switch to a new interface for doing attribute mapping, splitting the attribute mapping stuff into a separate file

git-svn-id: http://arthurdejong.org/svn/nss-pam-ldapd/nss-ldapd@326 ef36b2f9-881f-0410-afb5-c4e39611909c

20 files changed, 597 insertions, 179 deletions

diff --git a/nslcd/Makefile.am b/nslcd/Makefile.am
index 0da800a..14257a4 100644
--- a/nslcd/Makefile.am
+++ b/nslcd/Makefile.am
@@ -31,6 +31,7 @@ nslcd_SOURCES = nslcd.c ../nslcd.h ../nslcd-common.h \
                 pagectrl.c pagectrl.h \
                 util.c util.h \
                 cfg.c cfg.h \
+                attmap.c attmap.h \
                 alias.c ether.c group.c host.c netgroup.c network.c \
                 passwd.c protocol.c rpc.c service.c shadow.c
 nslcd_LDADD = @nslcd_LIBS@ ../common/libtio.a ../common/libdict.a
diff --git a/nslcd/alias.c b/nslcd/alias.c
index 6be04fc..5a43236 100644
--- a/nslcd/alias.c
+++ b/nslcd/alias.c
@@ -42,6 +42,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 static enum nss_status _nss_ldap_parse_alias(
         LDAPMessage *e,struct ldap_state UNUSED(*pvt),void *result,
@@ -54,11 +55,11 @@ static enum nss_status _nss_ldap_parse_alias(
   struct aliasent *alias=(struct aliasent *)result;
   enum nss_status stat;
 
-  stat=_nss_ldap_getrdnvalue(e,ATM(LM_ALIASES,cn),&alias->alias_name,&buffer,&buflen);
+  stat=_nss_ldap_getrdnvalue(e,attmap_alias_cn,&alias->alias_name,&buffer,&buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
-  stat=_nss_ldap_assign_attrvals(e,AT(rfc822MailMember),NULL,&alias->alias_members,&buffer,&buflen,&alias->alias_members_len);
+  stat=_nss_ldap_assign_attrvals(e,attmap_alias_rfc822MailMember,NULL,&alias->alias_members,&buffer,&buflen,&alias->alias_members_len);
 
