domain functional level.	Windows Server 2012 R2 Windows Server 2012
Windows Server 2012 R2	DC-side protections for Protected Users. Protected Users authenticating to a Windows Server 2012 R2 domain can no longer: Authenticate with NTLM authentication Use DES or RC4 cipher suites in Kerberos pre-authentication Be delegated with unconstrained or constrained delegation Renew user tickets (TGTs) beyond the initial 4 hour lifetime Authentication Policies (forest-based Active Directory) Authentication Policy Silos	Windows Server 2012 R2

 

Features that are available at forest functional levels

The following table shows the features that are available at each forest functional level.

Forest functional level	Available features	Supported domain controllers
Windows 2000	All of the default AD DS features are available.	Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 Windows 2000
Windows Server 2003	All of the default AD DS features, and the following features, are available: Forest trust Domain rename Linked-value replication (change group membership replicate values for individual members instead of replicating the entire membership ) The ability to deploy a read-only domain controller (RODC) Improved Knowledge Consistency Checker (KCC) algorithms and scalability The ability to create instances of the dynamic auxiliary class named dynamicObject in a domain directory partition The ability to convert an inetOrgPerson object instance into a User object instance, and to complete the conversion in the opposite direction The ability to create instances of new group types to support role-based authorisation. These types are called application basic groups and LDAP query groups. Deactivation and redefinition of attributes and classes in the schema. The following attributes can be reused: ldapDisplayName, schemaIdGuid, OID, and mapiID. Domain-based DFS namespaces running in Windows Server 2008 Mode, which includes support for access-based enumeration and increased scalability.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Windows Server 2008 Windows Server 2003
Windows Server 2008	All of the features that are available at the Windows Server 2003 forest functional level, but no additional features are available. All domains that are subsequently added to the forest, however, operate at the Windows Server 2008 domain functional level by default.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Windows Server 2008
Windows Server 2008 R2	All of the features that are available at the Windows Server 2003 forest functional level, plus the following features: Active Directory Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running. All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default. If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest.	Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2
Windows Server 2012	All of the features that are available at the Windows Server 2008 R2 forest functional level, but no additional features. All domains that are subsequently added to the forest will operate at the Windows Server 2012 domain functional level by default.	Windows Server 2012 R2 Windows Server 2012
Windows Server 2012 R2	All of the features that are available at the Windows Server 2012 forest functional level, but no additional features. All domains that are subsequently added to the forest will operate at the Windows Server 2012 R2 domain functional level by default.	Windows Server 2012 R2

 

Guidelines for raising domain and forest functional levels

The following guidelines apply to raising the domain or forest functional levels:

You must be a member of the Domain Admins group to raise the domain functional level.

You must be a member of the Enterprise Admins group to raise the forest functional level.

You can raise the domain functional level on the primary domain controller (PDC) emulator operations master only. The AD DS administrative tools that you use to raise the domain functional level (the Active Directory Domains and Trusts snap-in and the Active Directory Users and Computers snap-in) automatically target the PDC emulator when you raise the domain functional level.

You can raise the forest functional level on the schema operations master only. Active Directory Domains and Trusts automatically targets the schema operations master when you raise the forest functional level.

You can raise the functional level of a domain only if all domain controllers in the domain run the version or versions of Windows Server that the new functional level supports.

You can raise the functional level of a forest only if all domain controllers in the forest run the version or versions of Windows Server that the new functional level supports.

You cannot set the domain functional level to a value that is lower than the forest functional level, but you can set it to a value that is equal to or higher than the forest functional level.

With versions of Windows Server that are earlier than Windows Server 2008 R2, you cannot roll back or lower a functional level under any circumstances. If you have to revert to a lower functional level with a version of Windows Server that is earlier than Windows Server 2008 R2, you must rebuild the domain or forest or restore it from a backup copy.

After you set the domain functional level, you cannot roll back or lower the domain functional level except in the cases listed in the following table. The domain functional level can be lowered only by using Windows PowerShell.

