schema

# The Private Enterprise Number assigned to TCD Netsoc :D
objectIdentifier netsoc 1.3.6.1.4.1.33566
# Netsoc LDAP attributes
objectIdentifier na netsoc:1
# Netsoc LDAP objectclasses
objectIdentifier no netsoc:2

# OIDs for LDAP syntaxes
objectIdentifier syntax 1.3.6.1.4.1.1466.115.121.1
objectIdentifier boolean syntax:7
objectIdentifier directoryString syntax:15
objectIdentifier distinguishedName syntax:12
objectIdentifier integer syntax:27
objectIdentifier numericString syntax:36
objectIdentifier OID syntax:38
objectIdentifier octetString syntax:40


# ISS username
attributetype ( na:1
 NAME 'tcdnetsoc-ISS-username'
 DESC 'ISS username'
 SINGLE-VALUE
 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX directoryString )


# Year of membership, e.g. "2008-2009"
# This attribute corresponds to payment of the membership fee for that year
# A given user often has multiple values for this attribute 
attributetype ( na:3
 NAME 'tcdnetsoc-membership-year'
 DESC 'Year of membership'
 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX directoryString )

# Generic comment field
attributetype ( na:4
 NAME 'tcdnetsoc-admin-comment'
 DESC 'Comment'
 EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX directoryString )

# Services are things like 'login-spoon', which is a cn under the ou=Service branch
# Users are granted privileges to use these services
# The trivial pribileges are the login privileges to the login machines, but others exist (such as ones to the web server, or memberinfo)
attributetype ( na:5
 NAME 'tcdnetsoc-service-granted'
 DESC 'Service that a privilege grants access to'
 EQUALITY distinguishedNameMatch SYNTAX distinguishedName )

attributetype ( na:6
 NAME 'tcdnetsoc-granted-by-privilege'
 DESC 'Privilege sufficient to grant access to a service'
 EQUALITY distinguishedNameMatch SYNTAX distinguishedName )

# The canonical quota descriptor assumes everything is on one machine (or is at least accessible under one filesystem).
# This, naturally, doesn't work for us since we have two /homes (one on cube and one on spoon).
# So there's an extra entry, and then there are perl scripts on those machines which are supposed to enforce the quotas

attributetype ( na:7
 NAME 'tcdnetsoc-diskquota'
 DESC 'Disk quota entry (host:fs:blocks_soft:blocks_hard:inodes_soft:inodes_hard)'
 EQUALITY caseIgnoreMatch SYNTAX directoryString )

attributetype ( na:8
 NAME 'tcdnetsoc-diskusage'
 DESC 'Disk usage entry (host:fs:blocks_used:blocks_soft:blocks_hard:inodes_used:inodes_soft:inodes_hard)'
 EQUALITY caseIgnoreMatch SYNTAX directoryString )


# MySQL passwords, in plaintext. This is crap. A possible alternative is to symmetrically encrypt the plaintext version with the user's password
# So it can be decoded by the user to be put into config files. Then also have a hashed version (compatible with MySQL auth) for MySQL to use.
attributetype ( na:9
 NAME 'tcdnetsoc-mysql-pw'
 DESC 'MySQL password for per-user database'
 SINGLE-VALUE
 EQUALITY caseExactMatch SYNTAX directoryString )

attributetype ( na:10
 NAME 'tcdnetsoc-value'
 DESC 'Configuration setting stored in LDAP'
 EQUALITY caseExactMatch SYNTAX directoryString )

# I don't think we ever use this, and it's also horrible practice to store old passwords. They should just be deleted
attributetype ( na:11
 NAME 'tcdnetsoc-saved-password'
 DESC 'Saved password of a disabled user'
 EQUALITY octetStringMatch
 SYNTAX 1.3.6.1.4.1.1466.115.121.1.40{128} )

# Some users have (multiple) aliases to their userweb site. We're not allowing changing DocumentRoot here, as that should be always scrutinised
attributetype ( na:12
 NAME 'tcdnetsoc-website-alias'
 DESC 'ServerName alias to be used as well as their user.netsoc.ie address for user website'
 EQUALITY caseIgnoreMatch SYNTAX directoryString )