   return stat;
 }
@@ -66,9 +67,9 @@ static enum nss_status _nss_ldap_parse_alias(
 static int write_alias(LDAPMessage *e,struct ldap_state UNUSED(*pvt),TFILE *fp)
 {
   int stat;
-  if ((stat=_nss_ldap_write_rndvalue(fp,e,ATM(LM_ALIASES,cn)))!=NSLCD_RESULT_SUCCESS)
+  if ((stat=_nss_ldap_write_rndvalue(fp,e,attmap_alias_cn))!=NSLCD_RESULT_SUCCESS)
     return stat;
-  if ((stat=_nss_ldap_write_attrvals(fp,e,AT(rfc822MailMember)))!=NSLCD_RESULT_SUCCESS)
+  if ((stat=_nss_ldap_write_attrvals(fp,e,attmap_alias_rfc822MailMember))!=NSLCD_RESULT_SUCCESS)
     return stat;
   return NSLCD_RESULT_SUCCESS;
 }
diff --git a/nslcd/attmap.c b/nslcd/attmap.c
new file mode 100644
index 0000000..9e0b712
--- /dev/null
+++ b/nslcd/attmap.c
@@ -0,0 +1,174 @@
+/*
+   attmap.c - attribute mapping values and functions
+   This file is part of the nss-ldapd library.
+
+   Copyright (C) 2007 Arthur de Jong
+
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with this library; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+   02110-1301 USA
+*/
+
+
+
+
+
+#ifdef NEW_DISABLED_FOR_NOW
+
+/**
+ * Vendor-specific attributes and object classes.
+ * (Mainly from Sun.)
+ * ( 1.3.6.1.4.1.42.2.27.1.2.5 NAME 'nisMailAlias' SUP top STRUCTURAL
+ *   DESC 'NIS mail alias'
+ *   MUST cn
+ *   MAY rfc822MailMember )
+ */
+const char *attmap_alias_objectClass      = "nisMailAlias";
+const char *attmap_alias_cn               = "cn";
+const char *attmap_alias_rfc822MailMember = "rfc822MailMember";
+
+/*
+ * ( nisSchema.2.11 NAME 'ieee802Device' SUP top AUXILIARY
+ *   DESC 'A device with a MAC address; device SHOULD be
+ *         used as a structural class'
+ *   MAY macAddress )
+ */
+const char *attmap_ether_objectClass = "ieee802Device";
+const char *attmap_ether_cn          = "cn";
+const char *attmap_ether_macAddress  = "macAddress";
+
+/*
+ * ( nisSchema.2.2 NAME 'posixGroup' SUP top STRUCTURAL
+ *   DESC 'Abstraction of a group of accounts'
+ *   MUST ( cn $ gidNumber )
+ *   MAY ( userPassword $ uidMember $ description ) )
+ */
+const char *attmap_group_objectClass   = "posixGroup";
+const char *attmap_group_cn            = "cn";
+const char *attmap_group_userPassword  = "userPassword";
+const char *attmap_group_gidNumber     = "gidNumber";
+const char *attmap_group_memberUid     = "memberUid";
+/* probably also support uniqueMember and memberOf attributes */
+
+/*
+ * ( nisSchema.2.6 NAME 'ipHost' SUP top AUXILIARY
+ *   DESC 'Abstraction of a host, an IP device. The distinguished
+ *         value of the cn attribute denotes the host's canonical
+ *         name. Device SHOULD be used as a structural class'
+ *   MUST ( cn $ ipHostNumber )
+ *   MAY ( l $ description $ manager ) )
+ */
+const char *attmap_host_objectClass   = "ipHost";
+const char *attmap_host_cn            = "cn";
+const char *attmap_host_ipHostNumber  = "ipHostNumber";
+
+/*
+ * ( nisSchema.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL
+ *   DESC 'Abstraction of a netgroup. May refer to other netgroups'
+ *   MUST cn
+ *   MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )
+ */
+const char *attmap_netgroup_objectClass     = "nisNetgroup";
+/*const char *attmap_netgroup_cn              = "cn";*/
+const char *attmap_netgroup_nisNetgroupTriple = "nisNetgroupTriple";
+const char *attmap_netgroup_memberNisNetgroup = "memberNisNetgroup";
+
+/*
+ * ( nisSchema.2.7 NAME 'ipNetwork' SUP top STRUCTURAL
+ *   DESC 'Abstraction of a network. The distinguished value of
+ *   MUST ( cn $ ipNetworkNumber )
+ *   MAY ( ipNetmaskNumber $ l $ description $ manager ) )
+ */
+const char *attmap_network_objectClass     = "ipNetwork";
+const char *attmap_network_cn              = "cn";
+const char *attmap_network_ipNetworkNumber = "ipNetworkNumber";
+/*const char *attmap_network_ipNetmaskNumber = "ipNetmaskNumber"; */
+
+/*
+ * ( nisSchema.2.0 NAME 'posixAccount' SUP top AUXILIARY
+ *   DESC 'Abstraction of an account with POSIX attributes'
+ *   MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )
+ *   MAY ( userPassword $ loginShell $ gecos $ description ) )
+ */
+const char *attmap_passwd_objectClass   = "posixAccount";
+const char *attmap_passwd_uid           = "uid";
+const char *attmap_passwd_userPassword  = "userPassword";
+const char *attmap_passwd_uidNumber     = "uidNumber";
+const char *attmap_passwd_gidNumber     = "gidNumber";
+const char *attmap_passwd_gecos         = "gecos";
+const char *attmap_passwd_cn            = "cn";
+const char *attmap_passwd_homeDirectory = "homeDirectory";
+const char *attmap_passwd_loginShell    = "loginShell";
+
+/*
+ * ( nisSchema.2.4 NAME 'ipProtocol' SUP top STRUCTURAL
+ *   DESC 'Abstraction of an IP protocol. Maps a protocol number
+ *         to one or more names. The distinguished value of the cn
+ *         attribute denotes the protocol's canonical name'
+ *   MUST ( cn $ ipProtocolNumber )
+ *    MAY description )
+ */
+const char *attmap_protocol_objectClass      = "ipProtocol";
+const char *attmap_protocol_cn               = "cn";
+const char *attmap_protocol_ipProtocolNumber = "ipProtocolNumber";
+
+/*
+ * ( nisSchema.2.5 NAME 'oncRpc' SUP top STRUCTURAL
+ *   DESC 'Abstraction of an Open Network Computing (ONC)
+ *         [RFC1057] Remote Procedure Call (RPC) binding.
+ *         This class maps an ONC RPC number to a name.
+ *         The distinguished value of the cn attribute denotes
+ *         the RPC service's canonical name'
+ *   MUST ( cn $ oncRpcNumber )
+ *   MAY description )
+ */
+const char *attmap_rpc_objectClass      = "oncRpc";
+const char *attmap_rpc_cn               = "cn";
+const char *attmap_rpc_oncRpcNumber     = "oncRpcNumber";
+
+/*
+ * ( nisSchema.2.3 NAME 'ipService' SUP top STRUCTURAL
+ *   DESC 'Abstraction an Internet Protocol service.
+ *         Maps an IP port and protocol (such as tcp or udp)
+ *         to one or more names; the distinguished value of
+ *         the cn attribute denotes the service's canonical
+ *         name'
+ *   MUST ( cn $ ipServicePort $ ipServiceProtocol )
+ *   MAY ( description ) )
+ */
+const char *attmap_service_objectClass       = "ipService";
+const char *attmap_service_cn                = "cn";
+const char *attmap_service_ipServicePort     = "ipServicePort";
+const char *attmap_service_ipServiceProtocol = "ipServiceProtocol";
+
+/*
+ * ( nisSchema.2.1 NAME 'shadowAccount' SUP top AUXILIARY
+ *   DESC 'Additional attributes for shadow passwords'
+ *   MUST uid
+ *   MAY ( userPassword $ shadowLastChange $ shadowMin
+ *         shadowMax $ shadowWarning $ shadowInactive $
+ *         shadowExpire $ shadowFlag $ description ) )
+ */
+const char *attmap_shadow_objectClass      = "shadowAccount";
+const char *attmap_shadow_uid              = "uid";
+const char *attmap_shadow_userPassword     = "userPassword";
+const char *attmap_shadow_shadowLastChange = "shadowLastChange";
+const char *attmap_shadow_shadowMin        = "shadowMin";
+const char *attmap_shadow_shadowMax        = "shadowMax";
+const char *attmap_shadow_shadowWarning    = "shadowWarning";
+const char *attmap_shadow_shadowInactive   = "shadowInactive";
+const char *attmap_shadow_shadowExpire     = "shadowExpire";
+const char *attmap_shadow_shadowFlag       = "shadowFlag";
+
+#endif /* NEW_DISABLED_FOR_NOW */
diff --git a/nslcd/attmap.h b/nslcd/attmap.h
new file mode 100644
index 0000000..83f2e7e
--- /dev/null
+++ b/nslcd/attmap.h
@@ -0,0 +1,249 @@
+/*
+   attmap.h - attribute mapping variables
+   This file is part of the nss-ldapd library.
+
+   Copyright (C) 2007 Arthur de Jong
+
+   This library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   This library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with this library; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+   02110-1301 USA
+*/
+
+#ifndef _ATTMAP_H
+#define _ATTMAP_H 1
+
+
+/* What follows is a list of attribute names per database. */
+
+#include <ldap-schema.h>
+
+#define attmap_objectClass             _nss_ldap_map_at(LM_NONE,AT_objectClass)
+
+#define attmap_alias_objectClass       _nss_ldap_map_oc(LM_NONE,OC_nisMailAlias)
+#define attmap_alias_cn                _nss_ldap_map_at(LM_ALIASES,AT_cn)
+#define attmap_alias_rfc822MailMember  _nss_ldap_map_at(LM_NONE,AT_rfc822MailMember)
+
+#define attmap_ether_objectClass       _nss_ldap_map_oc(LM_NONE,OC_ieee802Device)
+#define attmap_ether_cn                _nss_ldap_map_at(LM_ETHERS,AT_cn)
+#define attmap_ether_macAddress        _nss_ldap_map_at(LM_NONE,AT_macAddress)
+
+#define attmap_group_objectClass       _nss_ldap_map_oc(LM_NONE,OC_posixGroup)
+#define attmap_group_cn                _nss_ldap_map_at(LM_GROUP,AT_cn)
+#define attmap_group_userPassword      _nss_ldap_map_at(LM_GROUP,AT_userPassword)
+#define attmap_group_gidNumber         _nss_ldap_map_at(LM_GROUP,AT_gidNumber)
+#define attmap_group_memberUid         _nss_ldap_map_at(LM_GROUP,AT_memberUid)
+#define attmap_group_uniqueMember      _nss_ldap_map_at(LM_GROUP,AT_uniqueMember)
+#define attmap_group_memberOf          _nss_ldap_map_at(LM_GROUP,AT_memberOf)
+
