text:
LPI exam 301 prep
Topic 301: Concepts, architecture, and design
Senior Level Linux Professional (LPIC-3)
Content series:
This content is part # of # in the series: LPI exam 301 prep
This content is part of the series:LPI exam 301 prep
Stay tuned for additional content in this series.
Before you start
Learn what these tutorials can teach you and how you can get the most from them.
About this series
The Linux Professional Institute (LPI) certifies Linux system administrators at three levels: junior level (also called "certification level 1"), advanced level (also called "certification level 2"), and senior level (also called "certification level 3"). To attain certification level 1, you must pass exams 101 and 102. To attain certification level 2, you must pass exams 201 and 202. To attain certification level 3, you must have an active advanced-level certification and pass exam 301 ("core"). You may also pass additional specialty exams at the senior level.
developerWorks offers tutorials to help you prepare for the five junior, advanced, and senior certification exams. Each exam covers several topics, and each topic has a corresponding self-study tutorial on developerWorks. Table 1 lists the six topics and corresponding developerWorks tutorials for LPI exam 301.
Table 1. LPI exam 301: Tutorials and topics
|LPI exam 301 topic
|developerWorks tutorial
|Tutorial summary
|Topic 301
|LPI exam 301 prep:
Concepts, architecture, and design
|(This tutorial.) Learn about LDAP concepts and architecture, learn how to design and implement an LDAP directory, and learn about schemas. See the detailed objectives below.
|Topic 302
| LPI exam 301 prep:
Installation and development
|Coming soon.
|Topic 303
| LPI exam 301 prep:
|Coming soon.
|Topic 304
| LPI exam 301 prep:
|Coming soon.
|Topic 305
| LPI exam 301 prep:
Integration and migration
|Coming soon.
|Topic 306
| LPI exam 301 prep:
Capacity planning
|Coming soon.
To pass exam 301 (and attain certification level 3), you should:
- Have several years experience with installing and maintaining Linux® on a number of computers for various purposes.
- Have integration experience with diverse technologies and operating systems.
- Have professional experience as, or training for, an enterprise-level Linux professional (including having experience as a part of another role).
- Know advanced and enterprise levels of Linux administration including installation, management, security, troubleshooting, and maintenance.
- Be able to use open source tools to measure capacity planning and troubleshoot resource problems.
- Have professional experience using LDAP to integrate with UNIX® and Microsoft® Windows® services, including Samba, Pluggable Authentication Modules (PAM), e-mail, and Microsoft Active Directory directory service.
- Be able to plan, architect, design, build, and implement a full environment using Samba and LDAP as well as measure the capacity planning and security of the services.
- Be able to create scripts in Bash or Perl or have knowledge of at least one system-programming language (such as C).
The Linux Professional Institute does not endorse any third-party exam preparation material or techniques in particular.
About this tutorial
Welcome to "Concepts, architecture, and design," the first of six tutorials designed to prepare you for LPI exam 301. In this tutorial, you learn about LDAP concepts and architecture, how to design and implement an LDAP directory, and about schemas.
This tutorial is organized according to the LPI objectives for this topic. Very roughly, expect more questions on the exam for objectives with higher weights.
Table 2 provides the detailed objectives for this tutorial.
Table 2. Concepts, architecture, and design: Exam objectives covered in this tutorial
|LPI exam objective
|Objective weight
|Objective summary
Concepts and architecture
|Be familiar with LDAP and X.500 concepts.
Directory design
|Design and implement an LDAP directory while planning an appropriate Directory Information Tree to avoid redundancy. You should have an understanding of the types of data that are appropriate for storage in an LDAP directory.
|Be familiar with schema concepts and the base schema files included with an OpenLDAP installation.
To get the most from this tutorial, you should have an advanced knowledge of Linux and a working Linux system on which to practice the commands covered.
If your fundamental Linux skills are a bit rusty, you may want to first review the tutorials for the LPIC-1 and LPIC-2 exams.
Different versions of a program may format output differently, so your results may not look exactly like the listings and figures in this tutorial.