Current domain functional level	Current forest functional level	Rollback options
Windows Server 2012 R2	Windows Server 2012 R2	None unless you first lower forest functional level
Windows Server 2012 R2	Windows Server 2012	Windows Server 2012
Windows Server 2012 R2	Windows Server 2008 R2	Windows Server 2012 or Windows Server 2008 R2
Windows Server 2012 R2	Windows Server 2008	Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008
Windows Server 2012	Windows Server 2012	None unless you first lower forest functional level
Windows Server 2012	Windows Server 2008 R2	Windows Server 2008 R2
Windows Server 2012	Windows Server 2008	Windows Server 2008 R2 or Windows Server 2008
Windows Server 2008 R2	Windows Server 2008 R2	None unless you first lower forest functional level
Windows Server 2008 R2	Windows Server 2008	Windows Server 2008
Windows Server 2008 or lower	Windows Server 2008 or lower	None

After you set the forest functional level, you cannot roll back or lower the forest functional level except in the cases listed in the following table. The forest functional level can be lowered only by using Windows PowerShell.

 

Current forest functional level	Recycle Bin enabled?	Rollback options
Windows Server 2012 R2	Yes	Windows Server 2012 or Windows Server 2008 R2
Windows Server 2012 R2	No	Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2
Windows Server 2012	Yes	Windows Server 2008 R2
Windows Server 2012	No	Windows Server 2008 R2 or Windows Server 2008
Windows Server 2008 R2	Yes	None
Windows Server 2008 R2	No	Windows Server 2008

 

Source material: http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels(v=ws.10).aspx

Checking if the AD Domain is Server 2012 ready

 

Use the Dsquery.exe command. Open a command prompt on a domain controllers and run:

dsquery * cn=schema,cn=configuration,dc=colv,dc=in -scope base -attr objectVersion

The output from a 2008 domain is:
objectVersion
47

If you promote a Windows Server 2012 in the domain OR manually run ADPrep.

The output from the command looks like this:
objectVersion
56

Version 56 of the schema of your forest now includes domain controllers running Windows Server 2012.

AD:DS verses AD:LDS

 

You have a requirement to provide an LDAP directory service to applications. And as a part of this there has been a discussion comparing full Active Directory (AD:DS) verses an Active Directory as an LDAP instance (AD:LDS).

The key differentiators between the two services are:

 

Active Directory Domain Services

Active Directory was designed and built in the late nineties for release with Windows Server 2000. The system was a direct replacement for Windows NT 4 Domains but is based on the X.500 standards. The solution was built as a replacement for file and print management but always contained methods to extend the schema and therefore extending functionality.

 

Active Directory Lightweight Directory Service

Designed and delivered as a direct competitor to traditional LDAP services such as iPlanet LDAP server AD:LDS (released as ADAM in Windows Server 2003) uses the same code base as traditional Active Directory but decouples many of the file and print specific details such as Domain Controllers , Domains and Forests. With a traditional Active Directory there is a single instance per server of the directory whereas AD:LDS can run many different ‘services’ on the same computer. AD:LDS comes without most schema objects to allow for custom schemas and is ideally suited to multi-million objects in web facing environment.

 

Comparing Services

Many of the features are listed below and shown if they are supported on both platforms.

Feature	AD:DS	AD:LDS
Forest and Domain	Yes	No
Sites	Yes	Yes
Run as a services	No	Yes
Trusts	Yes	No
LDAP 2/3	Yes	Yes
Kerberos	Yes	Partial
DNS Integration (SRV records required)	Yes	No
Schema modification	Yes	Yes
Computer objects (required)	Yes	No
Hosts computers (domain members)	Yes	No
Unique names (SAMaccountName)	Yes	Yes
Support iNetOrgPerson	Yes	Yes
Static ACL (stamped)	Yes	Yes
Global Catalogue	Yes	No
Custom Indexed objects	Yes	Yes
Scale (above 1 billion objects)	Yes	Yes
FSMOs	Yes	Yes
Trusts – Traditional Kerberos	Yes	No
SAML support	Yes	Yes
ADFS support	Yes	Yes
Group policy support	Yes	Partial
GPO based object rules	Yes	No
Active Directory Users and Computers support	Yes	No
LDAP tool support	Yes	Yes
ADSI Edit	Yes	Yes
Server Core support	Yes	Yes
Self-managed (via GPO)	Yes	No
Event log	Yes	Partial
Auditing	Yes	Partial
Higher computing power required	Yes	No
Built in Active Directory sync tool	No	Yes
Security outside of “Domain Admins”	No	Yes

 

High-level comparison

Some of the key aspects of Active Directory verse LDS.

Key: The larger area is best.