+#define attmap_host_objectClass        _nss_ldap_map_oc(LM_NONE,OC_ipHost)
+#define attmap_host_cn                 _nss_ldap_map_at(LM_HOSTS,AT_cn)
+#define attmap_host_ipHostNumber       _nss_ldap_map_at(LM_NONE,AT_ipHostNumber)
+
+#define attmap_netgroup_objectClass       _nss_ldap_map_oc(LM_NONE,OC_nisNetgroup)
+#define attmap_netgroup_cn                _nss_ldap_map_at(LM_NETGROUP,AT_cn)
+#define attmap_netgroup_nisNetgroupTriple _nss_ldap_map_at(LM_NONE,AT_nisNetgroupTriple)
+#define attmap_netgroup_memberNisNetgroup _nss_ldap_map_at(LM_NONE,AT_memberNisNetgroup)
+
+#define attmap_network_objectClass     _nss_ldap_map_oc(LM_NONE,OC_ipNetwork)
+#define attmap_network_cn              _nss_ldap_map_at(LM_NETWORKS,AT_cn)
+#define attmap_network_ipNetworkNumber _nss_ldap_map_at(LM_NONE,AT_ipNetworkNumber)
+
+#define attmap_passwd_objectClass      _nss_ldap_map_oc(LM_NONE,OC_posixAccount) 
+#define attmap_passwd_uid              _nss_ldap_map_at(LM_PASSWD,AT_uid)
+#define attmap_passwd_userPassword     _nss_ldap_map_at(LM_PASSWD,AT_userPassword)
+#define attmap_passwd_uidNumber        _nss_ldap_map_at(LM_NONE,AT_uidNumber)
+#define attmap_passwd_gidNumber        _nss_ldap_map_at(LM_PASSWD,AT_gidNumber)
+#define attmap_passwd_gecos            _nss_ldap_map_at(LM_NONE,AT_gecos)
+#define attmap_passwd_cn               _nss_ldap_map_at(LM_PASSWD,AT_cn)
+#define attmap_passwd_homeDirectory    _nss_ldap_map_at(LM_NONE,AT_homeDirectory)
+#define attmap_passwd_loginShell       _nss_ldap_map_at(LM_NONE,AT_loginShell)
+
+#define attmap_protocol_objectClass      _nss_ldap_map_oc(LM_NONE,OC_ipProtocol)
+#define attmap_protocol_cn               _nss_ldap_map_at(LM_PROTOCOLS,AT_cn)
+#define attmap_protocol_ipProtocolNumber _nss_ldap_map_at(LM_NONE,AT_ipProtocolNumber)
+
+#define attmap_rpc_objectClass         _nss_ldap_map_oc(LM_NONE,OC_oncRpc)
+#define attmap_rpc_cn                  _nss_ldap_map_at(LM_RPC,AT_cn)
+#define attmap_rpc_oncRpcNumber        _nss_ldap_map_at(LM_NONE,AT_oncRpcNumber)
+
+#define attmap_service_objectClass       _nss_ldap_map_oc(LM_NONE,OC_ipService)
+#define attmap_service_cn                _nss_ldap_map_at(LM_SERVICES,AT_cn)
+#define attmap_service_ipServicePort     _nss_ldap_map_at(LM_NONE,AT_ipServicePort)
+#define attmap_service_ipServiceProtocol _nss_ldap_map_at(LM_NONE,AT_ipServiceProtocol)
+
+#define attmap_shadow_objectClass      _nss_ldap_map_oc(LM_NONE,OC_shadowAccount)
+#define attmap_shadow_uid              _nss_ldap_map_at(LM_SHADOW,AT_uid)
+#define attmap_shadow_userPassword     _nss_ldap_map_at(LM_SHADOW,AT_userPassword)
+#define attmap_shadow_shadowLastChange _nss_ldap_map_at(LM_NONE,AT_shadowLastChange)
+#define attmap_shadow_shadowMin        _nss_ldap_map_at(LM_NONE,AT_shadowMin)
+#define attmap_shadow_shadowMax        _nss_ldap_map_at(LM_NONE,AT_shadowMax)
+#define attmap_shadow_shadowWarning    _nss_ldap_map_at(LM_NONE,AT_shadowWarning)
+#define attmap_shadow_shadowInactive   _nss_ldap_map_at(LM_NONE,AT_shadowInactive)
+#define attmap_shadow_shadowExpire     _nss_ldap_map_at(LM_NONE,AT_shadowExpire)
+#define attmap_shadow_shadowFlag       _nss_ldap_map_at(LM_NONE,AT_shadowFlag)
+
+
+#ifdef NEW_DISABLED_FOR_NOW
+
+/* This is new code to be put in place as new attribute mapping stuff.
+   This will just use strings that may be replaced elsewhere. */
+
+/**
+ * Vendor-specific attributes and object classes.
+ * (Mainly from Sun.)
+ * ( 1.3.6.1.4.1.42.2.27.1.2.5 NAME 'nisMailAlias' SUP top STRUCTURAL
+ *   DESC 'NIS mail alias'
+ *   MUST cn
+ *   MAY rfc822MailMember )
+ */
+extern const char *attmap_alias_objectClass;
+extern const char *attmap_alias_cn;
+extern const char *attmap_alias_rfc822MailMember;
+
+/*
+ * ( nisSchema.2.11 NAME 'ieee802Device' SUP top AUXILIARY
+ *   DESC 'A device with a MAC address; device SHOULD be
+ *         used as a structural class'
+ *   MAY macAddress )
+ */
+extern const char *attmap_ether_objectClass;
+extern const char *attmap_ether_cn;
+extern const char *attmap_ether_macAddress;
+
+/*
+ * ( nisSchema.2.2 NAME 'posixGroup' SUP top STRUCTURAL
+ *   DESC 'Abstraction of a group of accounts'
+ *   MUST ( cn $ gidNumber )
+ *   MAY ( userPassword $ uidMember $ description ) )
+ */
+extern const char *attmap_group_objectClass;
+extern const char *attmap_group_cn;
+extern const char *attmap_group_userPassword;
+extern const char *attmap_group_gidNumber;
+extern const char *attmap_group_memberUid;
+/* probably also support uniqueMember and memberOf attributes */
+
+/*
+ * ( nisSchema.2.6 NAME 'ipHost' SUP top AUXILIARY
+ *   DESC 'Abstraction of a host,An IP device. The distinguished
+ *         value of the cn attribute denotes the host's canonical
+ *         name. Device SHOULD be used as a structural class'
+ *   MUST ( cn $ ipHostNumber )
+ *   MAY ( l $ description $ manager ) )
+ */
+extern const char *attmap_host_objectClass;
+extern const char *attmap_host_cn;
+extern const char *attmap_host_ipHostNumber;
+
+/*
+ * ( nisSchema.2.8 NAME 'nisNetgroup' SUP top STRUCTURAL
+ *   DESC 'Abstraction of a netgroup. May refer to other netgroups'
+ *   MUST cn
+ *   MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )
+ */
+extern const char *attmap_netgroup_objectClass;
+/*extern const char *attmap_netgroup_cn;*/
+extern const char *attmap_netgroup_nisNetgroupTriple;
+extern const char *attmap_netgroup_memberNisNetgroup;
+
+/*
+ * ( nisSchema.2.7 NAME 'ipNetwork' SUP top STRUCTURAL
+ *   DESC 'Abstraction of a network. The distinguished value of
+ *   MUST ( cn $ ipNetworkNumber )
+ *   MAY ( ipNetmaskNumber $ l $ description $ manager ) )
+ */
+extern const char *attmap_network_objectClass;
+extern const char *attmap_network_cn;
+extern const char *attmap_network_ipNetworkNumber;
+/*extern const char *attmap_network_ipNetmaskNumber; */
+
+/*
+ * ( nisSchema.2.0 NAME 'posixAccount' SUP top AUXILIARY
+ *   DESC 'Abstraction of an account with POSIX attributes'
+ *   MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )
+ *   MAY ( userPassword $ loginShell $ gecos $ description ) )
+ */
+extern const char *attmap_passwd_objectClass;
+extern const char *attmap_passwd_uid;
+extern const char *attmap_passwd_userPassword;
+extern const char *attmap_passwd_uidNumber;
+extern const char *attmap_passwd_gidNumber;
+extern const char *attmap_passwd_gecos;
+extern const char *attmap_passwd_cn;
+extern const char *attmap_passwd_homeDirectory;
+extern const char *attmap_passwd_loginShell;
+
+/*
+ * ( nisSchema.2.4 NAME 'ipProtocol' SUP top STRUCTURAL
+ *   DESC 'Abstraction of an IP protocol. Maps a protocol number
+ *         to one or more names. The distinguished value of the cn
+ *         attribute denotes the protocol's canonical name'
+ *   MUST ( cn $ ipProtocolNumber )
+ *    MAY description )
+ */
+extern const char *attmap_protocol_objectClass;
+extern const char *attmap_protocol_cn;
+extern const char *attmap_protocol_ipProtocolNumber;
+
+/*
+ * ( nisSchema.2.5 NAME 'oncRpc' SUP top STRUCTURAL
+ *   DESC 'Abstraction of an Open Network Computing (ONC)
+ *         [RFC1057] Remote Procedure Call (RPC) binding.
+ *         This class maps an ONC RPC number to a name.
+ *         The distinguished value of the cn attribute denotes
+ *         the RPC service's canonical name'
+ *   MUST ( cn $ oncRpcNumber )
+ *   MAY description )
+ */
+extern const char *attmap_rpc_objectClass;
+extern const char *attmap_rpc_cn;
+extern const char *attmap_rpc_oncRpcNumber;
+
+/*
+ * ( nisSchema.2.3 NAME 'ipService' SUP top STRUCTURAL
+ *   DESC 'Abstraction an Internet Protocol service.
+ *         Maps an IP port and protocol (such as tcp or udp)
+ *         to one or more names; the distinguished value of
+ *         the cn attribute denotes the service's canonical
+ *         name'
+ *   MUST ( cn $ ipServicePort $ ipServiceProtocol )
+ *   MAY ( description ) )
+ */
+extern const char *attmap_service_objectClass;
+extern const char *attmap_service_cn;
+extern const char *attmap_service_ipServicePort;
+extern const char *attmap_service_ipServiceProtocol;
+
+/*
+ * ( nisSchema.2.1 NAME 'shadowAccount' SUP top AUXILIARY
+ *   DESC 'Additional attributes for shadow passwords'
+ *   MUST uid
+ *   MAY ( userPassword $ shadowLastChange $ shadowMin
+ *         shadowMax $ shadowWarning $ shadowInactive $
+ *         shadowExpire $ shadowFlag $ description ) )
+ */
+extern const char *attmap_shadow_objectClass;
+extern const char *attmap_shadow_uid;
+extern const char *attmap_shadow_userPassword;
+extern const char *attmap_shadow_shadowLastChange;
+extern const char *attmap_shadow_shadowMin;
+extern const char *attmap_shadow_shadowMax;
+extern const char *attmap_shadow_shadowWarning;
+extern const char *attmap_shadow_shadowInactive;
+extern const char *attmap_shadow_shadowExpire;
+extern const char *attmap_shadow_shadowFlag;
+
+#endif /* NEW_DISABLED_FOR_NOW */
+
+#endif /* not _ATTMAP_H */
diff --git a/nslcd/cfg.c b/nslcd/cfg.c
index 42e9785..6811355 100644
--- a/nslcd/cfg.c
+++ b/nslcd/cfg.c
@@ -36,6 +36,7 @@
 #include "ldap-nss.h"
 #include "util.h"
 #include "log.h"
+#include "ldap-schema.h"
 
