Using LDIF Files to Extend the AD Schema

The Active Directory (AD) schema contains the classes and attributes that define the types of objects that you can create in AD and the properties that you can configure with them. Domain controllers (DCs) store the schema as a set of objects inside the directory, whereas most Lightweight Directory Access Protocol (LDAP) servers store the schema as a collection of text files outside the directory. Storing the schema as objects in AD's Schema container has several advantages. Most notably, you can use tools and scripts to modify the schema as you would other types of objects.

A popular way to extend the AD schema is to use the LDAP Data Interchange Format (LDIF), which the Internet Engineering Task Force (IETF) Request for Comments (RFC) 2849 defines. All major directory vendors support LDIF, so tools that use LDIF to import and export directory data are readily available. For example, the LDIF Directory Exchange utility (Ldifde—a command-line tool in Windows 2000 and later) and the Perl Net::LDAP modules use LDIF files to import and export AD data. Let's look at how you can use Net::LDAP to automate not only importing LDIF files into the schema but also verifying the schema extensions to reduce the potential for errors during the import. But first, let's take a quick look at how LDIF files work and how to install the Net::LDAP modules. . . .