What is an object class, and why does a person entry list several of them (top, person, organizationalPerson, inetOrgPerson)?
An object class is a schema template that lists the attributes an entry must (MUST) and may (MAY) have; classes inherit from each other, so listing the chain top → person → organizationalPerson → inetOrgPerson accumulates all their attributes.
* Each subclass inherits the attributes of its parent and adds its own. *
Each level of the chain adds attributes:
| Object class | Adds (examples) |
|---|---|
top |
objectClass itself: the abstract root of every class |
person |
MUST sn, cn; MAY userPassword, telephoneNumber, description |
organizationalPerson |
Job data: title, ou, street, postalCode, facsimileTelephoneNumber |
inetOrgPerson |
Internet-era data: mail, uid, givenName, initials, employeeType, jpegPhoto, userCertificate |
So an entry for a secret agent with objectClass: inetOrgPerson may carry title: Commander, mail and a jpegPhoto, and it must carry sn and cn because person requires them. The server checks every add and modify against these rules; an entry that lacks a MUST attribute or uses an attribute no listed class allows is rejected.
Tip: Besides these structural classes (exactly one structural chain per entry, which defines what the object is), LDAP has auxiliary classes that can be mixed in to add extra attributes, for example for a mail system or POSIX login data.
Go deeper:
RFC 4512, Section 2.4: Object Classes — abstract, structural and auxiliary classes and how inheritance works.- RFC 2798: The inetOrgPerson object class — the full attribute list of the class most user entries use.