System requirements
To follow along with the examples in these tutorials, you need a Linux workstation with the OpenLDAP package and support for PAM. Most modern distributions meet these requirements.
Concepts and architecture
This section covers material for topic 301.1 for the Senior Level Linux Professional (LPIC-3) exam 301. This topic has a weight of 3.
In this section, learn about:
- LDAP and X.500 technical specification
- Attribute definitions
- Directory namespaces
- Distinguished names
- LDAP Data Interchange Format
- Meta-directories
- Changetype operations
Most of the LPIC-3 exam focuses on the use of the Lightweight Directory Access Protocol (LDAP). Accordingly, the first objective involves understanding what LDAP is, what it does, and some of the basic terminology behind the concept. When you understand this, you will be able to move on to designing your directory and integrating your applications with the directory.
LDAP, what is it?
Before talking about LDAP, let's review the concept of directories. The classic example of a directory is the phone book, where people are listed in alphabetical order along with their phone numbers and addresses. Each person (or family) represents an object, and the phone number and address are attributes of that object. Though not always obvious at a glance, some objects are businesses instead of people, and these may include fax numbers or hours of operation.
Unlike its printed counterpart, a computer directory is hierarchical in nature, allowing for objects to be placed under other objects to indicate a parent-child relationship. For instance, the phone directory could be extended to have objects representing areas of the city, each with the people and business objects falling into their respective area objects. These area objects would then fall under a city object, which might further fall under a state or province object, and so forth, much like Figure 1. This would make a printed copy much harder to use because you would need to know the name and geographical location, but computers are made to sort information and search various parts of the directory, so this is not a problem.
Figure 1. A sample directory
Looking at Figure 1, knowing where the Simpson's record is tells you more than just the address and phone number. You also know they are in the East end in the town of Springfield. This structure is called a tree. Here, the root of the tree is the Springfield object, and the various objects represent further levels of branching.
This directory-based approach to storing data is quite different than the relational databases that you may be familiar with. To compare the two models, Figure 2 shows what the telephone data might look like if modeled as a relational database.
Figure 2. Directory data modeled in relational form
In the relational model, each type of data is a separate table that allows different types of information to be held. Each table also has a link to its parent table so that the relationships between the objects can be held. Note that the tables would have to be altered to add more information fields.
Remember that nothing about the directory model places any restrictions on how the data may be stored on disk. In fact, OpenLDAP supports many back ends including flat files and Structured Query Language (SQL) databases. The mechanics of laying out the tables on disk are largely hidden from you. For instance, Active Directory provides an LDAP interface to its proprietary back end.
The history of LDAP
LDAP was conceived in Request for Comments (RFC) 1487 as a lightweight way to access an X.500 directory instead of the more complex Directory Access Protocol. (See the Related topics section for links to this and related RFCs.) X.500 is a standard (and a family of standards) from the International Telecommunication Union (ITU, formerly the CCITT) that specifies how directories are to be implemented. You may be familiar with the X.509 standard that forms the core of most Public Key Infrastructure (PKI) and Secure Sockets Layer (SSL) certificates. LDAP has since evolved to version 3 and is defined in RFC 4511.
Connecting to an X.500 database initially required the use of the Open Systems Interconnection (OSI) suite of protocols and, in true ITU fashion, required understanding of thick stacks of protocol documentation. LDAP allowed Internet Protocol (IP)-based networks to connect to the same directory with far fewer development cycles than using OSI protocols. Eventually the popularity of IP networks led to the creation of LDAP servers that support only as many X.500 concepts as necessary.
Despite the triumph of LDAP and IP over X.500 and OSI, the underlying organization of the directory data is still X.500-ish. Concepts that you will learn over the course of this tutorial, such as Distinguished Names and Object Identifiers, are brought up from X.500.
X.500 was intended as a way to create a global directory system, mostly to assist with the X.400 series of standards for e-mail. LDAP can be used as a global directory with some effort, but it is mostly used within an enterprise.
A closer look at naming and attributes
In the LDAP world, names are important. Names let you access and search records, and often the name gives an indication of where the record is within the LDAP tree. Figure 3 shows a typical LDAP tree.