EduPerson, AuEduPerson, schac Schema for Active Directory

 

As part of moving a Sydney University from Sun/Oracle iPlanet LDAP directory to Active Directory I have to support the educational standard objects, EduPerson, the Australian specific options required by the AFF, AuEduPerson, the university is also using the schac, the Schema for Academia. All three of these are out on the internets in different formats but not all were available for AD. I have taken these works, additional information from the schema documentation and converted them or updated them to support AD direct import. I have also be provided these to the AAF to list in there ‘files’ section of there web site.

These have all been tested on AD domain and forest modes 2003-2008r2 on Windows 2008 R2.

Make sure you turn on Advanced Features in AD users and computers to see them. And to enable the schema manager use the command “regsvr32 c:\Windows\System32\schmmgmt.dll”

   

To import these files, from a Domain Controller logged on as a Schema Admin run the following, you can run this remotely to the DC, but the command line is horrible…:

ldifde -i -f "eduPerson-active directory.ldf" -v

ldifde -i -f "aueduPerson-active directory.ldf" -v

ldifde -i -f "schac-active directory.ldf" -v

 

You will notice in some attributes the “searchFlags: 1” setting is on for some key attributes, this is anticipating searching and managing performance, this can be changed in the GUI or in the schema once scale testing is underway, this may also need to be enabled for some POSIX / PAM settings.

 

Following are the three schema files.

AuEduPerson

# ========================================================================================================================
#
#  File:    auEduPerson-active directory.ldf
#  Version: 20121130
#
#  Updated by Dave Colvin, http://davestechnology.blogspot.com.au/ for direct AD import
#
#  This file should be imported with the following command while logged in to the Domain Controller as an Admin User:
#    ldifde -i -f -v auEduPerson.ldif
#
#  REMEMBER TO SEARCH AND REPLACE DC=XXX,DC=EDU,DC=AU WITH YOUR DC SUFFIX
#
# ========================================================================================================================
#  Attributes
# ========================================================================================================================
#
dn: CN=auEduPersonAffiliation,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: auEduPersonAffiliation
lDAPDisplayName: auEduPersonAffiliation
adminDisplayName: auEduPersonAffiliation
adminDescription: Specifies a person's relationship to the institution in broad categories but with a finer-grained set of permissible values than eduPersonAffiliation.
attributeID: 1.3.6.1.4.1.27856.1
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: FALSE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=auEduPersonLegalName,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: auEduPersonLegalName
lDAPDisplayName: auEduPersonLegalName
adminDisplayName: auEduPersonLegalName
adminDescription: The user’s legal name, as per their passport, birth certificate, or other legal document.
attributeID: 1.3.6.1.4.1.27856.2
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: TRUE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=auEduPersonSharedToken,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: auEduPersonSharedToken
lDAPDisplayName: auEduPersonSharedToken
adminDisplayName: auEduPersonSharedToken
adminDescription: A unique identifier enabling federation spanning services such as Grid and Repositories. Values of the identifier are generated using a set formula. The value has the following qualities: unique; opaque; non-targeted; persistent; resolvable (only by an IdP that has supplied it); not re-assignable; not mutable (refreshing the value is equivalent to creating a new identity); permitted to be displayed (Note: the value is somewhat display friendly, and may be appended to the displayName with a separating space, and used as a unique display name to be included in PKI Certificate DNs and as a resource ownership label, e.g. John Citizen ZsiAvfxa0BXULgcz7QXknbGtfxk ); and portable.
attributeID: 1.3.6.1.4.1.27856.3
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: TRUE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-
# ========================================================================================================================
#  Object classes
# ========================================================================================================================

dn: CN=auEduPerson,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: auEduPerson
lDAPDisplayName: auEduPerson
adminDisplayName: auEduPerson
adminDescription: Consists of a set of data elements or attributes about individuals within Australian higher education
governsID: 1.3.6.1.4.1.27856
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.27856.1
mayContain: 1.3.6.1.4.1.27856.2
mayContain: 1.3.6.1.4.1.27856.3
defaultObjectCategory: CN=EduPerson,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: auEduPerson
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

# ========================================================================================================================

 