 struct ldap_config *nslcd_cfg=NULL;
 
diff --git a/nslcd/ether.c b/nslcd/ether.c
index b2c2acf..44472fc 100644
--- a/nslcd/ether.c
+++ b/nslcd/ether.c
@@ -59,6 +59,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 #ifndef HAVE_STRUCT_ETHER_ADDR
 struct ether_addr {
@@ -82,13 +83,13 @@ static int write_ether(LDAPMessage *e,struct ldap_state *pvt,TFILE *fp)
   int stat;
   char buffer[1024];
   /* write NSLCD_STRING(ETHER_NAME) */
-  stat=_nss_ldap_write_attrval(fp,e,ATM(LM_ETHERS,cn));
+  stat=_nss_ldap_write_attrval(fp,e,attmap_ether_cn);
   if (stat!=NSLCD_RESULT_SUCCESS)
     return stat;
   /* write NSLCD_TYPE(ETHER_ADDR,u_int8_t[6]) */
-  stat=_nss_ldap_write_attrval_ether(fp,e,AT(macAddress));
+  stat=_nss_ldap_write_attrval_ether(fp,e,attmap_ether_macAddress);
 
-  stat = _nss_ldap_assign_attrval (e, AT (macAddress), &saddr,
+  stat = _nss_ldap_assign_attrval (e, attmap_ether_macAddress, &saddr,
                                    &buffer, &buflen);
   if (stat != NSS_STATUS_SUCCESS || ((addr = ether_aton (saddr)) == NULL))
     return NSS_STATUS_NOTFOUND;
@@ -107,12 +108,12 @@ _nss_ldap_parse_ether (LDAPMessage * e,
   enum nss_status stat;
   struct ether_addr *addr;
 
-  stat = _nss_ldap_assign_attrval (e, ATM (LM_ETHERS, cn),
+  stat = _nss_ldap_assign_attrval (e, attmap_ether_cn,
                                    &ether->e_name, &buffer, &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
-  stat = _nss_ldap_assign_attrval (e, AT (macAddress), &saddr,
+  stat = _nss_ldap_assign_attrval (e, attmap_ether_macAddress, &saddr,
                                    &buffer, &buflen);
 
   if (stat != NSS_STATUS_SUCCESS || ((addr = ether_aton (saddr)) == NULL))
diff --git a/nslcd/group.c b/nslcd/group.c
index 2c1610e..3549759 100644
--- a/nslcd/group.c
+++ b/nslcd/group.c
@@ -49,6 +49,7 @@
 #include "common.h"
 #include "log.h"
 #include "cfg.h"
+#include "attmap.h"
 
 /* FIXME: fix following problem:
           if the entry has multiple cn fields we may end up
@@ -388,7 +389,7 @@ do_parse_group_members (LDAPMessage * e,
   int start, end = 0;
   char *groupdn = NULL;
 
-  uniquemember_attr = ATM (LM_GROUP, uniqueMember);
+  uniquemember_attr = attmap_group_uniqueMember;
 
   uniquemember_attrs[0] = uniquemember_attr;
   uniquemember_attrs[1] = NULL;
@@ -437,7 +438,7 @@ do_parse_group_members (LDAPMessage * e,
           groupMembersCount += ldap_count_values (dnValues);
         }
 
-      uidValues = _nss_ldap_get_values (e, ATM (LM_GROUP, memberUid));
+      uidValues = _nss_ldap_get_values (e, attmap_group_memberUid);
       if (uidValues != NULL)
         {
           groupMembersCount += ldap_count_values (uidValues);
@@ -662,7 +663,7 @@ _nss_ldap_parse_gr (LDAPMessage * e,
   struct name_list *knownGroups = NULL;
 
   stat =
-    _nss_ldap_assign_attrval (e, ATM (LM_GROUP, gidNumber), &gid, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_group_gidNumber, &gid, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
@@ -673,13 +674,13 @@ _nss_ldap_parse_gr (LDAPMessage * e,
                                                               10);
 
   stat =
-    _nss_ldap_getrdnvalue (e, ATM (LM_GROUP, cn), &gr->gr_name, &buffer,
+    _nss_ldap_getrdnvalue (e, attmap_group_cn, &gr->gr_name, &buffer,
                            &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
   stat =
-    _nss_ldap_assign_userpassword (e, ATM (LM_GROUP, userPassword),
+    _nss_ldap_assign_userpassword (e, attmap_group_userPassword,
                                    &gr->gr_passwd, &buffer, &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
@@ -714,7 +715,7 @@ _nss_ldap_parse_gr (LDAPMessage * e,
   else
     {
       stat =
-        _nss_ldap_assign_attrvals (e, ATM (LM_GROUP, memberUid), NULL,
+        _nss_ldap_assign_attrvals (e, attmap_group_memberUid, NULL,
                                    &gr->gr_mem, &buffer, &buflen, NULL);
     }
 
@@ -736,7 +737,7 @@ do_parse_initgroups (LDAPMessage * e,
   gid_t gid;
   ldap_initgroups_args_t *lia = (ldap_initgroups_args_t *) result;
 
-  values = _nss_ldap_get_values (e, ATM (LM_GROUP, gidNumber));
+  values = _nss_ldap_get_values (e, attmap_group_gidNumber);
   if (values == NULL)
     {
       /* invalid group; skip it */
@@ -842,7 +843,7 @@ do_parse_initgroups_nested (LDAPMessage * e,
        * Now add the GIDs of any groups of which this group is
        * a member.
        */
-      values = _nss_ldap_get_values (e, ATM (LM_GROUP, memberOf));
+      values = _nss_ldap_get_values (e, attmap_group_memberOf);
       if (values != NULL)
         {
           lia->depth++;
@@ -891,7 +892,7 @@ static enum nss_status ng_chase(const char *dn, ldap_initgroups_args_t * lia)
   if (_nss_ldap_namelist_find (lia->known_groups, dn))
     return NSS_STATUS_NOTFOUND;
 
-  gidnumber_attrs[0] = ATM (LM_GROUP, gidNumber);
+  gidnumber_attrs[0] = attmap_group_gidNumber;
   gidnumber_attrs[1] = NULL;
 
   LA_INIT (a);
@@ -962,8 +963,8 @@ static enum nss_status ng_chase_backlink(const char ** membersOf, ldap_initgroup
       return NSS_STATUS_NOTFOUND;
     }
 
-  gidnumber_attrs[0] = ATM (LM_GROUP, gidNumber);
-  gidnumber_attrs[1] = ATM (LM_GROUP, memberOf);
+  gidnumber_attrs[0] = attmap_group_gidNumber;
+  gidnumber_attrs[1] = attmap_group_memberOf;
   gidnumber_attrs[2] = NULL;
 
   LA_INIT (a);
@@ -1070,8 +1071,8 @@ static enum nss_status group_bymember(const char *user, long int *start,
       LA_STRING2 (a) = LA_STRING (a);
       LA_TYPE (a) = LA_TYPE_STRING_AND_STRING;
 
-      gidnumber_attrs[0] = ATM (LM_GROUP, gidNumber);
-      gidnumber_attrs[1] = ATM (LM_GROUP, memberOf);
+      gidnumber_attrs[0] = attmap_group_gidNumber;
+      gidnumber_attrs[1] = attmap_group_memberOf;
       gidnumber_attrs[2] = NULL;
 
       map = LM_PASSWD;
@@ -1109,7 +1110,7 @@ static enum nss_status group_bymember(const char *user, long int *start,
           filter = _nss_ldap_filt_getgroupsbymember;
         }
 
-      gidnumber_attrs[0] = ATM (LM_GROUP, gidNumber);
+      gidnumber_attrs[0] = attmap_group_gidNumber;
       gidnumber_attrs[1] = NULL;
     }
 
diff --git a/nslcd/host.c b/nslcd/host.c
index 4ebc544..68fb1de 100644
--- a/nslcd/host.c
+++ b/nslcd/host.c
@@ -53,6 +53,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 #ifndef MAXALIASES
 #define MAXALIASES 35
@@ -105,19 +106,19 @@ _nss_ldap_parse_host (LDAPMessage * e,
 
   *addressbuf = *buffer = '\0';
 
-  stat = _nss_ldap_assign_attrval (e, ATM (LM_HOSTS, cn), &host->h_name,
+  stat = _nss_ldap_assign_attrval (e, attmap_host_cn, &host->h_name,
                                    &buffer, &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
   stat =
-    _nss_ldap_assign_attrvals (e, ATM (LM_HOSTS, cn), host->h_name,
+    _nss_ldap_assign_attrvals (e, attmap_host_cn, host->h_name,
                                &host->h_aliases, &buffer, &buflen, NULL);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
   stat =
-    _nss_ldap_assign_attrvals (e, AT (ipHostNumber), NULL, &addresses,
+    _nss_ldap_assign_attrvals (e, attmap_host_ipHostNumber, NULL, &addresses,
                                &p_addressbuf, &addresslen, &addresscount);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
diff --git a/nslcd/ldap-nss.c b/nslcd/ldap-nss.c
index 9bcc930..a482f25 100644
--- a/nslcd/ldap-nss.c
+++ b/nslcd/ldap-nss.c
@@ -79,6 +79,8 @@
 #include "pagectrl.h"
 #include "common.h"
 #include "log.h"
+#include "ldap-schema.h"
+#include "attmap.h"
 
 /* how many messages to retrieve results for */
 #ifndef LDAP_MSG_ONE
@@ -2975,7 +2977,7 @@ int has_objectclass(LDAPMessage *entry,const char *objectclass)
   ld=__session.ls_conn;
   if (ld==NULL)
     return 0;
-  vals=ldap_get_values(ld,entry,AT(objectClass));
+  vals=ldap_get_values(ld,entry,attmap_objectClass);
   if (vals==NULL)
     return 0;
   for (i=0;vals[i]!=NULL;i++)
diff --git a/nslcd/ldap-nss.h b/nslcd/ldap-nss.h
index 5009a9a..ca55389 100644
--- a/nslcd/ldap-nss.h
+++ b/nslcd/ldap-nss.h
@@ -46,7 +46,6 @@
 #include <nss.h>
 #include <ldap.h>
 
