LDAP_SCHEMA(3)

💅 LDAP_SCHEMA(3) — schema definition handling routines, bestie edition

okay so this is ldap_schema(3), a manual page from the Library Functions Manual, and it's literally all about parsing LDAP schema definitions and holding them in structs. it's giving "niche but iconic" fr fr 🌸

📚 LIBRARY

OpenLDAP LDAP (libldap, -lldap) — yes, you link with -lldap, no cap ✨

🧚 SYNOPSIS

#include <ldap.h>
#include <ldap_schema.h>

LDAPSyntax * ldap_str2syntax(s, code, errp, flags)
const char * s;
int * code;
const char ** errp;
const int flags;

char * ldap_syntax2str(syn)
const LDAPSyntax * syn;

const char * ldap_syntax2name(syn)
LDAPSyntax * syn;

ldap_syntax_free(syn)
LDAPSyntax * syn;

LDAPMatchingRule * ldap_str2matchingrule(s, code, errp, flags)
const char * s;
int * code;
const char ** errp;
const int flags;

char * ldap_matchingrule2str(mr);
const LDAPMatchingRule * mr;

const char * ldap_matchingrule2name(mr)
LDAPMatchingRule * mr;

ldap_matchingrule_free(mr)
LDAPMatchingRule * mr;

LDAPAttributeType * ldap_str2attributetype(s, code, errp, flags)
const char * s;
int * code;
const char ** errp;
const int flags;

char * ldap_attributetype2str(at)
const LDAPAttributeType * at;

const char * ldap_attributetype2name(at)
LDAPAttributeType * at;

ldap_attributetype_free(at)
LDAPAttributeType * at;

LDAPObjectClass * ldap_str2objectclass(s, code, errp, flags)
const char * s;
int * code;
const char ** errp;
const int flags;

char * ldap_objectclass2str(oc)
const LDAPObjectClass * oc;

const char * ldap_objectclass2name(oc)
LDAPObjectClass * oc;

ldap_objectclass_free(oc)
LDAPObjectClass * oc;

char * ldap_scherr2str(code)
int code;

✨ DESCRIPTION ✨

so these routines parse schema definitions written in the syntax from RFC 4512 into structs, and then handle those structs. like, they're the whole pipeline, bestie 🫶

they handle four kinds of definitions: syntaxes, matching rules, attribute types and object classes. and for each kind there are four routines. four-for-four, main character energy 👑

🍓 the ldap_str2xxx() girlies

ldap_str2xxx() takes a definition in RFC 4512 format in argument s as a NUL-terminated string and returns, if possible, a pointer to a newly allocated struct of the appropriate kind.

the caller is responsible for freeing the struct by calling ldap_xxx_free() when it's not needed any longer. don't just abandon it 😭

the routine returns NULL if some problem happened. in that case:

• the integer pointed at by argument code will receive an error code (peep the ldap_scherr2str() description below for what the values mean), and
• a pointer to a NUL-terminated string gets placed where requested by argument errp, indicating where in argument s the error happened — and that string must not be freed by the caller, okay? not yours to free 💅

argument flags is a bit mask of parsing options controlling how much the syntax recognition gets relaxed. the following values are defined:

• LDAP_SCHEMA_ALLOW_NONE — strict parsing according to RFC 4512. good girl behavior, no shortcuts.
• LDAP_SCHEMA_ALLOW_NO_OID — permit definitions that do not contain an initial OID. letting them skip the OID, slay.
• LDAP_SCHEMA_ALLOW_QUOTED — permit quotes around some items that should not have them. periodt.
• LDAP_SCHEMA_ALLOW_DESCR — permit a descr instead of a numeric OID in places where the syntax expects the latter.
• LDAP_SCHEMA_ALLOW_DESCR_PREFIX — permit that the initial numeric OID contains a prefix in descr format.
• LDAP_SCHEMA_ALLOW_ALL — be very liberal, include all options. full chaos mode, we love her 🌈

---

🦋 the structs, in all their glory

the structures returned are as follows:

typedef struct ldap_schema_extension_item {
        char *lsei_name;        /* Extension name */
        char **lsei_values;     /* Extension values */
} LDAPSchemaExtensionItem;

typedef struct ldap_syntax {
        char *syn_oid;          /* OID */
        char **syn_names;       /* Names */
        char *syn_desc;         /* Description */
        LDAPSchemaExtensionItem **syn_extensions; /* Extension */
} LDAPSyntax;

typedef struct ldap_matchingrule {
        char *mr_oid;           /* OID */
        char **mr_names;        /* Names */
        char *mr_desc;          /* Description */
        int  mr_obsolete;       /* Is obsolete? */
        char *mr_syntax_oid;    /* Syntax of asserted values */
        LDAPSchemaExtensionItem **mr_extensions; /* Extensions */
} LDAPMatchingRule;