EduPerson

# ========================================================================================================================
#
#  File:    eduPerson-active directory.ldf
#  Version: 200806
#
#  Updated by Dave Colvin, http://davestechnology.blogspot.com.au/ for direct AD import
#
#  This file should be imported with the following command while logged in to the Domain Controller as an Admin User:
#    ldifde -i -f eduPerson-active directory.ldif -v
#
#  REMEMBER TO SEARCH AND REPLACE DC=XXX,DC=EDU,DC=AU WITH YOUR DC SUFFIX
#
# ========================================================================================================================

# ========================================================================================================================
#  Attributes
# ========================================================================================================================

dn: CN=eduPersonAffiliation,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonAffiliation
lDAPDisplayName: eduPersonAffiliation
adminDisplayName: eduPersonAffiliation
adminDescription: Specifies the person's relationship(s) to the institution, permissible values: faculty, student, staff, alum, member, affiliate, employee
attributeID: 1.3.6.1.4.1.5923.1.1.1.1
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: FALSE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonNickname,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonNickname
lDAPDisplayName: eduPersonNickname
adminDisplayName: eduPersonNickname
adminDescription: Person's nickname, or the informal name by which they are accustomed to be hailed
attributeID: 1.3.6.1.4.1.5923.1.1.1.2
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: FALSE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonOrgDN,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonOrgDN
lDAPDisplayName: eduPersonOrgDN
adminDisplayName: eduPersonOrgDN
adminDescription: Specifies the person's relationship(s) to the institution, permissible values: faculty, student, staff, alum, member, affiliate, employee
attributeID: 1.3.6.1.4.1.5923.1.1.1.3
attributeSyntax: 2.5.5.1
oMSyntax: 127
isSingleValued: TRUE
searchFlags: 0
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonOrgUnitDN,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonOrgUnitDN
lDAPDisplayName: eduPersonOrgUnitDN
adminDisplayName: eduPersonOrgUnitDN
adminDescription: The distinguished name(s) (DN) of the directory entries representing the person's Organizational Unit(s)
attributeID: 1.3.6.1.4.1.5923.1.1.1.4
attributeSyntax: 2.5.5.1
oMSyntax: 127
isSingleValued: FALSE
searchFlags: 0
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonPrimaryAffiliation,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonPrimaryAffiliation
lDAPDisplayName: eduPersonPrimaryAffiliation
adminDisplayName: eduPersonPrimaryAffiliation
adminDescription: Specifies the person's PRIMARY relationship to the institution in broad categories such as student, faculty, staff, alum, etc
attributeID: 1.3.6.1.4.1.5923.1.1.1.5
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: TRUE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonPrincipalName,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonPrincipalName
lDAPDisplayName: eduPersonPrincipalName
adminDisplayName: eduPersonPrincipalName
adminDescription: The "NetID" of the person for the purposes of inter-institutional authentication. It should be represented in the form "user@scope" where scope defines a local security domain
attributeID: 1.3.6.1.4.1.5923.1.1.1.6
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: TRUE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonEntitlement,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonEntitlement
lDAPDisplayName: eduPersonEntitlement
adminDisplayName: eduPersonEntitlement
adminDescription: URI (either URN or URL) that indicates a set of rights to specific resources
attributeID: 1.3.6.1.4.1.5923.1.1.1.7
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: FALSE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonPrimaryOrgUnitDN,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonPrimaryOrgUnitDN
lDAPDisplayName: eduPersonPrimaryOrgUnitDN
adminDisplayName: eduPersonPrimaryOrgUnitDN
adminDescription: The distinguished name (DN) of the directory entry representing the person's primary Organizational Unit(s)
attributeID: 1.3.6.1.4.1.5923.1.1.1.8
attributeSyntax: 2.5.5.1
oMSyntax: 127
isSingleValued: TRUE
searchFlags: 0
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonScopedAffiliation,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonScopedAffiliation
lDAPDisplayName: eduPersonScopedAffiliation
adminDisplayName: eduPersonScopedAffiliation
adminDescription: Specifies the person's affiliation (see eduPersonAffiliation) within a particular security domain, the values consist of a left (affiliation) and right component (security domain) separated by an "@" sign
attributeID: 1.3.6.1.4.1.5923.1.1.1.9
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: FALSE
searchFlags: 1
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonTargetedID,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonTargetedID
lDAPDisplayName: eduPersonTargetedID
adminDisplayName: eduPersonTargetedID
adminDescription: Specifies the person's relationship(s) to the institution, permissible values: faculty, student, staff, alum, member, affiliate, employee
attributeID: 1.3.6.1.4.1.5923.1.1.1.10
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: FALSE
searchFlags: 0
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn: CN=eduPersonAssurance,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: eduPersonAssurance
lDAPDisplayName: eduPersonAssurance
adminDisplayName: eduPersonAssurance
adminDescription: Set of URIs that assert compliance with specific standards for identity assurance.
attributeID: 1.3.6.1.4.1.5923.1.1.1.11
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: FALSE
searchFlags: 0
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

