---
name: "ldap_schema"
section: "3"
platform: "macos"
package: "OpenLDAP"
version: "561"
release: "macOS 26.5"
platforms: ["linux", "macos"]
url: "https://new.carta.tech/ldap_schema"
---

# ldap\_schema(3)

Schema definition handling routines

## NAME

ldap\_str2syntax, ldap\_syntax2str, ldap\_syntax2name, ldap\_syntax\_free, ldap\_str2matchingrule, ldap\_matchingrule2str, ldap\_matchingrule2name, ldap\_matchingrule\_free, ldap\_str2attributetype, ldap\_attributetype2str, ldap\_attributetype2name, ldap\_attributetype\_free, ldap\_str2objectclass, ldap\_objectclass2str, ldap\_objectclass2name, ldap\_objectclass\_free, ldap\_scherr2str - Schema definition handling routines

## LIBRARY

OpenLDAP LDAP (libldap, -lldap)

## SYNOPSIS

```
#include <ldap.h>
#include <ldap_schema.h>
```

**LDAPSyntax \* ldap\_str2syntax(s, code, errp, flags)** **const char \* s;** **int \* code;** **const char \*\* errp;** **const int flags;**

**char \* ldap\_syntax2str(syn)** **const LDAPSyntax \* syn;**

**const char \* ldap\_syntax2name(syn)** **LDAPSyntax \* syn;**

**ldap\_syntax\_free(syn)** **LDAPSyntax \* syn;**

**LDAPMatchingRule \* ldap\_str2matchingrule(s, code, errp, flags)** **const char \* s;** **int \* code;** **const char \*\* errp;** **const int flags;**

**char \* ldap\_matchingrule2str(mr);** **const LDAPMatchingRule \* mr;**

**const char \* ldap\_matchingrule2name(mr)** **LDAPMatchingRule \* mr;**

**ldap\_matchingrule\_free(mr)** **LDAPMatchingRule \* mr;**

**LDAPAttributeType \* ldap\_str2attributetype(s, code, errp, flags)** **const char \* s;** **int \* code;** **const char \*\* errp;** **const int flags;**

**char \* ldap\_attributetype2str(at)** **const LDAPAttributeType \* at;**

**const char \* ldap\_attributetype2name(at)** **LDAPAttributeType \* at;**

**ldap\_attributetype\_free(at)** **LDAPAttributeType \* at;**

**LDAPObjectClass \* ldap\_str2objectclass(s, code, errp, flags)** **const char \* s;** **int \* code;** **const char \*\* errp;** **const int flags;**

**char \* ldap\_objectclass2str(oc)** **const LDAPObjectClass \* oc;**

**const char \* ldap\_objectclass2name(oc)** **LDAPObjectClass \* oc;**

**ldap\_objectclass\_free(oc)** **LDAPObjectClass \* oc;**

**char \* ldap\_scherr2str(code)** **int code;**

## DESCRIPTION

**These routines are used to parse schema definitions in the syntax** **defined in RFC 4512 into structs and handle these structs.  These** **routines handle four kinds of definitions: syntaxes, matching rules,** **attribute types and object classes.  For each definition kind, four** **routines are provided.**

**ldap\_str2xxx()** **takes a definition in RFC 4512 format in argument** *s* **as a NUL-terminated string and returns, if possible, a pointer to a** **newly allocated struct of the appropriate kind.  The caller is** **responsible for freeing the struct by calling** **ldap\_xxx\_free()** **when not needed any longer.  The routine returns NULL if some problem** **happened.  In this case, the integer pointed at by argument** *code* **will receive an error code (see below the description of** **ldap\_scherr2str()** **for an explanation of the values) and a pointer to a NUL-terminated** **string will be placed where requested by argument** *errp* **, indicating where in argument** *s* **the error happened, so it must not be freed by the caller.  Argument** *flags* **is a bit mask of parsing options controlling the relaxation of the** **syntax recognized.  The following values are defined:**

