What is the LDAP schema, and what does it control?

The schema is the server's rulebook: it defines the attribute types (with syntax, matching rules and single/multi-value), the object classes, and so which entries are valid; the server enforces it on every write.

Think of it as the directory's equivalent of a database's table definitions, but organised around types instead of tables:

• Attribute type definitions: a name and a unique object identifier (OID), a syntax (what a value looks like), matching rules (for example "case-insensitive string match", which is why a search for sn=meier finds Meier), and whether it is single- or multi-valued.
• Object class definitions: the MUST and MAY attribute lists and the parent class.
• Optional structure rules: which kinds of entries may appear below which others.

Because every server publishes its schema (in a special subschema entry), clients can discover which attributes exist. When an organisation needs its own data, for example an employee badge number, it extends the schema with a new attribute type and an auxiliary object class, each with its own OID.

Go deeper:

• LDAP.com: Understanding LDAP schema — attribute types, object classes, syntaxes and matching rules with real definitions.
• OpenLDAP Admin Guide: Schema specification — how to extend a real server's schema with your own attributes and classes.