-#include "ldap-schema.h"
 #include "common/tio.h"
 
 #ifndef LDAP_FILT_MAXSIZ
diff --git a/nslcd/ldap-schema.c b/nslcd/ldap-schema.c
index f7b2839..c354718 100644
--- a/nslcd/ldap-schema.c
+++ b/nslcd/ldap-schema.c
@@ -45,6 +45,7 @@
 #include "ldap-nss.h"
 #include "ldap-schema.h"
 #include "util.h"
+#include "attmap.h"
 
 /* max number of attributes per object class */
 #define ATTRTAB_SIZE    15
@@ -119,121 +120,121 @@ _nss_ldap_init_filters ()
 {
   /* rfc822 mail aliases */
   snprintf (_nss_ldap_filt_getaliasbyname, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (nisMailAlias),
-            ATM (LM_ALIASES, cn), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_alias_objectClass,
+            attmap_alias_cn, "%s");
   snprintf (_nss_ldap_filt_getaliasent, LDAP_FILT_MAXSIZ,
-            "(%s=%s)", AT (objectClass), OC (nisMailAlias));
+            "(%s=%s)", attmap_objectClass, attmap_alias_objectClass);
 
   /* MAC address mappings */
   snprintf (_nss_ldap_filt_gethostton, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ieee802Device),
-            ATM (LM_ETHERS, cn), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_ether_objectClass,
+            attmap_ether_cn, "%s");
   snprintf (_nss_ldap_filt_getntohost, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ieee802Device), AT (macAddress),
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_ether_objectClass, attmap_ether_macAddress,
             "%s");
   snprintf (_nss_ldap_filt_getetherent, LDAP_FILT_MAXSIZ, "(%s=%s)",
-            AT (objectClass), OC (ieee802Device));
+            attmap_objectClass, attmap_ether_objectClass);
 
   /* groups */
   snprintf (_nss_ldap_filt_getgrnam, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (posixGroup),
-            ATM (LM_GROUP, cn), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_group_objectClass,
+            attmap_group_cn, "%s");
   snprintf (_nss_ldap_filt_getgrgid, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (posixGroup),
-            ATM (LM_GROUP, gidNumber), "%d");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_group_objectClass,
+            attmap_group_gidNumber, "%d");
   snprintf (_nss_ldap_filt_getgrent, LDAP_FILT_MAXSIZ, "(&(%s=%s))",
-            AT (objectClass), OC (posixGroup));
+            attmap_objectClass, attmap_group_objectClass);
   snprintf (_nss_ldap_filt_getgroupsbymemberanddn, LDAP_FILT_MAXSIZ,
             "(&(%s=%s)(|(%s=%s)(%s=%s)))",
-            AT (objectClass), OC (posixGroup), AT (memberUid), "%s", AT (uniqueMember), "%s");
+            attmap_objectClass, attmap_group_objectClass, attmap_group_memberUid, "%s", attmap_group_uniqueMember, "%s");
   snprintf (_nss_ldap_filt_getgroupsbydn, LDAP_FILT_MAXSIZ,
             "(&(%s=%s)(%s=%s))",
-            AT (objectClass), OC (posixGroup), AT (uniqueMember), "%s");
+            attmap_objectClass, attmap_group_objectClass, attmap_group_uniqueMember, "%s");
   snprintf (_nss_ldap_filt_getpwnam_groupsbymember, LDAP_FILT_MAXSIZ,
             "(|(&(%s=%s)(%s=%s))(&(%s=%s)(%s=%s)))",
-            AT (objectClass), OC (posixGroup), AT (memberUid), "%s",
-            AT (objectClass), OC (posixAccount), ATM (LM_PASSWD, uid), "%s");
+            attmap_objectClass, attmap_group_objectClass, attmap_group_memberUid, "%s",
+            attmap_objectClass, attmap_passwd_objectClass, attmap_passwd_uid, "%s");
   snprintf (_nss_ldap_filt_getgroupsbymember, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (posixGroup), AT (memberUid),
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_group_objectClass, attmap_group_memberUid,
             "%s");
 
   /* IP hosts */
   snprintf (_nss_ldap_filt_gethostbyname, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ipHost), ATM (LM_HOSTS, cn),
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_host_objectClass, attmap_host_cn,
             "%s");
   snprintf (_nss_ldap_filt_gethostbyaddr, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ipHost), AT (ipHostNumber),
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_host_objectClass, attmap_host_ipHostNumber,
             "%s");
   snprintf (_nss_ldap_filt_gethostent, LDAP_FILT_MAXSIZ, "(%s=%s)",
-            AT (objectClass), OC (ipHost));
+            attmap_objectClass, attmap_host_objectClass);
 
   /* IP networks */
   snprintf (_nss_ldap_filt_getnetbyname, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ipNetwork),
-            ATM (LM_NETWORKS, cn), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_network_objectClass,
+            attmap_network_cn, "%s");
   snprintf (_nss_ldap_filt_getnetbyaddr, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ipNetwork),
-            AT (ipNetworkNumber), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_network_objectClass,
+            attmap_network_ipNetworkNumber, "%s");
   snprintf (_nss_ldap_filt_getnetent, LDAP_FILT_MAXSIZ, "(%s=%s)",
-            AT (objectClass), OC (ipNetwork));
+            attmap_objectClass, attmap_network_objectClass);
 
   /* IP protocols */
   snprintf (_nss_ldap_filt_getprotobyname, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ipProtocol),
-            ATM (LM_PROTOCOLS, cn), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_protocol_objectClass,
+            attmap_protocol_cn, "%s");
   snprintf (_nss_ldap_filt_getprotobynumber, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ipProtocol),
-            AT (ipProtocolNumber), "%d");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_protocol_objectClass,
+            attmap_protocol_ipProtocolNumber, "%d");
   snprintf (_nss_ldap_filt_getprotoent, LDAP_FILT_MAXSIZ, "(%s=%s)",
-            AT (objectClass), OC (ipProtocol));
+            attmap_objectClass, attmap_protocol_objectClass);
 
   /* users */
   snprintf (_nss_ldap_filt_getpwnam, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (posixAccount),
-            ATM (LM_PASSWD, uid), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_passwd_objectClass,
+            attmap_passwd_uid, "%s");
   snprintf (_nss_ldap_filt_getpwuid, LDAP_FILT_MAXSIZ,
             "(&(%s=%s)(%s=%s))",
-            AT (objectClass), OC (posixAccount), AT (uidNumber), "%d");
+            attmap_objectClass, attmap_passwd_objectClass, attmap_passwd_uidNumber, "%d");
   snprintf (_nss_ldap_filt_getpwent, LDAP_FILT_MAXSIZ,
-            "(%s=%s)", AT (objectClass), OC (posixAccount));
+            "(%s=%s)", attmap_objectClass, attmap_passwd_objectClass);
 
   /* RPCs */
   snprintf (_nss_ldap_filt_getrpcbyname, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (oncRpc), ATM (LM_RPC, cn), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_rpc_objectClass, attmap_rpc_cn, "%s");
   snprintf (_nss_ldap_filt_getrpcbynumber, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (oncRpc), AT (oncRpcNumber),
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_rpc_objectClass, attmap_rpc_oncRpcNumber,
             "%d");
   snprintf (_nss_ldap_filt_getrpcent, LDAP_FILT_MAXSIZ, "(%s=%s)",
-            AT (objectClass), OC (oncRpc));
+            attmap_objectClass, attmap_rpc_objectClass);
 
   /* IP services */
   snprintf (_nss_ldap_filt_getservbyname, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ipService), ATM (LM_SERVICES, cn),
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_service_objectClass, attmap_service_cn,
             "%s");
   snprintf (_nss_ldap_filt_getservbynameproto, LDAP_FILT_MAXSIZ,
             "(&(%s=%s)(%s=%s)(%s=%s))",
-            AT (objectClass), OC (ipService), ATM (LM_SERVICES, cn), "%s", AT (ipServiceProtocol),
+            attmap_objectClass, attmap_service_objectClass, attmap_service_cn, "%s", attmap_service_ipServiceProtocol,
             "%s");
   snprintf (_nss_ldap_filt_getservbyport, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (ipService), AT (ipServicePort),
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_service_objectClass, attmap_service_ipServicePort,
             "%d");
   snprintf (_nss_ldap_filt_getservbyportproto, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s)(%s=%s))", AT (objectClass), OC (ipService),
-            AT (ipServicePort), "%d", AT (ipServiceProtocol), "%s");
+            "(&(%s=%s)(%s=%s)(%s=%s))", attmap_objectClass, attmap_service_objectClass,
+            attmap_service_ipServicePort, "%d", attmap_service_ipServiceProtocol, "%s");
   snprintf (_nss_ldap_filt_getservent, LDAP_FILT_MAXSIZ, "(%s=%s)",
-            AT (objectClass), OC (ipService));
+            attmap_objectClass, attmap_service_objectClass);
 