Figure 3. A typical LDAP tree showing a user
At the top, or root, of the tree is an entity called
dc=ertw,dc=com. The
dc is short for domain component. Because
ertw is under
.com top-level domain, the two are separated into two different units. Components of a name are concatenated with a comma when using the X.500 nomenclature, with the
new components being added to the left. Nothing technically prevents you from referring to the root as
dc=ertw.com, though in the interest of future interoperability it is
best to have the domain components separate (in fact, RFC 2247 recommends the separate domain components).
dc=ertw,dc=com is a way to uniquely identify that entity in the tree. In X.500 parlance, this is called the distinguished name, or the DN. The DN is much
like a primary key in the relational-database world because there can be only one entity with a given DN within the tree. The DN of the topmost entry is called the Root
Under the root DN is an object with the DN of
ou means organizational unit, and you can be sure it falls under the root DN
because the
ou appears immediately to the left of the root DN. You can also call
ou=people the relative distinguished name, or RDN, because
it is unique within its level. Put in recursive terms, the DN of an entity is the entity's RDN plus the DN of the parent. Most LDAP browsers show only the RDN because it eliminates
Moving down the tree to
cn=Sean Walberg,ou=people,dc=ertw,dc=com, you find the record for a person.
cn means common name. For the first time, though,
a record has some additional information in the form of attributes. Attributes provide additional information about the entity. In fact, you'll see the leftmost component of
the DN is duplicated; in this case, it's the
cn attribute. Put another way, the RDN of an entity is composed of one (or more) attributes of the entity.
description are easy enough to understand,
objectClass is not as obvious. An object class is a group of attributes that correspond
to a particular entity type. One object class may contain attributes for people and another for UNIX accounts. By applying the two object classes to an entity, both sets of attributes
are available to be stored.
Each object class is assigned an object identifier (OID) that uniquely identifies it. The object class also specifies the attributes, and which ones are mandatory and which are optional. Mandatory attributes must have some data for the entity to be saved. The object class also identifies the type of data held and whether multiple attributes of the same name are allowed. For instance, a person might have only one employee number but multiple first names (for example, Bob, Robert, and Rob).
The bottom-level objects are not the only ones to have object classes associated with them. These objects, called containers, also have object classes and attributes. The
people ou is of type
organizationalUnit and has a description attribute along with
ou=people to create the RDN. The root of the tree is of type
dcObject and
organization. Knowing which object classes to assign an object depends on what is being held in the object and under it. Refer to the Schemas section for more details.
The root DN also defines the namespace of the tree or, to be more technical, the Directory Information Tree (DIT). Something ending in
dc=ibm,dc=com would
fall outside of the namespace from Figure 3, whereas the record for
Sean Walberg falls within the namespace. With that in mind, though, it is possible
that one LDAP server contains multiple namespaces. A somewhat abstract item called the Root DSE contains the information about all the namespaces available on the server. DSE
means the DSA-Specific Entry, and DSA means Directory System Agent (that is, the LDAP server).
Figure 4 summarizes the terminology associated with the LDAP tree.
Figure 4. Summary of LDAP terminology
Finally, an LDAP tree can be synchronized with other trees or data sources. For instance, one branch of the tree could come from a security system, another from a customer database, and the rest could be stored in the LDAP server. This is called a meta-directory and is intended to be a single source of data for applications such as single sign-on.
The LDIF file
Data can get into an LDAP server in one of two ways. Either it can be loaded in over the network, using the LDAP protocol, or it can be imported from the server through a file in the LDAP Data Interchange Format (LDIF). LDIF can be used at any time, such as to create the initial tree, and to perform a bulk add or modify of the data some time later. The output of a search can also be in LDIF for easy parsing or import to another server. The full specification for LDIF is in RFC 2849 (see Related topics for a link).
Adding records
The LDIF that generated the tree from Figure 3 is shown in Listing 1.
