Managing the NDS Schema

With the NDS Manager Utility

David Cox

With IntranetWare and NetWare 4.11, Novell intro-duced the NDS Manager utility, which you can run as a standalone utility or as part of the NetWare Administrator (NWADMIN) utility. You can use the NDS Manager utility to manage the Novell Directory Services (NDS) database, performing tasks such as the following:

Novell has released an updated version of the NDS Manager utility, which is included in IntranetWare Support Pack 4.0. This updated version includes NDS Schema Manager, a new component of the NDS Manager utility that allows you to view and customize the NDS schema. (You can download IntranetWare Support Pack 4.0 from the Novell Support Connection World-Wide Web site at http://www.support.novell.com/misc/patlst.htm#nw411.)

With NDS Schema Manager, you can perform several tasks:

This article explains how you as a network administrator or a developer can use NDS Schema Manager to manage or design the NDS schema.

THE NDS SCHEMA OF THINGS TO COME

NDS is a full-featured, hierarchical directory. In addition to providing partition and replication capabilities, NDS offers a dynamic schema. The term schema refers to the rules that govern the structure of the NDS database and define the relationship (either superior or subordinate) between NDS objects. For example, the NDS schema ensures that an Organizational Unit (OU), such as OU=East Coast Sales, is not placed beneath a User object, such as CN=John Doe.

Unlike NDS, many directories are static and use a file to define their schema. To change a static schema, you must modify this file and then restart the directory to make the changes take effect. Because NDS has a dynamic schema, however, you can modify the schema while NDS is running, and the changes take effect immediately.

The NDS schema is also global, which means that each NDS tree has only one schema. When you make changes to this schema, these changes are replicated throughout the entire NDS tree. To modify the NDS schema, you must have ADMIN rights to the [Root] object in the NDS tree.

The NDS schema includes two components: attributes and classes. Attributes specify the syntax of the individual fields in the NDS database. For example, one of the attributes for a User object is a telephone number. Classes, on the other hand, use a collection of one or more attributes to define a template for storing information (referred to as objects) in the NDS database. For example, NDS includes a definition for the Organization class, which is a collection of attributes and rules used to create an Organization object.

NDS SCHEMA MANAGER

To access NDS Schema Manager, you launch the NDS Manager utility and select a partition or a server listed in the boxes on the left-hand side of the main NDS Manager window. You then select the Schema Manager option from the Object menu. The NDS Schema Manager window appears, displaying two boxes. (See Figure 1.) The box on the right-hand side of the window contains attributes; the box on the left-hand side of the window contains classes.

If you double-click an attribute, the Attribute Information dialog box appears. (See Figure 2.) If you double-click a class, the Class Manager dialog box appears. (See Figure 3.)

You can also access these dialog boxes by selecting an attribute or class and clicking the appropriate button in the toolbar. Finally, you can access these dialog boxes by right-clicking an attribute or class. A menu appears, displaying only valid operations for the attribute or class you selected.

ATTRIBUTE OPERATIONS

With NDS Schema Manager, you can view, create, or delete an attribute. To view an attribute, you double-click the attribute in the NDS Schema Manager window to bring up the Attribute Information dialog box. (See Figure 2.) This dialog box shows the name of the attribute, its syntax, its flags, and the class using this attribute. For example, in Figure 2, the Classes Using Attribute field shows that the Version attribute is being used by the NLSProduct and Server classes.

Creating an Attribute

To create an attribute, you must have ADMIN rights to the [Root] object's access control list (ACL). If you do not have these rights, an error message appears, explaining the rights required to perform this operation. If you have the necessary rights, you must complete the following steps:

1. Right-click an attribute in the NDS Schema Manager window, and select the Create New Attribute option. An information screen appears, explaining that the Create Attribute Wizard will help you create an attribute in the NDS schema.

2. Click the Next button. A screen appears, prompting you to enter an attribute name, which can be up to 32 characters and can include spaces. The attribute name must be unique and should be descriptive. For example, if you created an attribute that would be used to save a color picture in NDS, you might name the attribute Color Picture.

3. After you enter a name for the new attribute, click the Next button. A screen appears, prompting you to select the attribute syntax. NDS has 28 syntaxes you can choose from. (For more information about syntaxes, see "Attribute Syntaxes and Flags" on the NetWare Connection web site.) For the Color Picture attribute, you would select the Octet String syntax. You use the Octet String syntax to save items in NDS that are arbitrary in both length and data. By saving the picture in NDS, you would ensure that the picture could be accessed even if the server went down (since the NDS database is replicated across multiple servers).

4. After you select a syntax for the new attribute, click the Next button. A screen appears, prompting you to select flags for this attribute. The flags available for a particular attribute depend on the syntax you have chosen. For example, the Boolean syntax does not support the Sized flag because the Boolean syntax has a true or false value and has no associated size.