   /* shadow users */
   snprintf (_nss_ldap_filt_getspnam, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (shadowAccount),
-            ATM (LM_SHADOW, uid), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_shadow_objectClass,
+            attmap_shadow_uid, "%s");
   snprintf (_nss_ldap_filt_getspent, LDAP_FILT_MAXSIZ,
-            "(%s=%s)", AT (objectClass), OC (shadowAccount));
+            "(%s=%s)", attmap_objectClass, attmap_shadow_objectClass);
 
   /* netgroups */
   snprintf (_nss_ldap_filt_getnetgrent, LDAP_FILT_MAXSIZ,
-            "(&(%s=%s)(%s=%s))", AT (objectClass), OC (nisNetgroup),
-            ATM (LM_NETGROUP, cn), "%s");
+            "(&(%s=%s)(%s=%s))", attmap_objectClass, attmap_netgroup_objectClass,
+            attmap_netgroup_cn, "%s");
 
 }
 
@@ -245,16 +246,16 @@ init_pwd_attributes (const char ***pwd_attrs)
 
   (*pwd_attrs) = __pwd_attrs;
 
-  (*pwd_attrs)[i++] = ATM (LM_PASSWD, uid);
-  (*pwd_attrs)[i++] = ATM (LM_PASSWD, userPassword);
-  (*pwd_attrs)[i++] = AT (uidNumber);
-  (*pwd_attrs)[i++] = ATM (LM_PASSWD, gidNumber);
-  (*pwd_attrs)[i++] = ATM (LM_PASSWD, cn);
-  (*pwd_attrs)[i++] = AT (homeDirectory);
-  (*pwd_attrs)[i++] = AT (loginShell);
-  (*pwd_attrs)[i++] = AT (gecos);
-  (*pwd_attrs)[i++] = ATM (LM_PASSWD, description);
-  (*pwd_attrs)[i++] = AT (objectClass);
+  (*pwd_attrs)[i++] = attmap_passwd_uid;
+  (*pwd_attrs)[i++] = attmap_passwd_userPassword;
+  (*pwd_attrs)[i++] = attmap_passwd_uidNumber;
+  (*pwd_attrs)[i++] = attmap_passwd_gidNumber;
+  (*pwd_attrs)[i++] = attmap_passwd_cn;
+  (*pwd_attrs)[i++] = attmap_passwd_homeDirectory;
+  (*pwd_attrs)[i++] = attmap_passwd_loginShell;
+  (*pwd_attrs)[i++] = attmap_passwd_gecos;
+  (*pwd_attrs)[i++] = "description";
+  (*pwd_attrs)[i++] = attmap_objectClass;
   (*pwd_attrs)[i] = NULL;
 }
 
@@ -265,15 +266,15 @@ init_sp_attributes (const char ***sp_attrs)
 
   (*sp_attrs) = __sp_attrs;
 
-  (*sp_attrs)[0] = ATM (LM_SHADOW, uid);
-  (*sp_attrs)[1] = ATM (LM_SHADOW, userPassword);
-  (*sp_attrs)[2] = AT (shadowLastChange);
-  (*sp_attrs)[3] = AT (shadowMax);
-  (*sp_attrs)[4] = AT (shadowMin);
-  (*sp_attrs)[5] = AT (shadowWarning);
-  (*sp_attrs)[6] = AT (shadowInactive);
-  (*sp_attrs)[7] = AT (shadowExpire);
-  (*sp_attrs)[8] = AT (shadowFlag);
+  (*sp_attrs)[0] = attmap_shadow_uid;
+  (*sp_attrs)[1] = attmap_shadow_userPassword;
+  (*sp_attrs)[2] = attmap_shadow_shadowLastChange;
+  (*sp_attrs)[3] = attmap_shadow_shadowMax;
+  (*sp_attrs)[4] = attmap_shadow_shadowMin;
+  (*sp_attrs)[5] = attmap_shadow_shadowWarning;
+  (*sp_attrs)[6] = attmap_shadow_shadowInactive;
+  (*sp_attrs)[7] = attmap_shadow_shadowExpire;
+  (*sp_attrs)[8] = attmap_shadow_shadowFlag;
   (*sp_attrs)[9] = NULL;
 }
 
@@ -285,12 +286,12 @@ init_grp_attributes (const char ***grp_attrs)
 
   (*grp_attrs) = __grp_attrs;
 
-  (*grp_attrs)[i++] = ATM (LM_GROUP, cn);
-  (*grp_attrs)[i++] = ATM (LM_GROUP, userPassword);
-  (*grp_attrs)[i++] = AT (memberUid);
+  (*grp_attrs)[i++] = attmap_group_cn;
+  (*grp_attrs)[i++] = attmap_group_userPassword;
+  (*grp_attrs)[i++] = attmap_group_memberUid;
   if (_nss_ldap_test_config_flag (NSS_LDAP_FLAGS_RFC2307BIS))
-    (*grp_attrs)[i++] = AT (uniqueMember);
-  (*grp_attrs)[i++] = ATM (LM_GROUP, gidNumber);
+    (*grp_attrs)[i++] = attmap_group_uniqueMember;
+  (*grp_attrs)[i++] = attmap_group_gidNumber;
   (*grp_attrs)[i] = NULL;
 }
 
@@ -301,8 +302,8 @@ init_hosts_attributes (const char ***hosts_attrs)
 
   (*hosts_attrs) = __hosts_attrs;
 
-  (*hosts_attrs)[0] = ATM (LM_HOSTS, cn);
-  (*hosts_attrs)[1] = AT (ipHostNumber);
+  (*hosts_attrs)[0] = attmap_host_cn;
+  (*hosts_attrs)[1] = attmap_host_ipHostNumber;
   (*hosts_attrs)[2] = NULL;
 }
 
@@ -313,9 +314,9 @@ init_services_attributes (const char ***services_attrs)
 
   (*services_attrs) = __services_attrs;
 
-  (*services_attrs)[0] = ATM (LM_SERVICES, cn);
-  (*services_attrs)[1] = AT (ipServicePort);
-  (*services_attrs)[2] = AT (ipServiceProtocol);
+  (*services_attrs)[0] = attmap_service_cn;
+  (*services_attrs)[1] = attmap_service_ipServicePort;
+  (*services_attrs)[2] = attmap_service_ipServiceProtocol;
   (*services_attrs)[3] = NULL;
 }
 
@@ -326,10 +327,9 @@ init_network_attributes (const char ***network_attrs)
 
   (*network_attrs) = __network_attrs;
 
-  (*network_attrs)[0] = ATM (LM_NETWORKS, cn);
-  (*network_attrs)[1] = AT (ipNetworkNumber);
-  (*network_attrs)[2] = AT (ipNetmaskNumber);
-  (*network_attrs)[3] = NULL;
+  (*network_attrs)[0] = attmap_network_cn;
+  (*network_attrs)[1] = attmap_network_ipNetworkNumber;
+  (*network_attrs)[2] = NULL;
 }
 
 static void
@@ -339,8 +339,8 @@ init_proto_attributes (const char ***proto_attrs)
 
   (*proto_attrs) = __proto_attrs;
 
-  (*proto_attrs)[0] = ATM (LM_PROTOCOLS, cn);
-  (*proto_attrs)[1] = AT (ipProtocolNumber);
+  (*proto_attrs)[0] = attmap_protocol_cn;
+  (*proto_attrs)[1] = attmap_protocol_ipProtocolNumber;
   (*proto_attrs)[2] = NULL;
 }
 
@@ -351,8 +351,8 @@ init_rpc_attributes (const char ***rpc_attrs)
 
   (*rpc_attrs) = __rpc_attrs;
 
-  (*rpc_attrs)[0] = ATM (LM_RPC, cn);
-  (*rpc_attrs)[1] = AT (oncRpcNumber);
+  (*rpc_attrs)[0] = attmap_rpc_cn;
+  (*rpc_attrs)[1] = attmap_rpc_oncRpcNumber;
   (*rpc_attrs)[2] = NULL;
 }
 
@@ -363,8 +363,8 @@ init_ethers_attributes (const char ***ethers_attrs)
 
   (*ethers_attrs) = __ethers_attrs;
 
-  (*ethers_attrs)[0] = ATM (LM_ETHERS, cn);
-  (*ethers_attrs)[1] = AT (macAddress);
+  (*ethers_attrs)[0] = attmap_ether_cn;
+  (*ethers_attrs)[1] = attmap_ether_macAddress;
   (*ethers_attrs)[2] = NULL;
 }
 
@@ -375,8 +375,8 @@ init_alias_attributes (const char ***alias_attrs)
 