Listing 1. A simple LDIF file to populate a tree
# This is a comment dn: dc=ertw,dc=com dc: ertw description: This is my company the description continues on the next line indented by one space objectClass: dcObject objectClass: organization o: ERTW.COM dn: ou=people,dc=ertw,dc=com ou: people description: Container for users objectclass: organizationalunit dn: cn=Sean Walberg,ou=people,dc=ertw,dc=com objectclass: inetOrgPerson cn: Sean Walberg cn: Sean A. Walberg sn: Walberg homephone: 555-111-2222 mail: email@example.com description: Watch out for this guy ou: Engineering
Before delving into the details of the LDIF file, note that the attribute names are case insensitive. That is,
objectclass is the same as both
objectClass and
OBJECTCLASS. Many people choose to capitalize the first letter of each word except the first, such as
homePhone, and
The first line of the LDIF shows a UNIX-style comment, which is prefixed by a hash sign (#), otherwise known as a pound sign or an octothorpe. LDIF is a standard ASCII file and can be edited by humans, so comments can be helpful. Comments are ignored by the LDAP server, though.
Records in the LDIF file are separated by a blank line and contain a list of attributes and values separated by a colon (:). Records begin with the
dn attribute, which
identifies the distinguished name of the record. Figure 1, therefore, shows three records: the
ou=people, and
cn=Sean Walberg RDNs, respectively.
Looking back at Figure 1, you can see the first record defined is the root of the tree. The distinguished name comes first. Next comes a list of all the attributes and values, separated by a colon. Colons within the value do not need any special treatment. The LDAP tools understand that the first colon separates the attribute from the value. If you need to define two values for an attribute, then simply list them as two separate lines. For example, the root object defines two object classes.
Each record must define at least one object class. The object class, in turn, may require that certain attributes be present. In the case of the root object, the
object class requires that a domain component, or
dc, be defined, and the
organization object class requires that an organization attribute,
o, be defined. Because an object must have an attribute and value corresponding to the RDN, the
dcObject object class is required to import the
dc attribute. Defining an
o attribute is not required to create a valid record.
description is also used on the root object to describe the company. The purpose here is to demonstrate the comment format. If your value needs to span multiple lines,
start each new line with a leading space instead of a value. Remember that specifying multiple
attribute: value pairs defines multiple instances of the attribute.
The second record in Figure 1 defines an
organizationalUnit, which is a container for people objects in this case. The third defines a user of type
inetOrgPerson, which provides common attributes for defining people within an organization. Note that two
cn attributes are defined; one is also used in the
DN of the record. The second, with the middle initial, will help for searching, but it is the first that is required to satisfy the condition that the RDN be defined.
In the user record there is also an
ou that does not correspond to the
organizationalUnit the user is in. The container the user object belongs to can always
be found by parsing the DN. This
ou attribute refers to something defined by the user, in this case a department. No referential integrity is imposed by the server, though
the application may be looking for a valid DN such as
The only other restriction placed on LDIF files that add records is that the tree must be built in order, from the root. Figure 1 shows the root object being built,
then an
ou, then a user within that
ou. Now that the structure is built, users can be added directly to the
people container, but if a new
container is to be used, it must be created first.
The LDIF behind adding objects is quite easy. The format gets more complex when objects must be changed or deleted. LDIF defines a
changetype, which can be one of the
addadds an item (default).
deletedeletes the item specified by the DN.
modrdnrenames the specified object within the current container, or moves the object to another part of the tree.
moddnis synonymous with
modifymakes changes to attributes within the current DN.
Deleting users
Deleting an item is the simplest case, only requiring the
dn and
changetype. Listing 2 shows a user being deleted.
Listing 2. Deleting a user with LDIF
dn: cn=Fred Smith,ou=people,dc=ertw,dc=com changetype: delete
Manipulating the DN
Manipulating the DN of the object is slightly more complex. Despite the fact that there are two commands,
moddn and
modrdn, they do the same thing! The
operation consists of three separate parts:
- Specify the new RDN (leftmost component of the DN).
- Determine if the old RDN should be replaced by the new RDN within the record, or if it should be left.
- Optionally, move the record to a new part of the tree by specifying a new parent DN.
