Samba AD schema extensions

From SambaWiki
Revision as of 08:21, 30 March 2012 by Ekacnet (talk | contribs)

Schema extension in Samba 4

Samba 4 supports same kind of schema extensions as Microsoft Active Directory. Generally speaking schema update in AD is a sensitive action and you must be prepared to restore the DC holding the role of schema master if something goes wrong.

This is even more true in Samba 4 not always generate some critical attributes, that are generated on Microsoft AD, this lack of attribute could lead to a unstartable samba provision. That's why currently schema updates in Samba 4 are disabled by default.

In order to allow them, the option dsdb:schema update allowed has to be set to true in the smb.conf or passed on the command line.

Tested Schema extensions

As getting an LDIF that won't ruined the provision can be hard the following of this page will list LDIFs that are known not to break the database. Perform those updates only if you need them and if you know how to restore the provision on the schema master.


This extension allow you to store in LDAP automount information. In order to add this extension here are the steps:

  • Download File:Automount template.ldif.txt, this is a template that will be transformed in the next steps
  • Locate the rootDN of your provision: ldbsearch -H ldap://ip_of_server -U administrator -s base dn
  • Run cat automount_template.ldif | sed 's/DOMAIN_TOP_DN/value_of_rootDN_obtained_in_previous_step/' > automount.ldif
  • Stop Samba4 on the schema master
  • Copy automount.ldif to the schema master server (if you were working on a different server)
  • Apply the ldif with a command similar to: ldbmodify -H path_to_sam_ldb automount.ldif --option="dsdb:schema update allowed"=true --noautocommit