For the Color Picture attribute, you might choose the Single Valued and Public Read flags. The Single Valued flag specifies that you do not want multiple pictures, and the Public Read flag allows applications to access the picture. For example, you could enable a web server to display this picture in a HyperText Markup Language (HTML) document. (For more information about flags, see "Attribute Syntaxes and Flags" on the NetWare Connection web site.)

5. After you select flags for the new attribute, click the Next button. A screen appears, summarizing the settings you have chosen. (See Figure 4.)

6. If you want to change a setting, you can click the Back button to access a previous screen. Make sure the settings are correct because you cannot modify the attribute after you create it. When this attribute is correctly defined, click the Finish button to create the attribute.

Deleting an Attribute

Before you can delete an attribute, you must ensure that no class is using the attribute. If a class is using this attribute, you must first delete the class. However, you cannot delete standard attributes and classes that were included with the shipping version of NDS. If you add an attribute to a standard class, you cannot delete that attribute.

To delete an attribute, you must have ADMIN rights to the [Root] object's ACL. You then right-click the attribute you want to delete in the NDS Schema Manager window, and select the Delete Attribute option. A warning screen appears. If you are sure that no classes are using this attribute, click the Yes button to delete the attribute.

CLASS OPERATIONS

With NDS Schema Manager, you can also view a class, view the class's inheritance, create a class, delete a class, or add an attribute to a class. To view a class, you double-click the class in the NDS Schema Manager window to bring up the Class Manager dialog box. (See Figure 3.)

The Class Manager dialog box shows which attributes are mandatory and which attributes are optional. This dialog box also specifies the class's naming attribute, the types of objects that can contain this class, and the class's flags. (For more information about classes, see "Components of a Class" on the NetWare Connection web site.)

Viewing a Class's Inheritance

Before you create a class, you should understand class inheritance. In NDS, classes, like objects, are part of a hierarchy. You assign class inheritance when you create a class.

If you right-click a class in the NDS Schema Manager window and select the View Inheritance option, the Class Inheritance dialog box appears. This dialog box shows how the class inherits attributes from its parent classes. For example, in Figure 5, Organizational Person, Person, and Top are the parent classes of User.

The definition of a class includes the components of the class itself and the components of all of the classes in the inheritance hierarchy. As shown in Figure 5, the inheritance hierarchy is inverted: The Top class is actually the topmost class in this hierarchy. The reason the inheritance hierarchy is inverted is that classes can inherit attributes from multiple classes, and an inverted hierarchy logically displays these multiple inheritances.

Creating a Class

To create a class, you must have ADMIN rights to the [Root] object's ACL. You must then complete the following steps:

1. Right-click a class in the NDS Schema Manager window, and select the Create New Class option. An information screen appears, explaining that the Create Class Wizard will help you create a class in the NDS schema.

2. Click the Next button. A screen appears, prompting you to enter the class name, which can be up to 32 characters and can include spaces. The class name must be unique and should be descriptive. For example, if you created a class for employees of the month, you might name the class Employee of the Month.

3. After you enter a name for the new class, click the Next button. A screen appears, prompting you to specify a class or classes from which the new class will inherit attributes and flags. For example, you could specify that the Employee of the Month class would inherit attributes and flags from the Top class. (NDS Schema Manager allows you to customize this inheritance as you continue the process of creating a class.)

4. After you select the class or classes from which you want the new class to inherit attributes and flags, click the Next button. A screen appears, prompting you to select flags for the new class. You can set two flags: the Container flag and the Effective flag. The Container flag specifies that NDS objects using this class can contain other NDS objects, and the Effective flag specifies that NDS objects can be created using the class. For example, you would need to set the Effective flag for the Employee of the Month class. However, you would not set the Container flag because you would use the Employee of the Month class to create a leaf object (rather than a container object). (For more information about flags, see "Components of a Class" on the NetWare Connection web site.)

5. After you select flags for the new class, click the Next button. A screen appears, prompting you to select mandatory attributes for this class. Mandatory attributes are required values for NDS objects that use the class.

6. After you select mandatory attributes for the new class, click the Next button. A screen appears, prompting you to select optional attributes for this class. Optional attributes are not required values, but these attributes may be used by NDS objects that use the class.

7. After you select optional attributes for the new class, click the Next button. A screen appears, prompting you to select the class's naming attribute, which defines the attribute or attributes that are used to name the NDS object. Only attributes that have a string-type syntax can be used for naming. (A string-type syntax is a collection of alpha and numeric characters, which NDS can use to name objects. For more information about syntaxes, see "Components of a Class" on the NetWare Connection web site.)