Consider Jane Smith, who changes her name to Jane Doe. The first thing to do is change her
cn attribute to reflect the name change. Because the new name is the primary way
she wishes to be referred to, and the common name forms part of the DN, the
moddn operation is appropriate. (If the common name weren't part of the DN, this would be an
attribute change, which is covered in the next section.) The second choice is to determine if the
cn: Jane Smith should stay in addition to
cn: Jane Doe,
which allows people to search for her under either name. Listing 3 shows the LDIF that performs the change.
Listing 3. LDIF to change a user's RDN
# Specify the record to operate on dn: cn=Jane Smith,ou=people,dc=ertw,dc=com changetype: moddn # Specify the new RDN, including the attribute newrdn: cn=Jane Doe # Should the old RDN (cn=Jane Smith) be deleted? 1/0, Default = 1 (yes) deleteoldrdn: 0
Listing 3 begins by identifying Jane's record, then the
moddn operator. The new RDN is specified, continuing to use a common name type but with the new name. Finally,
deleteoldrdn directs the server to keep the old name. Note that while
newrdn is the only necessary option to the
moddn changetype, if you omit
deleteoldrdn, the action is to delete the old RDN. According to RFC 2849,
deleteoldrdn is a required element.
Should the new Mrs. Jane Doe be sent to a new part of the tree, such as a move to
ou=managers,dc=ertw,dc=com, the LDIF must specify the new part of the tree somehow, such
as in Listing 4.
Listing 4. Moving a record to a new part of the tree
dn: cn=Jane Doe,ou=people,dc=ertw,dc=com changetype: modrdn newrdn: cn=Jane Doe deleteoldrdn: 0 newsuperior: ou=managers,dc=ertw,dc=com
Curiously, a new RDN must be specified even though it is identical to the old one, and the OpenLDAP parser now requires that
deleteoldrdn is present despite it being
meaningless when the RDN stays the same.
newsuperior follows, which is the DN of the new parent in the tree.
One final note on the
modrdn operation is that the order matters, unlike most other LDIF formats. After the
changetype comes the
newrdn, followed
deleteoldrdn, and, optionally,
Modifying attributes
The final
changetype is
modify, which is used to modify attributes of a record. Based on the earlier discussion of
moddn, it should be clear that
modify does not apply to the DN or the RDN of a record.
Listing 5 shows several modifications made to a single record.
Listing 5. Modifying a record through LDIF
dn: cn=Sean Walberg,dc=ertw,dc=com changetype: modify replace: homePhone homePhone: 555-222-3333 - changetype: modify add: title title: network guy - changetype: modify delete: mail -
The LDIF for the
modify operation looks similar to the others. It begins with the DN of the record, then the
changetype. After that comes either
add:, or
delete:, followed by the attribute. For
delete, this is enough information. The others require the
attribute:value pair. Each change is followed by a dash (-) on a blank line, including the final change.
LDIF has an easy-to-read format, both for humans and computers. For bulk import and export of data, LDIF is a useful tool.
Directory design
This section covers material for topic 301.2 for the Senior Level Linux Professional (LPIC-3) exam 301. The topic has a weight of 2.
In this section, learn about:
- Defining LDAP directory content
- Directory organization
- How to plan appropriate Directory Information Trees
Determining if LDAP is appropriate
Like any other tool, LDAP is not appropriate for every solution. Before choosing LDAP, you must ask yourself some questions:
- How often will changes be made, and what kind of changes are they?
- What will be using the data?
- What kind of queries will be made against the data?
- Is the information hierarchical in nature?
LDAP databases are geared toward read-intensive operations. People may only change personal information a few times a year, but we can expect to look up attributes far more than that,
such as resolving the
UserID owning a file to a printable name when looking through a directory. LDAP data tends to be heavily indexed, which means every change to the
underlying data requires multiple changes to the indexes that help the server find the data later. LDAP also doesn't offer a means to make mass updates to the tree, other than
performing a search and then modifying each individual DN.
The LDAP specifications do not define transactions, which are common in relational databases. Transactions ensure that all the operations within the transaction succeed, or else the data is rolled back to the pre-transaction state (individual servers may implement this, but it is not a requirement). These limitations on updating data and the lack of transactions make LDAP a poor choice for bank transactions.
