How to export AD LDS schema

Working for a client I needed to stand up an LDAP client and create a new class and attributes.  It was about 35 new attributes and take take a while when you have to do each one manually.  Now it’s time to move it to QA.  There ain’t a whole lot out there for exporting LDAP schema and of course the old LDIFE was giving me grief.  So after more searching I stumbled on a TechNet article and there it was.

It’s already installed if you set up ADLDS.  Look in \windows\ADAM it’s called ADSchemaAnalyzer.  I think it’s purpose is to compare different schema, but it also exports them to LDIF – Sweet!

First ‘load target schema’, then ‘load base schema’  I don’t know why, I didn’t have time to find out.  Then walk the tree and you’ll see all the object classes and attributes.  Now if you created an object class and new attributes just for that object, just select the new object class and the attributes will come along automatically.

Now Create LDIF file and away you go.  Very awesome!

OpenLDAP and password sync

Recently at a client's site and they wanted to flow passwords from AD to their OpenLDAP directory.

Went out to SourceForge and downloaded their latest OpenLDAP XMA which can be found here: http://sourceforge.net/projects/openldap-xma/. Very impressed with it's packaging, just run the MSI installer and puts everything where it needs to be. Even includes some handy user guides. For the most part you configure according to the guides and it works. Except if you want to do password sync. Instead you get a warning 6901: The password extension does not implement the entry point.

This will explain what you need to do to get the password sync functionality working. After cruising around I finally found an entry in the sourceforce forum where Randy Weimer mentions an error with password sync that he had to add some missing code. But this was May of 2010 (over a year ago), I'm sure this has been fixed - but it smells the same. Unfortunately it is the same issue. So here's what you have to do.

1. download the code from Sourceforge which is not an intuitive task. Luckily Carrol explains it nicely here: http://www.wapshere.com/missmiis/compiling-the-openldap-xma-to-use-with-fim-2010 Though it seems when you read her post there was no nice msi installer like there is now. But you can figure out how to get the latest code: Read Get the Right Source Code section.

Now I did the rest on my laptop (without FIM installed).
2. Open up the solution OpenLDAPXMA.sln in Visual Studio and choose the PasswordExtension.cs. Search for the following phrase

ConnectionSecurityLevel GetConnectionSecurityLevel

You'll find the function really doesn't do anything. so you'll need to comment out the throw statement and add a return statement within the function like this:

return ConnectionSecurityLevel.Secure;

See below for Randy's entry and the code.

3 Add the missing reference.
Since I was using my laptop, I needed to copy the Microsoft.MetadirectoryServicesEx.dll file from the FIM server over to my laptop. You can find it at ..\Microsoft Forefront Indentity Manager\2010\Synchronization Service\Bin\Assemblies\ folder.
Then add it as a reference. Build the whole solution. Which by the way is just one file called OpenLDAPXMA.dll. There is no extra password DLL file as the user guide mentions.

4. Put the newly compiled dll in the \extensions\ folder and that's it. All should work.

If by chance you don't want to do through all this just contact me at my hotmail account (pjalaff).

I want to give full credit to Carroll Wapshere - who has save me more times than I want to admit, and to Randy Weimer who figure'd out this bug. If anything this blog puts both pieces together.



Randy's original post: http://sourceforge.net/tracker/?func=detail&aid=2996718&group_id=196847&atid=959098