# ========================================================================================================================
#  Object classes
# ========================================================================================================================

dn: CN=eduPerson,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: eduPerson
lDAPDisplayName: eduPerson
adminDisplayName: eduPerson
adminDescription: Consists of a set of data elements or attributes about individuals within higher education
governsID: 1.3.6.1.4.1.5923.1.1.2
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.5923.1.1.1.1
mayContain: 1.3.6.1.4.1.5923.1.1.1.2
mayContain: 1.3.6.1.4.1.5923.1.1.1.3
mayContain: 1.3.6.1.4.1.5923.1.1.1.4
mayContain: 1.3.6.1.4.1.5923.1.1.1.5
mayContain: 1.3.6.1.4.1.5923.1.1.1.6
mayContain: 1.3.6.1.4.1.5923.1.1.1.7
mayContain: 1.3.6.1.4.1.5923.1.1.1.8
mayContain: 1.3.6.1.4.1.5923.1.1.1.9
mayContain: 1.3.6.1.4.1.5923.1.1.1.10
mayContain: 1.3.6.1.4.1.5923.1.1.1.11
defaultObjectCategory: CN=eduPerson,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: eduPerson
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1

# ========================================================================================================================

 

SchAc

# ========================================================================================================================
#  Based on file Schac-Schema-1.4-Sun.ldif (non experimental schema items)
#
#  File:    # schac-active directory.ldf
#  Version: 20121103
#
#  updated by Dave Colvin, http://davestechnology.blogspot.com.au/ for AD direct import...
#
#  This file should be imported with the following command while logged in to the Domain Controller as an Admin User:
#    ldifde -i -f eduPerson.ldif -v
#
#  REMEMBER TO SEARCH AND REPLACE DC=XXX,DC=EDU,DC=AU WITH YOUR DC SUFFIX
#

# ========================================================================================================================
#  Attributes
# ========================================================================================================================