Determining the user, or the consumer, of the data is also important. If none of the consumers speak LDAP, then LDAP may not be a good fit. To LDAP's credit, it is an extremely simple protocol to implement and is available for most languages on most platforms. With a mere handful of available operations defined, it can be integrated into existing applications with ease.
LDAP provides search functionality, but with nowhere near the level of a relational database. The LDAP server may store the underlying data using SQL, but you as the user are abstracted
from this and cannot make use of it. Thus, you are limited to the search filters that are supported by your LDAP server. These filters will be investigated in more detail in later
articles in this series, but for now understand that the filters are just that -- filters. You can perform some powerful searches, such as "show me all the employees who live in
Washington and those that live in Texas who are over 40." Statements equivalent to the SQL
GROUP BY are not available, though. LDAP is best suited for look-up style
operations, such as "show me the username of the person with UID 4131," and "give me the names of everyone working for Jim Smith."
Finally, the information you are trying to store should lend itself to hierarchical storage. You could store a flat list of data in an LDAP server, but it would probably be a waste of resources.
When you can answer these questions and have determined that LDAP is the correct solution, it is time to design the directory tree.
Organizing your tree
The foremost idea to keep in your mind is that reorganization of the tree is undesirable. The goal is to break down your objects such that each branch of the tree holds objects of a similar type, but the chances of an object having to be moved is low. The reasons for this are twofold. One is that it's just a hassle to do. The second is that a move changes the DN of the object, and then you have to update all the objects that reference the moved object.
The root DN
The root of your tree should be something that represents your company. RFC 2247 calls for the use of the
dc attribute and the familiar
format to map the company's primary domain into a DN. Your company probably has many Internet domains but has one that is preferred. It is also common to choose something under the
local top-level domain (TLD), which doesn't currently exist on the Internet. Microsoft has long suggested using this TLD for their Active Directory implementations despite
it not being a reserved TLD.
If you don't want to use a domain name in your root DN, you can simply have an object with
objectclass: organization, which gives a root DN of
o=My Corporation.
Filling in the structure
Deciding what goes at the next level of the DIT is difficult. It is often tempting to describe the company's organizational structure as a series of nested
organizationalUnit objects, but companies are constantly reorganizing, which breaks the first rule. Instead, consider using attributes to store this information
Depending on your use of the LDAP server and how you choose to name objects, you may want to keep all users in one tree or separate them according to role. For instance, you can create one container for employees and one for customers, or you can group them all into a single container. The choice depends on your applications and how you plan on managing the tree. If the sales department takes care of managing the customer list, and the systems administrators take care of the staff, it might be better to create two containers. Figure 5 shows a DIT that has been broken down into customers and users.
Figure 5. An LDAP tree with separate branches for users and customers
Figure 5 shows one grouping for staff and one for customers. All staff reside in the same organizational unit (OU), but customers are broken up by region. In this situation, this allows different people to manage their own region's customers.
If you plan on using LDAP for authentication of UNIX resources, you must then decide where to store that information. User accounts have already been taken care of earlier, but you will need to store groups, and possibly other maps such as hosts, services, networks, and aliases. Which of these you store in LDAP, and which you leave as local files depends on you and if you need to be able to update them centrally.
The simplest case is to store each map in a separate
organizationalUnit. You will find that when configuring your UNIX system to read this information, you need to specify
the DN of the container and any filters. If you store groups in the user OU, you will have to write some filters. You also may have to adjust the filters if you ever make any
structural changes to the staff OU.
Determining the object classes
So far the discussion has centered on the layout of the LDAP tree with the basic goal being to avoid having to rename objects in the future. After you decide upon the tree, you must then decide which object classes to use. It is certainly possible to assign different object classes to objects under the same branch of the tree, but this will almost certainly lead to maintenance problems in the future.