- **LDAP\_SCHEMA\_ALLOW\_NONE**

  **strict parsing according to RFC 4512.**

- **LDAP\_SCHEMA\_ALLOW\_NO\_OID**

  **permit definitions that do not contain an initial OID.**

- **LDAP\_SCHEMA\_ALLOW\_QUOTED**

  **permit quotes around some items that should not have them.**

- **LDAP\_SCHEMA\_ALLOW\_DESCR**

  **permit a** **descr** **instead of a numeric OID in places where the syntax expect the latter.**

- **LDAP\_SCHEMA\_ALLOW\_DESCR\_PREFIX**

  **permit that the initial numeric OID contains a prefix in** **descr** **format.**

- **LDAP\_SCHEMA\_ALLOW\_ALL**

  **be very liberal, include all options.**

**The structures returned are as follows:**

```
typedef struct ldap_schema_extension_item {
	char *lsei_name;	/* Extension name */
	char **lsei_values;	/* Extension values */
} LDAPSchemaExtensionItem;
typedef struct ldap_syntax {
	char *syn_oid;		/* OID */
	char **syn_names;	/* Names */
	char *syn_desc;		/* Description */
	LDAPSchemaExtensionItem **syn_extensions; /* Extension */
} LDAPSyntax;
typedef struct ldap_matchingrule {
	char *mr_oid;		/* OID */
	char **mr_names;	/* Names */
	char *mr_desc;		/* Description */
	int  mr_obsolete;	/* Is obsolete? */
	char *mr_syntax_oid;	/* Syntax of asserted values */
	LDAPSchemaExtensionItem **mr_extensions; /* Extensions */
} LDAPMatchingRule;
typedef struct ldap_attributetype {
	char *at_oid;		/* OID */
	char **at_names;	/* Names */
	char *at_desc;		/* Description */
	int  at_obsolete;	/* Is obsolete? */
	char *at_sup_oid;	/* OID of superior type */
	char *at_equality_oid;	/* OID of equality matching rule */
	char *at_ordering_oid;	/* OID of ordering matching rule */
	char *at_substr_oid;	/* OID of substrings matching rule */
	char *at_syntax_oid;	/* OID of syntax of values */
	int  at_syntax_len;	/* Suggested minimum maximum length */
	int  at_single_value;	/* Is single-valued?  */
	int  at_collective;	/* Is collective? */
	int  at_no_user_mod;	/* Are changes forbidden through LDAP? */
	int  at_usage;		/* Usage, see below */
	LDAPSchemaExtensionItem **at_extensions; /* Extensions */
} LDAPAttributeType;
typedef struct ldap_objectclass {
	char *oc_oid;		/* OID */
	char **oc_names;	/* Names */
	char *oc_desc;		/* Description */
	int  oc_obsolete;	/* Is obsolete? */
	char **oc_sup_oids;	/* OIDs of superior classes */
	int  oc_kind;		/* Kind, see below */
	char **oc_at_oids_must;	/* OIDs of required attribute types */
	char **oc_at_oids_may;	/* OIDs of optional attribute types */
	LDAPSchemaExtensionItem **oc_extensions; /* Extensions */
} LDAPObjectClass;
```

**Some integer fields (those described with a question mark) have a** **truth value, for these fields the possible values are:**

- **LDAP\_SCHEMA\_NO**

  **The answer to the question is no.**

- **LDAP\_SCHEMA\_YES**

  **The answer to the question is yes.**

**For attribute types, the following usages are possible:**

- **LDAP\_SCHEMA\_USER\_APPLICATIONS**

  **the attribute type is non-operational.**

- **LDAP\_SCHEMA\_DIRECTORY\_OPERATION**

  **the attribute type is operational and is pertinent to the directory** **itself, i.e. it has the same value on all servers that master the** **entry containing this attribute type.**

- **LDAP\_SCHEMA\_DISTRIBUTED\_OPERATION**

  **the attribute type is operational and is pertinent to replication,** **shadowing or other distributed directory aspect.  TBC.**

- **LDAP\_SCHEMA\_DSA\_OPERATION**

  **the attribute type is operational and is pertinent to the directory** **server itself, i.e. it may have different values for the same entry** **when retrieved from different servers that master the entry.**

**Object classes can be of three kinds:**

- **LDAP\_SCHEMA\_ABSTRACT**

  **the object class is abstract, i.e. there cannot be entries of this** **class alone.**

- **LDAP\_SCHEMA\_STRUCTURAL**

  **the object class is structural, i.e. it describes the main role of the** **entry.  On some servers, once the entry is created the set of** **structural object classes assigned cannot be changed: none of those** **present can be removed and none other can be added.**

- **LDAP\_SCHEMA\_AUXILIARY**

  **the object class is auxiliary, i.e. it is intended to go with other,** **structural, object classes.  These can be added or removed at any time** **if attribute types are added or removed at the same time as needed by** **the set of object classes resulting from the operation.**

**Routines** **ldap\_xxx2name()** **return a canonical name for the definition.**

**Routines** **ldap\_xxx2str()** **return a string representation in the format described by RFC 4512 of** **the struct passed in the argument.  The string is a newly allocated** **string that must be freed by the caller.  These routines may return** **NULL if no memory can be allocated for the string.**

**ldap\_scherr2str()** **returns a NUL-terminated string with a text description of the error** **found.  This is a pointer to a static area, so it must not be freed by** **the caller.  The argument** *code* **comes from one of the parsing routines and can adopt the following** **values:**

- **LDAP\_SCHERR\_OUTOFMEM**

  **Out of memory.**

- **LDAP\_SCHERR\_UNEXPTOKEN**

  **Unexpected token.**

- **LDAP\_SCHERR\_NOLEFTPAREN**

  **Missing opening parenthesis.**

- **LDAP\_SCHERR\_NORIGHTPAREN**

  **Missing closing parenthesis.**

- **LDAP\_SCHERR\_NODIGIT**

  **Expecting digit.**

- **LDAP\_SCHERR\_BADNAME**

  **Expecting a name.**

- **LDAP\_SCHERR\_BADDESC**

  **Bad description.**

- **LDAP\_SCHERR\_BADSUP**

  **Bad superiors.**

- **LDAP\_SCHERR\_DUPOPT**

  **Duplicate option.**

- **LDAP\_SCHERR\_EMPTY**

  **Unexpected end of data.**

## SEE ALSO

[**ldap**(3)](/ldap/3.md)

## ACKNOWLEDGEMENTS