   (*alias_attrs) = __alias_attrs;
 
-  (*alias_attrs)[0] = ATM (LM_ALIASES, cn);
-  (*alias_attrs)[1] = AT (rfc822MailMember);
+  (*alias_attrs)[0] = attmap_alias_cn;
+  (*alias_attrs)[1] = attmap_alias_rfc822MailMember;
   (*alias_attrs)[2] = NULL;
 }
 
@@ -387,9 +387,9 @@ init_netgrp_attributes (const char ***netgrp_attrs)
 
   (*netgrp_attrs) = __netgrp_attrs;
 
-  (*netgrp_attrs)[0] = ATM (LM_NETGROUP, cn);
-  (*netgrp_attrs)[1] = AT (nisNetgroupTriple);
-  (*netgrp_attrs)[2] = AT (memberNisNetgroup);
+  (*netgrp_attrs)[0] = attmap_netgroup_cn;
+  (*netgrp_attrs)[1] = attmap_netgroup_nisNetgroupTriple;
+  (*netgrp_attrs)[2] = attmap_netgroup_memberNisNetgroup;
   (*netgrp_attrs)[3] = NULL;
 }
 
diff --git a/nslcd/ldap-schema.h b/nslcd/ldap-schema.h
index 360b642..94471d6 100644
--- a/nslcd/ldap-schema.h
+++ b/nslcd/ldap-schema.h
@@ -94,31 +94,10 @@ extern char _nss_ldap_filt_getspent[];
 extern char _nss_ldap_filt_getnetgrent[];
 
 /**
- * Initialize attribute vector table indexed by map
- * selector (eg. LM_PASSWD) relative to an "ldap_config"
- */
-
-
-
-
-/**
- * Lookup (potentially mapped)
- * objectclass/attribute.
- */
-/* these functions are defined in ldap-nss.[ch] */
-#define OC(oc)                   _nss_ldap_map_oc(LM_NONE, OC##_##oc)
-#define OCM(map, at)             _nss_ldap_map_oc(map, AT##_##at)
-#define AT(at)                   _nss_ldap_map_at(LM_NONE, AT##_##at)
-#define ATM(map, at)             _nss_ldap_map_at(map, AT##_##at)
-
-/**
  * Common attributes, not from RFC 2307.
  */
 #define AT_objectClass            "objectClass"
 #define AT_cn                     "cn"
-#define AT_description            "description"
-#define AT_l                      "l"
-#define AT_manager                "manager"
 
 /**
  * Vendor-specific attributes and object classes.
diff --git a/nslcd/netgroup.c b/nslcd/netgroup.c
index 54cd55e..42cef7f 100644
--- a/nslcd/netgroup.c
+++ b/nslcd/netgroup.c
@@ -52,6 +52,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 /* A netgroup can consist of names of other netgroups.  We have to
    track which netgroups were read and which still have to be read.  */
@@ -233,10 +234,10 @@ _nss_ldap_load_netgr (LDAPMessage * e,
       switch (attr)
         {
         case 1:
-          vals = _nss_ldap_get_values (e, AT (nisNetgroupTriple));
+          vals = _nss_ldap_get_values (e, attmap_netgroup_nisNetgroupTriple);
           break;
         default:
-          vals = _nss_ldap_get_values (e, AT (memberNisNetgroup));
+          vals = _nss_ldap_get_values (e, attmap_netgroup_memberNisNetgroup);
           break;
         }
 
diff --git a/nslcd/network.c b/nslcd/network.c
index e463e5a..bb14093 100644
--- a/nslcd/network.c
+++ b/nslcd/network.c
@@ -50,6 +50,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 #if defined(HAVE_USERSEC_H)
 #define MAXALIASES 35
@@ -86,13 +87,13 @@ _nss_ldap_parse_net (LDAPMessage * e,
   /* IPv6 support ? XXX */
   network->n_addrtype = AF_INET;
 
-  stat = _nss_ldap_assign_attrval (e, ATM (LM_NETWORKS, cn), &network->n_name,
+  stat = _nss_ldap_assign_attrval (e, attmap_network_cn, &network->n_name,
                                    &buffer, &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (ipNetworkNumber), &tmp, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_network_ipNetworkNumber, &tmp, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
@@ -100,7 +101,7 @@ _nss_ldap_parse_net (LDAPMessage * e,
   network->n_net = inet_network (tmp);
 
   stat =
-    _nss_ldap_assign_attrvals (e, ATM (LM_NETWORKS, cn), network->n_name,
+    _nss_ldap_assign_attrvals (e, attmap_network_cn, network->n_name,
                                &network->n_aliases, &buffer, &buflen, NULL);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
diff --git a/nslcd/passwd.c b/nslcd/passwd.c
index eef6d86..8434052 100644
--- a/nslcd/passwd.c
+++ b/nslcd/passwd.c
@@ -48,6 +48,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 #ifndef UID_NOBODY
 #define UID_NOBODY      (-2)
@@ -106,14 +107,14 @@ static enum nss_status _nss_ldap_parse_pw (LDAPMessage * e,
   else
     {
       stat =
-        _nss_ldap_assign_userpassword (e, ATM (LM_PASSWD, userPassword),
+        _nss_ldap_assign_userpassword (e, attmap_passwd_userPassword,
                                        &pw->pw_passwd, &buffer, &buflen);
       if (stat != NSS_STATUS_SUCCESS)
         return stat;
     }
 
   stat =
-    _nss_ldap_assign_attrval (e, ATM (LM_PASSWD, uid), &pw->pw_name, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_passwd_uid, &pw->pw_name, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
@@ -121,7 +122,7 @@ static enum nss_status _nss_ldap_parse_pw (LDAPMessage * e,
   tmp = tmpbuf;
   tmplen = sizeof (tmpbuf) - 1;
   stat =
-    _nss_ldap_assign_attrval (e, AT (uidNumber), &uid, &tmp, &tmplen);
+    _nss_ldap_assign_attrval (e, attmap_passwd_uidNumber, &uid, &tmp, &tmplen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
   pw->pw_uid = (*uid == '\0') ? UID_NOBODY : (uid_t) atol (uid);
@@ -129,33 +130,33 @@ static enum nss_status _nss_ldap_parse_pw (LDAPMessage * e,
   tmp = tmpbuf;
   tmplen = sizeof (tmpbuf) - 1;
   stat =
-    _nss_ldap_assign_attrval (e, ATM (LM_PASSWD, gidNumber), &gid, &tmp,
+    _nss_ldap_assign_attrval (e, attmap_passwd_gidNumber, &gid, &tmp,
                               &tmplen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
   pw->pw_gid = (*gid == '\0') ? GID_NOBODY : (gid_t) atol (gid);
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (gecos), &pw->pw_gecos, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_passwd_gecos, &pw->pw_gecos, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     {
       pw->pw_gecos = NULL;
       stat =
-        _nss_ldap_assign_attrval (e, ATM (LM_PASSWD, cn), &pw->pw_gecos,
+        _nss_ldap_assign_attrval (e, attmap_passwd_cn, &pw->pw_gecos,
                                   &buffer, &buflen);
       if (stat != NSS_STATUS_SUCCESS)
         return stat;
     }
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (homeDirectory), &pw->pw_dir, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_passwd_homeDirectory, &pw->pw_dir, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     (void) _nss_ldap_assign_emptystring (&pw->pw_dir, &buffer, &buflen);
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (loginShell), &pw->pw_shell, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_passwd_loginShell, &pw->pw_shell, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     (void) _nss_ldap_assign_emptystring (&pw->pw_shell, &buffer, &buflen);
diff --git a/nslcd/protocol.c b/nslcd/protocol.c
index 3c58b0a..01a872c 100644
--- a/nslcd/protocol.c
+++ b/nslcd/protocol.c
@@ -52,6 +52,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 static enum nss_status _nss_ldap_parse_proto (LDAPMessage *e,
                        struct ldap_state UNUSED(*pvt),
@@ -63,13 +64,13 @@ static enum nss_status _nss_ldap_parse_proto (LDAPMessage *e,
   enum nss_status stat;
 
   stat =
-    _nss_ldap_getrdnvalue (e, ATM (LM_PROTOCOLS, cn), &proto->p_name,
+    _nss_ldap_getrdnvalue (e, attmap_protocol_cn, &proto->p_name,
                            &buffer, &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (ipProtocolNumber), &number, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_protocol_ipProtocolNumber, &number, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
@@ -77,7 +78,7 @@ static enum nss_status _nss_ldap_parse_proto (LDAPMessage *e,
   proto->p_proto = atoi (number);
 