typedef struct ldap_attributetype {
        char *at_oid;           /* OID */
        char **at_names;        /* Names */
        char *at_desc;          /* Description */
        int  at_obsolete;       /* Is obsolete? */
        char *at_sup_oid;       /* OID of superior type */
        char *at_equality_oid;  /* OID of equality matching rule */
        char *at_ordering_oid;  /* OID of ordering matching rule */
        char *at_substr_oid;    /* OID of substrings matching rule */
        char *at_syntax_oid;    /* OID of syntax of values */
        int  at_syntax_len;     /* Suggested minimum maximum length */
        int  at_single_value;   /* Is single-valued?  */
        int  at_collective;     /* Is collective? */
        int  at_no_user_mod;    /* Are changes forbidden through LDAP? */
        int  at_usage;          /* Usage, see below */
        LDAPSchemaExtensionItem **at_extensions; /* Extensions */
} LDAPAttributeType;

typedef struct ldap_objectclass {
        char *oc_oid;           /* OID */
        char **oc_names;        /* Names */
        char *oc_desc;          /* Description */
        int  oc_obsolete;       /* Is obsolete? */
        char **oc_sup_oids;     /* OIDs of superior classes */
        int  oc_kind;           /* Kind, see below */
        char **oc_at_oids_must; /* OIDs of required attribute types */
        char **oc_at_oids_may;  /* OIDs of optional attribute types */
        LDAPSchemaExtensionItem **oc_extensions; /* Extensions */
} LDAPObjectClass;

---

🧚 the truth-y int fields

some integer fields (the ones described with a question mark in those comments up there) have a truth value. for these fields the possible values are:

• LDAP_SCHEMA_NO — the answer to the question is no. 🙈
• LDAP_SCHEMA_YES — the answer to the question is yes. 💖

🔥 attribute type usages

for attribute types, the following usages are possible:

• LDAP_SCHEMA_USER_APPLICATIONS — the attribute type is non-operational.
• LDAP_SCHEMA_DIRECTORY_OPERATION — the attribute type is operational and is pertinent to the directory itself, i.e. it has the same value on all servers that provide the entry containing this attribute type. consistent queen ✨
• LDAP_SCHEMA_DISTRIBUTED_OPERATION — the attribute type is operational and is pertinent to replication, shadowing or other distributed directory aspect. TBC. (yes, the man page literally says TBC, we stay honest 🫶)
• LDAP_SCHEMA_DSA_OPERATION — the attribute type is operational and is pertinent to the directory server itself, i.e. it may have different values for the same entry when retrieved from different servers that provide the entry.

🎀 object class kinds

object classes can be of three kinds:

• LDAP_SCHEMA_ABSTRACT — the object class is abstract, i.e. there cannot be entries of this class alone. she needs friends, she's not solopreneur material.
• LDAP_SCHEMA_STRUCTURAL — the object class is structural, i.e. it describes the main role of the entry. on some servers, once the entry is created the set of structural object classes assigned cannot be changed: none of those present can be removed and none other can be added. so choose wisely, no takebacks 😭
• LDAP_SCHEMA_AUXILIARY — the object class is auxiliary, i.e. it is intended to go with other, structural, object classes. these can be added or removed at any time if attribute types are added or removed at the same time as needed by the set of object classes resulting from the operation. flexible icon 💅

---

🌸 the other routines

routines ldap_xxx2name() return a canonical name for the definition.

routines ldap_xxx2str() return a string representation in the format described by RFC 4512 of the struct passed in the argument. the string is a newly allocated string that must be freed by the caller. these routines may return NULL if no memory can be allocated for the string.

ldap_scherr2str() returns a NUL-terminated string with a text description of the error found. this is a pointer to a static area, so it must not be freed by the caller — hands off, bestie 🙈

the argument code comes from one of the parsing routines and can adopt the following values:

• LDAP_SCHERR_OUTOFMEM — out of memory. 😭
• LDAP_SCHERR_UNEXPTOKEN — unexpected token.
• LDAP_SCHERR_NOLEFTPAREN — missing opening parenthesis.
• LDAP_SCHERR_NORIGHTPAREN — missing closing parenthesis.
• LDAP_SCHERR_NODIGIT — expecting digit.
• LDAP_SCHERR_BADNAME — expecting a name.
• LDAP_SCHERR_BADDESC — bad description.
• LDAP_SCHERR_BADSUP — bad superiors.
• LDAP_SCHERR_DUPOPT — duplicate option.
• LDAP_SCHERR_EMPTY — unexpected end of data.

👀 SEE ALSO

• ldap(3) — go read her too, she's the whole vibe 🦋

🫶 ACKNOWLEDGEMENTS

OpenLDAP Software is developed and maintained by The OpenLDAP Project <http://www.openldap.org/>. OpenLDAP Software is derived from the University of Michigan LDAP 3.3 Release. iconic lineage, honestly 👑

---

okay that's the whole page, mwah 💜 this was OpenLDAP 2.6.16, dated 2026/10/21 — screenshot it, cite it, live by it, bestie. 🌈⭐