dn: cn=schacMotherTongue,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
cn: schacMotherTongue
lDAPDisplayName: schacMotherTongue
adminDisplayName: schacMotherTongue
adminDescription: RFC 3066 code for prefered language of communication
attributeID: 1.3.6.1.4.1.25178.1.2.1
attributeSyntax: 2.5.5.12
oMSyntax: 64
isSingleValued: TRUE
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacGender,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.2
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
lDAPDisplayName: schacGender
cn: schacGender
oMSyntax: 64
adminDisplayName: schacGender
adminDescription: Representation of human gender (see ISO 5218)
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacDateOfBirth,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.3
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
lDAPDisplayName: schacDateOfBirth
cn: schacDateOfBirth
oMSyntax: 64
adminDisplayName: schacDateOfBirth
adminDescription: Date of birth (format YYYYMMDD, only numeric chars)
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacPlaceOfBirth,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.4
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
lDAPDisplayName: schacPlaceOfBirth
cn: schacPlaceOfBirth
oMSyntax: 64
adminDisplayName: schacPlaceOfBirth
adminDescription: Birth place of a person
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacCountryOfCitizenship,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.5
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacCountryOfCitizenship
cn: schacCountryOfCitizenship
oMSyntax: 64
adminDisplayName: schacCountryOfCitizenship
adminDescription: Country of citizenship of a person. Format two-letter acronym according to ISO 3166
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacSn1,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.6
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacSn1
cn: schacSn1
oMSyntax: 64
adminDisplayName: schacSn1
searchFlags: 1
showInAdvancedViewOnly: TRUE
adminDescription: First surname of a person
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacSn2,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.7
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacSn2
cn: schacSn2
oMSyntax: 64
adminDisplayName: schacSn2
searchFlags: 1
showInAdvancedViewOnly: TRUE
adminDescription: Second surname of a person
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacPersonalTitle,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.8
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
lDAPDisplayName: schacPersonalTitle
cn: schacPersonalTitle
oMSyntax: 64
adminDisplayName: schacPersonalTitle
adminDescription: RFC1274: personal title
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacHomeOrganization,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.9
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
lDAPDisplayName: schacHomeOrganization
cn: schacHomeOrganization
oMSyntax: 64
adminDisplayName: schacHomeOrganization
adminDescription: Domain name of the home organization
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacHomeOrganizationType,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.10
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
lDAPDisplayName: schacHomeOrganizationType
cn: schacHomeOrganizationType
oMSyntax: 64
adminDisplayName: schacHomeOrganizationType
adminDescription: Type of the home organization
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacCountryOfResidence,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.11
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacCountryOfResidence
cn: schacCountryOfResidence
oMSyntax: 64
adminDisplayName: schacCountryOfResidence
adminDescription: Country of citizenship of a person. Format two-letter acronym according to ISO 3166
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacUserPresenceID,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.12
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacUserPresenceID
cn: schacUserPresenceID
oMSyntax: 64
adminDisplayName: schacUserPresenceID
adminDescription: Used to store a set of values related to the network presence
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacPersonalPosition,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.13
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacPersonalPosition
cn: schacPersonalPosition
searchFlags: 1
showInAdvancedViewOnly: TRUE
oMSyntax: 64
adminDisplayName: schacPersonalPosition
adminDescription: Position inside an institution
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacPersonalUniqueCode,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.14
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacPersonalUniqueCode
cn: schacPersonalUniqueCode
oMSyntax: 64
searchFlags: 1
showInAdvancedViewOnly: TRUE
adminDisplayName: schacPersonalUniqueCode
adminDescription: unique code for the subject
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacPersonalUniqueID,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.15
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacPersonalUniqueID
cn: schacPersonalUniqueID
oMSyntax: 64
searchFlags: 1
showInAdvancedViewOnly: TRUE
adminDisplayName: schacPersonalUniqueID
adminDescription: Unique identifier for the subject
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacExpiryDate,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.17
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
lDAPDisplayName: schacExpiryDate
cn: schacExpiryDate
oMSyntax: 64
adminDisplayName: schacExpiryDate
adminDescription: Date from which the set of data is to be considered invalid (format YYYYMMDDhhmmssZ)
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacUserPrivateAttribute,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.18
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacUserPrivateAttribute
cn: schacUserPrivateAttribute
oMSyntax: 64
adminDisplayName: schacUserPrivateAttribute
adminDescription: Set of denied access attributes
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacUserStatus,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.19
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacUserStatus
cn: schacUserStatus
oMSyntax: 64
adminDisplayName: schacUserStatus
adminDescription: Used to store a set of status of a person as user of services
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacProjectMembership,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.20
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacProjectMembership
cn: schacProjectMembership
oMSyntax: 64
searchFlags: 1
showInAdvancedViewOnly: TRUE
adminDisplayName: schacProjectMembership
adminDescription: Name of the project
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacProjectSpecificRole,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.2.21
attributeSyntax: 2.5.5.12
isSingleValued: FALSE
lDAPDisplayName: schacProjectSpecificRole
cn: schacProjectSpecificRole
oMSyntax: 64
searchFlags: 1
showInAdvancedViewOnly: TRUE
adminDisplayName: schacProjectSpecificRole
adminDescription: Used to store a set of roles of a person inside a project
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: cn=schacYearOfBirth,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: top
objectClass: attributeSchema
attributeID: 1.3.6.1.4.1.25178.1.0.2.3
attributeSyntax: 2.5.5.12
isSingleValued: TRUE
lDAPDisplayName: schacYearOfBirth
cn: schacYearOfBirth
oMSyntax: 64
adminDisplayName: schacYearOfBirth
adminDescription: Year of birth (format YYYY, only numeric chars)
showInAdvancedViewOnly: TRUE
systemOnly: FALSE

dn:
changetype: Modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

# ========================================================================================================================
#  Object classes
# ========================================================================================================================

