posixAccount

posixAccount is an LDAP directory objectClass used to store UNIX-like user account information in a directory service. Defined as part of RFC 2307, it is commonly used alongside other RFC 2307 schemas such as shadowAccount to provide POSIX-compatible account data for UNIX and Linux systems. In practice, posixAccount is typically applied as an auxiliary objectClass to entries that represent users, enabling the directory to serve as the central source of truth for UNIX account attributes.

Key attributes and requirements of posixAccount include a login name and numeric identifiers. The required attributes are uid (the user’s login name), uidNumber (the numeric user ID), gidNumber (the numeric primary group ID), homeDirectory (the user’s home directory path), and loginShell (the user’s default shell). Optional attributes may include gecos (full name and related information) and other RFC 2307 attributes. When used, uidNumber and gidNumber should be unique within the directory to ensure consistent identity mapping across systems.

Relation to other schema elements is important. posixAccount is often used in combination with inetOrgPerson or organizationalPerson and is frequently paired with shadowAccount to provide password aging and expiry data. The entry’s Unix account data enables UNIX hosts to map directory users to local system accounts, supporting centralized administration and cross-system access control.

Use cases and implications. posixAccount supports centralized identity management for heterogeneous environments, enabling consistent UID/GID mappings, home directories, and shells across multiple UNIX-like machines. It is commonly implemented in OpenLDAP and other directory services to facilitate NSS/pam integration and networked authentication.

See also: RFC 2307, RFC 2307bis, OpenLDAP, NSS/PAM, shadowAccount.