To add more stress to the situation, it's not always possible to add more object classes to an object if you make a mistake. LDAP schemas define two types of object classes:
structural and auxiliary. Structural object classes usually inherit properties from other object classes in a chain that ends up at an object class called
top. Structural object classes can be said to define the object's identity, while auxiliary object classes are there to add attributes.
organizationalUnit is
a structural object class, as is
inetOrgPerson. Going back to Listing 1, the top-level entry had two object classes:
dcObject and
organization is the structural object class.
dcObject plays the auxiliary role by defining the
dc attribute
The part that can cause problems is that an entry can only have one structural object class. Sometimes you see
person, and
top in the same record, but they are all part of the same inheritance tree.
inetOrgPerson and
account are both
structural, are not in the same inheritance tree, and therefore can't be used together. Some LDAP servers permit this, but eventually this behavior may change and cause problems.
There is a third type of object class called abstract. It is much like structural except that it must be inherited to be used.
top is such a class.
Without getting into the specifics of each application there are some general structural object classes that are useful:
inetOrgPerson: Defines a generic person, along with some contact information.
organizationalRole: Much like a person, but it defines a generic role such as
IT Helpdeskor
Fire Warden.
organizationalUnit: A generic container, may describe a department within a container or may be used to separate various parts of the LDAP tree such as groups, people, and servers
organization: A company or other organization.
groupOfNames: Stores one or more DNs referring to members of a group. Not necessarily useful for UNIX groups, but helpful for meeting invitations or other simple things.
Stick to these for your people and organizations and you will be safe. Most extensions, such as authentication, use auxiliary attributes. When in doubt, consult the schema.
The final design consideration is the choice of DNs. Most branches are fairly easy because there is no chance of duplication. A UNIX group's name and ID is unique, so using
cn as the RDN of a group is possible. What happens when you have two employees called Fred Smith? Because the DN must be unique,
cn=Fred Smith,ou=People,dc=example,dc=com could be either of them. Either something else must be used, such as
employeeNumber, or the RDN will have to be made
from two different attributes separated by a plus sign (+). For example,
cn=Fred Smith+userid=123, ou=people, dc=example, dc=com has an RDN made from two different
attributes. Whatever you do, do it consistently!
This section covers material for topic 301.3 for the Senior Level Linux Professional (LPIC-3) exam 301. The topic has a weight of 3.
In this section, learn about:
- LDAP schema concepts
- How to create and modify schemas
- Attribute and object class syntax
Up until now, the schema has been mentioned several times but not fully explained. The schema is a collection of object classes and their attributes. A schema file contains one or more object classes and attributes in a text format the LDAP server can understand. You import the schema file into your LDAP server's configuration, and then use the object classes and attributes in your objects. If the available schemas don't fit your needs, you can create your own or extend an existing one.
LDAP schema concepts
Technically, a schema is a packaging mechanism for object classes and attributes. However, the grouping of object classes is not random. Schemas are generally organized along an application, such as a core, X.500 compatibility, UNIX network services, sendmail, and so on. If you have a need to integrate an application with LDAP, you generally have to add a schema to your LDAP server.
A more in-depth look at OpenLDAP configuration will be in a later tutorial in this series, but the way to add a schema is with
include /path/to/file.schema. After
restarting the server, the new schema will be available.
When the schema is loaded, you then apply the new object classes to the relevant objects. This can be done through an LDIF file or through the LDAP application program interface (API). Applying the object classes gives you more attributes to use.
Creating and modifying schemas
Schemas have a fairly simple format. Listing 6 shows the schema for the
inetOrgPerson object class along with some of its attributes.
