Nova's LDAP schema has an unneeded requirement on the nis or bis schema

[Ryan Lane]

Though requiring the nis or bis schema doesn't necessarily exclude Active Directory, it adds an unneeded and bothersome requirement to include the nis schema, and forces the use of the uid attribute.

It would be better if the schema defined novaUser as follows:

objectClass (
    novaOCs:1
    NAME 'novaUser'
    DESC 'access and secret keys'
    AUXILIARY
    MUST ( cn )
    MAY ( accessKey $ secretKey $ isAdmin )
    )

This puts the requirement on person or inetorgperson instead, which is mostly universally used for user entries.

The code should default to using cn, but the configuration should default to using uid. Allowing this to be a configurable option allows users to define which attribute their directory server should be using, such as sAMAccountName in AD.

[Ryan Lane (rlane)]

Looking at the inetorgperson schema, it looks like uid is defined as a 'may' attribute. So there isn't a requirement on nis or bis, but this still complicates configuration for AD users, or users who use something other than uid as their username attribute, so the above schema change would still be necessary for proper interoperability.