   stat =
-    _nss_ldap_assign_attrvals (e, ATM (LM_PROTOCOLS, cn), proto->p_name,
+    _nss_ldap_assign_attrvals (e, attmap_protocol_cn, proto->p_name,
                                &proto->p_aliases, &buffer, &buflen, NULL);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
diff --git a/nslcd/rpc.c b/nslcd/rpc.c
index ea02e92..d63daf6 100644
--- a/nslcd/rpc.c
+++ b/nslcd/rpc.c
@@ -56,6 +56,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 /* macros for expanding the NSLCD_RPC macro */
 #define NSLCD_STRING(field)     WRITE_STRING(fp,field)
@@ -83,13 +84,13 @@ static enum nss_status _nss_ldap_parse_rpc (LDAPMessage * e,
   enum nss_status stat;
 
   stat =
-    _nss_ldap_getrdnvalue (e, ATM (LM_RPC, cn), &rpc->r_name, &buffer,
+    _nss_ldap_getrdnvalue (e, attmap_rpc_cn, &rpc->r_name, &buffer,
                            &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (oncRpcNumber), &number, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_rpc_oncRpcNumber, &number, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
@@ -97,7 +98,7 @@ static enum nss_status _nss_ldap_parse_rpc (LDAPMessage * e,
   rpc->r_number = atol (number);
 
   stat =
-    _nss_ldap_assign_attrvals (e, ATM (LM_RPC, cn), rpc->r_name,
+    _nss_ldap_assign_attrvals (e, attmap_rpc_cn, rpc->r_name,
                                &rpc->r_aliases, &buffer, &buflen, NULL);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
diff --git a/nslcd/service.c b/nslcd/service.c
index 2326977..830cdbc 100644
--- a/nslcd/service.c
+++ b/nslcd/service.c
@@ -56,6 +56,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 /* macros for expanding the NSLCD_SERVICE macro */
 #define NSLCD_STRING(field)     WRITE_STRING(fp,field)
@@ -93,7 +94,7 @@ static enum nss_status _nss_ldap_parse_serv (LDAPMessage *e,
         {
           /* non-deterministic behaviour is ok */
           stat =
-            _nss_ldap_assign_attrval (e, AT (ipServiceProtocol),
+            _nss_ldap_assign_attrval (e, attmap_service_ipServiceProtocol,
                                       &service->s_proto, &buffer, &buflen);
           if (stat != NSS_STATUS_SUCCESS)
             {
@@ -117,7 +118,7 @@ static enum nss_status _nss_ldap_parse_serv (LDAPMessage *e,
     }
   else
     {
-      char **vals = _nss_ldap_get_values (e, AT (ipServiceProtocol));
+      char **vals = _nss_ldap_get_values (e, attmap_service_ipServiceProtocol);
       int len;
       if (vals == NULL)
         {
@@ -161,7 +162,7 @@ static enum nss_status _nss_ldap_parse_serv (LDAPMessage *e,
     }
 
   stat =
-    _nss_ldap_getrdnvalue (e, ATM (LM_SERVICES, cn), &service->s_name,
+    _nss_ldap_getrdnvalue (e, attmap_service_cn, &service->s_name,
                            &buffer, &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     {
@@ -169,7 +170,7 @@ static enum nss_status _nss_ldap_parse_serv (LDAPMessage *e,
     }
 
   stat =
-    _nss_ldap_assign_attrvals (e, ATM (LM_SERVICES, cn), service->s_name,
+    _nss_ldap_assign_attrvals (e, attmap_service_cn, service->s_name,
                                &service->s_aliases, &buffer, &buflen, NULL);
   if (stat != NSS_STATUS_SUCCESS)
     {
@@ -177,7 +178,7 @@ static enum nss_status _nss_ldap_parse_serv (LDAPMessage *e,
     }
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (ipServicePort), &port, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_service_ipServicePort, &port, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     {
diff --git a/nslcd/shadow.c b/nslcd/shadow.c
index 4208ebe..e453ba0 100644
--- a/nslcd/shadow.c
+++ b/nslcd/shadow.c
@@ -48,6 +48,7 @@
 #include "util.h"
 #include "common.h"
 #include "log.h"
+#include "attmap.h"
 
 static enum nss_status _nss_ldap_parse_sp(LDAPMessage *e,
                     struct ldap_state UNUSED(*pvt),
@@ -58,47 +59,47 @@ static enum nss_status _nss_ldap_parse_sp(LDAPMessage *e,
   char *tmp = NULL;
 
   stat =
-    _nss_ldap_assign_userpassword (e, ATM (LM_SHADOW, userPassword),
+    _nss_ldap_assign_userpassword (e, attmap_shadow_userPassword,
                                    &sp->sp_pwdp, &buffer, &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
   stat =
-    _nss_ldap_assign_attrval (e, ATM (LM_SHADOW, uid), &sp->sp_namp, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_shadow_uid, &sp->sp_namp, &buffer,
                               &buflen);
   if (stat != NSS_STATUS_SUCCESS)
     return stat;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (shadowLastChange), &tmp, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_shadow_shadowLastChange, &tmp, &buffer,
                               &buflen);
   sp->sp_lstchg = (stat == NSS_STATUS_SUCCESS) ? _nss_ldap_shadow_date (tmp) : -1;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (shadowMax), &tmp, &buffer, &buflen);
+    _nss_ldap_assign_attrval (e, attmap_shadow_shadowMax, &tmp, &buffer, &buflen);
   sp->sp_max = (stat == NSS_STATUS_SUCCESS) ? atol (tmp) : -1;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (shadowMin), &tmp, &buffer, &buflen);
+    _nss_ldap_assign_attrval (e, attmap_shadow_shadowMin, &tmp, &buffer, &buflen);
   sp->sp_min = (stat == NSS_STATUS_SUCCESS) ? atol (tmp) : -1;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (shadowWarning), &tmp, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_shadow_shadowWarning, &tmp, &buffer,
                               &buflen);
   sp->sp_warn = (stat == NSS_STATUS_SUCCESS) ? atol (tmp) : -1;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (shadowInactive), &tmp, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_shadow_shadowInactive, &tmp, &buffer,
                               &buflen);
   sp->sp_inact = (stat == NSS_STATUS_SUCCESS) ? atol (tmp) : -1;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (shadowExpire), &tmp, &buffer,
+    _nss_ldap_assign_attrval (e, attmap_shadow_shadowExpire, &tmp, &buffer,
                               &buflen);
   sp->sp_expire = (stat == NSS_STATUS_SUCCESS) ? _nss_ldap_shadow_date (tmp) : -1;
 
   stat =
-    _nss_ldap_assign_attrval (e, AT (shadowFlag), &tmp, &buffer, &buflen);
+    _nss_ldap_assign_attrval (e, attmap_shadow_shadowFlag, &tmp, &buffer, &buflen);
   sp->sp_flag = (stat == NSS_STATUS_SUCCESS) ? atol (tmp) : 0;
 
   _nss_ldap_shadow_handle_flag(sp);
diff --git a/nslcd/util.c b/nslcd/util.c
index ecac7b7..bd08825 100644
--- a/nslcd/util.c
+++ b/nslcd/util.c
@@ -54,6 +54,8 @@
 #include "common.h"
 #include "log.h"
 #include "cfg.h"
+#include "ldap-schema.h"
+#include "attmap.h"
 
 
 static void *__cache = NULL;
@@ -297,9 +299,9 @@ enum nss_status _nss_ldap_dn2uid(const char *dn,char **uid,char **buffer,
       const char *attrs[4];
       LDAPMessage *res;
 
-      attrs[0] = ATM (LM_PASSWD, uid);
-      attrs[1] = ATM (LM_GROUP, uniqueMember);
-      attrs[2] = AT (objectClass);
+      attrs[0] = attmap_passwd_uid;
+      attrs[1] = attmap_group_uniqueMember;
+      attrs[2] = attmap_objectClass;
       attrs[3] = NULL;
 
       if (_nss_ldap_read (dn, attrs, &res) == NSS_STATUS_SUCCESS)
@@ -307,7 +309,7 @@ enum nss_status _nss_ldap_dn2uid(const char *dn,char **uid,char **buffer,
           LDAPMessage *e = _nss_ldap_first_entry (res);
           if (e != NULL)
             {
-              if (has_objectclass(e,OC(posixGroup)))
+              if (has_objectclass(e,attmap_group_objectClass))
                 {
                   *pIsNestedGroup = 1;
                   *pRes = res;
@@ -316,7 +318,7 @@ enum nss_status _nss_ldap_dn2uid(const char *dn,char **uid,char **buffer,
                 }
 
               status =
-                _nss_ldap_assign_attrval (e, ATM (LM_PASSWD, uid), uid,
+                _nss_ldap_assign_attrval (e, attmap_passwd_uid, uid,
                                           buffer, buflen);
               if (status == NSS_STATUS_SUCCESS)
                 dn2uid_cache_put (dn, *uid);