# Committee membership can be recorded here
attributetype ( na:13
 NAME 'tcdnetsoc-committee-service'
 DESC 'Comment for member who served on Committee for specified academic year'
 EQUALITY caseIgnoreMatch SYNTAX directoryString )

# Subject and year, useful to know
attributetype ( na:14
 NAME 'tcdnetsoc-member-course-name'
 DESC 'Name of course member is taking'
 EQUALITY caseIgnoreMatch SYNTAX directoryString )

attributetype ( na:15
 NAME 'tcdnetsoc-member-course-year'
 DESC 'Year that member is in'
 EQUALITY caseIgnoreMatch SYNTAX directoryString )

attributetype ( na:16
 NAME 'tcdnetsoc-temp-loginShell'
 DESC 'Placeholder for actual loginShell when users are renewing their accounts'
 EQUALITY caseIgnoreMatch SYNTAX directoryString )


# A member or user of Netsoc
# This covers every person in the database. Those who are currently paid-up members
# will have a tcdnetsoc-membership-year attribute storing the current year.
# For those who don't have usernames (e.g. members who paid but never signed up for
# an account, the uid field is the same as the uidNumber field).
# The RDN is given by the uid field (so, user mu may be in LDAP with the DN of
# "uid=mu,ou=people,dc=netsoc,dc=tcd,dc=ie"
# Details pertaining to a shell account are stored in the posixAccount objectclass
# (see nis.schema), so that pam+ldap is possible.
# Mail aliases are also stored here
# there may be other attributes inherited from inetOrgPerson and its parents
# useful ones include sn (required), cn (required), userPassword, jpegPhoto,
# mail, userSMIMECertificate.
# A user may also have an amavisAccount object for amavis prefs.
objectclass ( no:1
 NAME 'tcdnetsoc-person'
 DESC 'Member or user of Trinity College Dublin Internet Society'
 STRUCTURAL
 MUST (
  uidNumber $ cn )
 MAY (
  uid $ gidNumber $ homeDirectory $ tcdnetsoc-ISS-username $ tcdnetsoc-membership-year $ 
  tcdnetsoc-admin-comment $ mail $ userPassword $ loginShell $ tcdnetsoc-diskquota $ tcdnetsoc-diskusage $ tcdnetsoc-mysql-pw $
  tcdnetsoc-saved-password $ tcdnetsoc-website-alias $ tcdnetsoc-temp-loginShell $ 
  tcdnetsoc-committee-service $ tcdnetsoc-member-course-name $ tcdnetsoc-member-course-year $ sambaSID $
  sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $
  sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $
  sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $
  displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $
  sambaProfilePath $ description $ sambaUserWorkstations $
  sambaPrimaryGroupSID $ sambaDomainName $ sambaMungedDial $
  sambaBadPasswordCount $ sambaBadPasswordTime $
  sambaPasswordHistory $ sambaLogonHours
  ) )

objectclass ( no:2
 NAME 'tcdnetsoc-group'
 DESC 'Group of TCD Netsoc accounts'
 SUP posixGroup
 STRUCTURAL
 MUST ( gidNumber )
 MAY ( member $ sambaSID $ sambaGroupType ) )

objectclass ( no:3
 NAME 'tcdnetsoc-idnum'
 DESC 'Object to hold an ID number'
 SUP top
 STRUCTURAL
 MUST ( cn $ serialNumber ) )

objectclass ( no:4
 NAME 'tcdnetsoc-privilege'
 DESC 'Privilege granting access for some users to some services'
 SUP tcdnetsoc-group
 STRUCTURAL
 MAY ( tcdnetsoc-service-granted ) )

objectclass ( no:5
 NAME 'tcdnetsoc-service'
 DESC 'Service accessible by Netsoc users with the right privileges'
 STRUCTURAL
 MUST ( cn ) 
 MAY ( tcdnetsoc-granted-by-privilege $ userPassword $ uid $ mail ) )
 
objectclass ( no:6
 NAME 'tcdnetsoc-setting'
 DESC 'Arbitrary name-value setting'
 STRUCTURAL
 MUST ( cn )
 MAY ( tcdnetsoc-value ) )