dn: CN=schacPersonalCharacteristics,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: schacPersonalCharacteristics
lDAPDisplayName: schacPersonalCharacteristics
adminDisplayName: schacPersonalCharacteristics
adminDescription: Personal characteristics describe the individual person represented by the entry
governsID: 1.3.6.1.4.1.25178.1.1.1
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.25178.1.2.8
mayContain: 1.3.6.1.4.1.25178.1.2.7
mayContain: 1.3.6.1.4.1.25178.1.2.6
mayContain: 1.3.6.1.4.1.25178.1.2.5
mayContain: 1.3.6.1.4.1.25178.1.2.4
mayContain: 1.3.6.1.4.1.25178.1.2.3
mayContain: 1.3.6.1.4.1.25178.1.2.2
mayContain: 1.3.6.1.4.1.25178.1.2.1
defaultObjectCategory: CN=schacPersonalCharacteristics,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: schacPersonalCharacteristics
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=schacContactLocation,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: schacContactLocation
lDAPDisplayName: schacContactLocation
adminDisplayName: schacContactLocation
adminDescription: Primary means of locating and contacting potential collaborators and other persons-of-interest at peer institutions
governsID: 1.3.6.1.4.1.25178.1.1.2
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.25178.1.2.12
mayContain: 1.3.6.1.4.1.25178.1.2.11
mayContain: 1.3.6.1.4.1.25178.1.2.10
mayContain: 1.3.6.1.4.1.25178.1.2.9
defaultObjectCategory: CN=schacContactLocation,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: schacContactLocation
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=schacEmployeeInfo,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: schacEmployeeInfo
lDAPDisplayName: schacEmployeeInfo
adminDisplayName: schacEmployeeInfo
adminDescription: Employee information includes attributes that have relevance to the employee role, such as position, office hours, and job title
governsID: 1.3.6.1.4.1.25178.1.1.3
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.25178.1.2.13
defaultObjectCategory: CN=schacEmployeeInfo,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: schacEmployeeInfo
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=schacLinkageIdentifiers,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: schacLinkageIdentifiers
lDAPDisplayName: schacLinkageIdentifiers
adminDisplayName: schacLinkageIdentifiers
adminDescription: Used to link a directory entry with records in external data stores or other directory entries
governsID: 1.3.6.1.4.1.25178
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.25178.1.2.15
mayContain: 1.3.6.1.4.1.25178.1.2.14
defaultObjectCategory: CN=schacLinkageIdentifiers,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: schacLinkageIdentifiers
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=schacEntryMetadata,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: schacEntryMetadata
lDAPDisplayName: schacEntryMetadata
adminDisplayName: schacEntryMetadata
adminDescription: Used to contain information about the entry itself, often its status, birth, and death
governsID: 1.3.6.1.4.1.25178.1.1.5
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.25178.1.2.17
defaultObjectCategory: CN=schacEntryMetadata,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: schacEntryMetadata
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=schacEntryConfidentiality,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: schacEntryConfidentiality
lDAPDisplayName: schacEntryConfidentiality
adminDisplayName: schacEntryConfidentiality
adminDescription: Used to indicate whether an entry is visible publicly, visible only to affiliates of the institution, or not visible at all
governsID: 1.3.6.1.4.1.25178.1.1.6
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.25178.1.2.18
defaultObjectCategory: CN=schacEntryConfidentiality,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: schacEntryConfidentiality
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=schacUserEntitlements,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: schacUserEntitlements
lDAPDisplayName: schacUserEntitlements
adminDisplayName: schacUserEntitlements
adminDescription: Authorization for services
governsID: 1.3.6.1.4.1.25178.1.1.7
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.25178.1.2.19
defaultObjectCategory: CN=schacUserEntitlements,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: schacUserEntitlements
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=schacGroupMembership,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: ntdsschemaadd
objectClass: classSchema
cn: schacGroupMembership
lDAPDisplayName: schacGroupMembership
adminDisplayName: schacGroupMembership
adminDescription: Groups used to provide/restrict authorization to entries and attributes
governsID: 1.3.6.1.4.1.25178.1.1.8
objectClassCategory: 3
subclassOf: top
rdnAttId: cn
mayContain: 1.3.6.1.4.1.25178.1.2.21
mayContain: 1.3.6.1.4.1.25178.1.2.20
defaultObjectCategory: CN=schacGroupMembership,cn=Schema,cn=Configuration,DC=xxx,DC=EDU,DC=AU
systemOnly: FALSE

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

dn: CN=User,CN=Schema,CN=Configuration,DC=xxx,DC=EDU,DC=AU
changetype: modify
add: auxiliaryClass
auxiliaryClass: schacGroupMembership
-

dn:
changetype: modify
add: schemaUpdateNow
schemaUpdateNow: 1
-

# ========================================================================================================================