To appear in the list of available naming attributes, an attribute must be a mandatory or optional attribute. If the naming attribute you want to select does not appear in this list, you can click the Back button and make the naming attribute a mandatory or optional attribute. If you select an optional attribute as a naming attribute, it is effectively a mandatory attribute, even though it is defined as optional.

8. After you select a naming attribute for the new class, click the Next button. A screen appears, prompting you to select this class's container class, which specifies where an NDS object that uses the new class can appear in the NDS tree.

9. After you select a container class for the new class, click the Next button. A screen appears, summarizing the settings you have chosen. (See Figure 6.) If these settings are correct, click the Finish button to create the class.

Deleting a Class

To delete a class, you must have ADMIN rights to the [Root] object's ACL. You right-click the class you want to delete in the NDS Schema Manager window and select the Delete Class option. A warning screen appears. If you are sure that no NDS objects are using this class, click the Yes button to delete the class.

Adding an Attribute to a Class

To add an attribute to a class, you must have ADMIN rights to the [Root] object's ACL. Before you add an attribute, you should be aware that you can only add attributes to a class; you cannot delete attributes from a class. If you want to delete an attribute from a class, you must delete the entire class and create a new class without the attribute.

As mentioned earlier, you should not delete a class if any NDS objects are using the class. Instead, you must delete these NDS objects before you delete the class. Finally, you cannot delete attributes from standard classes because these classes are flagged as Non-removable.

To add an attribute to a class, you right-click the class in the NDS Schema Manager window and select the Add Optional Attribute to Class option. The Add Optional Attributes dialog box appears, displaying a list of attributes that you can add to this class. (See Figure 7.) You simply double-click the attribute you want to add and click the OK button.

THE REPORTS YOU HAVE BEEN WAITING FOR

With NDS Schema Manager, you can generate the following reports:

Schema extensions are attributes and classes that have been added to or modified in the standard NDS schema. If you want to simply view a report of schema extensions, you can select the Only Show Extensions option from the View menu in the NDS Schema Manager window. (See Figure 8.) You can also generate a schema extensions report by selecting the Schema Extensions option from the Object menu in the NDS Schema Manager window. (See Figure 9.) If you choose this option, you can print the schema extensions report or save it to a file.

Don't be surprised if many attributes and classes appear in the schema extensions report: Each version of NDS includes a slightly different NDS schema. If you have upgraded NDS on the ser-ver, the NDS schema is a hybrid of the schema in previous versions of NDS and the schema in the upgraded version of NDS.

In addition, several applications, such as Novell Workstation Manager, extend the NDS schema when they are installed. Also, if you extended the Top class by adding an attribute, all classes appear in the schema extension report. Because all classes inherit attributes from the Top class, all classes have been modified.

If you want to generate a report on a specific attribute or class, you select the attribute or class in the NDS Schema Manager window and then select the Schema Report option from the Object menu. You can also generate this report by right-clicking an attribute or class in the NDS Schema Manager window and then selecting the Quick Report option.

If you want to generate a report on the entire NDS schema, you select the Schema Report option from the Object menu. You then select the Generate Report on Entire Schema option from the Schema Reports screen.

If you want to compare the schemas of two NDS trees, you select the Schema Compare option from the Object menu. (See Figure 10.) After you specify which trees NDS Schema Manager should compare, you can use report filters to specify that the schema comparison report compare attributes or classes.

Figure 10 shows the differences between two NDS trees. LDAP Services for NDS 1.0, which has been installed on one NDS tree, extended the NDS schema by adding optional attributes to the NCP Server and User classes.

Comparing two NDS trees is helpful if you are going to merge these trees. Before you can merge two NDS trees, their schemas must be identical. When you run the DSREPAIR utility, it modifies both schemas so that they are identical and then merges the two NDS trees.

CONCLUSION

If you are a network administrator, you can use NDS Schema Manager to examine the schema of your company's NDS tree and evaluate its attributes and classes. With NDS Schema Manager, you can also extend the NDS schema to accommodate special types of NDS objects.

The larger and more complex your company, the more likely it is that you will want to customize the NDS schema. However, even small companies have unique needs. Because NDS Schema Manager allows you to view and print reports about the NDS schema, you can evaluate how well this schema meets your company's needs. You can then determine if you need to extend the NDS schema in any way.

If you are a developer, you can use NDS Schema Manager to gather information about the NDS schema, which can help you extend the features of the application you are creating. For information about developer resources such as application program interfaces (APIs) and documentation, visit the Novell DeveloperNet web site (http://devsup.novell.com).

David Cox works for Novell Inc. in Provo, Utah.

NetWare Connection, November 1997, pp. 27-33