In the objectclass schema definition you must have one of MAY or MUST, otherwise there
 are no attributes considered legal by adding your supplimentary objectclass to an object, it wont affect what attributes are considered valid (valid attributes in your case are determined by the superset attributes which are allowed by the other objectclass values).<br>


<br>The MAY attribute you commented out does not look valid, IMHO.. from the shipped schemas :<br><br>objectclass     ( 2.16.840.1.113730.3.2.2<br>    NAME &#39;inetOrgPerson&#39;<br>        DESC &#39;RFC2798: Internet Organizational Person&#39;<br>
    SUP organizationalPerson<br>    STRUCTURAL<br>        MAY (<br>                audio $ businessCategory $ carLicense $ departmentNumber $<br>                displayName $ employeeNumber $ employeeType $ givenName $<br>
                homePhone $ homePostalAddress $ initials $ jpegPhoto $<br>                labeledURI $ mail $ manager $ mobile $ o $ pager $<br>                photo $ roomNumber $ secretary $ uid $ userCertificate $<br>                x500uniqueIdentifier $ preferredLanguage $<br>
                userSMIMECertificate $ userPKCS12 )<br>        )<br><br>The first character after MAY should be &quot;(&quot; with a dollar delimited list of allowed attribute names, with a closing &quot;)&quot; <br><br>
Cheers<br>
Brett<br><br><div class="gmail_quote">On Wed, Oct 5, 2011 at 2:52 AM, Bryce Powell <span dir="ltr">&lt;<a href="mailto:Bryce.Powell@telus.com" target="_blank">Bryce.Powell@telus.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">









<div>
<font face="Calibri, sans-serif" size="2">
<div>Hi,</div>
<div> </div>
<div>I need an attribute to store password expiry date for the inetOrgPerson objectClass entries in my directory. Since I could not find this or similar attribute in the existing set of schemas (including the ppolicy schema), I have tried to implemented an
extension in a custom local.schema:</div>
<div> </div>
<div>objectclass ( 1.3.6.1.4.1.22280.1021.4.1 NAME &#39;x-sdids-enPortal&#39;</div>
<div>        DESC &#39;Indicates that this entry has additional attributes used by enPortal.&#39;</div>
<div>        AUXILIARY )</div>
<div># The “MAY” directive below prevents slapd form starting, and is therefore commented out.</div>
<div>#        MAY 1.3.6.1.4.1.22280.1021.3.1 )</div>
<div> </div>
<div>attributeType ( 1.3.6.1.4.1.22280.1021.3.1 NAME &#39;x-sdids-passwordExpirationTime&#39;</div>
<div>        DESC &#39;TELUS defined password policy attribute type used by enPortal.&#39;</div>
<div>        EQUALITY generalizedTimeMatch</div>
<div>        ORDERING generalizedTimeOrderingMatch</div>
<div>        SYNTAX 1.3.6.1.4.1.1466.115.121.1.24</div>
<div>        SINGLE-VALUE</div>
<div>        USAGE userApplications )</div>
<div> </div>
<div> </div>
<div>I figured the best bet would be an auxiliary objectClass. After including the new local.schema file in the slapd.conf, and restarting slapd, I get an error when trying to add the new attribute value to an existing or new inetOrgPerson entry:</div>



<div> </div>
<div>Oct  4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 MOD dn=&quot;uid=<a href="mailto:john@abc.com" target="_blank">john@abc.com</a>,ou=CUSTOMER,ou=Users,dc=private,dc=sdi&quot;</div>
<div>Oct  4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 MOD attr=x-sdids-passwordExpirationTime</div>
<div>Oct  4 10:37:43 vmsdildap04 slapd[31176]: Entry (uid= <a href="mailto:john@abc.com" target="_blank">john@abc.com</a>,ou=CUSTOMER,ou=Users,dc=private,dc=sdi), attribute &#39;x-sdids-passwordExpirationTime&#39; not allowed</div>



<div>Oct  4 10:37:43 vmsdildap04 slapd[31176]: entry failed schema check: attribute &#39;x-sdids-passwordExpirationTime&#39; not allowed</div>
<div>Oct  4 10:37:43 vmsdildap04 slapd[31176]: conn=1 op=22 RESULT tag=103 err=65 text=attribute &#39;x-sdids-passwordExpirationTime&#39; not allowed</div>
<div> </div>
<div>I believe this error 65, as per the OpenLDAP docs, is:</div>
<a name="132d223e1d223fbc_132d1fa0118b5ddf_132cfe56db58b530_objectClassViolation_(65)"></a>
<div style="margin-top:5pt;margin-bottom:5pt">H.35. objectClassViolation (65)<br>

<font face="Times New Roman, serif" size="3">Indicates that the entry violates object class restrictions.</font></div>
<div>The value I am specifying for the attribute is 20111004164129Z</div>
<div> </div>
<div>I have also tried to first add an objectClass attribute value to an existing entry with value ‘x-sdids-enPortal’, and then add the ‘x-sdids-passwordExpirationTime’ attribute value, with the same outcome.</div>
<div> </div>
<div>Thanks,</div>
<div>Bryce Powell<br>

</div>
<div> </div>
<div> </div>
<div> </div>
</font>
</div>

</blockquote></div><br><br clear="all"><br>-- <br><b>The only thing that  interferes with my learning is my education.</b><br>
      <b><br>Albert Einstein</b><br><br>