Listing 6. Part of the inetOrgPerson definition
attributetype ( 2.16.840.1.113722.214.171.124 NAME 'displayName' DESC 'RFC2798: preferred name to be used when displaying entries' EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 220.127.116.11.4.1.1422.214.171.124.15 SINGLE-VALUE ) attributetype ( 0.9.2342.19200300.100.1.60 NAME 'jpegPhoto' DESC 'RFC2798: a JPEG image' SYNTAX 22.214.171.124.4.1.14188.8.131.52.28 ) objectclass ( 2.16.840.1.1137220.127.116.11 NAME 'inetOrgPerson' DESC 'RFC2798: Internet Organizational Person' SUP organizationalPerson STRUCTURAL MAY ( audio $ businessCategory $ carLicense $ departmentNumber $ displayName $ employeeNumber $ employeeType $ givenName $ homePhone $ homePostalAddress $ initials $ jpegPhoto $ labeledURI $ mail $ manager $ mobile $ o $ pager $ photo $ roomNumber $ secretary $ uid $ userCertificate $ x500uniqueIdentifier $ preferredLanguage $ userSMIMECertificate $ userPKCS12 ) )
Line spacing is not important in schema files -- it is mostly there for human readability. The first definition is an
attributetype, which means an attribute. The
parentheses enclose the definition of the attribute. First comes a series of numbers, separated by periods, called the object ID, or OID, which is a globally unique number.
The OID is also hierarchical, such that if you're assigned the 1.1 tree, you can create anything like 1.1.1 or 220.127.116.11.4.5.6 without having to register it.
Following the OID is a series of keywords, each of which may have a value after it. First the
NAME of the attribute defines the name that humans will use, such as in the
LDIF file or when retrieving the information through the LDAP API. Sometimes you might see the name in the form of
NAME ( 'foo' 'bar' ), which means that either
foo or
bar are acceptable. The server, however, considers the first to be the primary name of the attribute.
DESC provides a description of the attribute. This helps you understand the attribute if you're browsing the schema file.
SUBSTR, and
ORDERING (not shown) require a matching rule. This defines how strings are compared, searched, and sorted, respectively.
caseIgnoreMatch is a
case-insensitive match, and
caseIgnoreSubstringsMatch is also case insensitive. See the Related topics section for Web sites that define
all the standard matching rules. Like most things in LDAP, a server can define its own matching methods for its own attributes, so there are no comprehensive lists of matching
SYNTAX of the attribute defines the format of the data by referencing an OID. RFC 2252 lists the standard syntaxes and their OIDs. If the OID is immediately followed by
a number in curly braces ({}), this represents the maximum length of the data. 184.108.40.206.4.1.1418.104.22.168.15 represents a
DirectoryString that is a UTF-8 string.
Finally, the
SINGLE-VALUE keyword has no arguments and specifies that only one instance of
displayName is allowed.
jpegPhoto attribute has a very short definition: just the OID, the name and description, and a syntax meaning a JPEG object, which is an encoded string of the binary
data. It is not practical to search or sort a picture, and multiple photos can exist in a single record.
Defining an object class follows a similar method. The
objectclass keyword starts the definition, followed by parentheses, the OID of the object class, and then the
NAME and
DESC are the same as before.
SUP defines a superior object class, which is another way of saying that the object class
being defined inherits from the object class specified by the
SUP keyword. Thus, an
inetOrgPerson carries the attributes of an
STRUCTURAL keyword defines this as a structural object class, which can be considered the primary type of the object. Other options are
AUXILIARY, which
adds attributes to an existing object, and
ABSTRACT, which is the same as structural but cannot be used directly. Abstract object classes must be inherited by another
object class, which can then be used. The
top object class is abstract. It is inherited by most other structural object classes, including
person, which is
the parent of
organizationalPerson, which, in turn, is inherited by
Two keywords,
MAY and
MUST, define the attributes that are allowed and mandatory, respectively, for records using that particular object class. For mandatory
items, you may not save a record without all the items being defined. Each attribute is separated by a dollar sign ($), even if the line continues on the next line.
It is not a good idea to modify structural object classes, or even existing, well-known, auxiliary object classes. Because these are well known, you may cause incompatibility issues in
the future if your server is different. Usually the best solution is to define your own auxiliary object class, create a local schema, and apply it to your records. For instance, if
you are a university and want to store student attributes, you might consider creating a student object class that is inherited from either
organizationalPerson or
inetOrgPerson and adding your own attributes. You could then create auxiliary object classes to add more attributes such as class schedules.
Understanding which schemas to use
After learning about how schemas are created, it is tempting to start fresh -- to create your own schema based on your environment. This would certainly take care of your present needs, but it could quite possibly make things more difficult in the long run as you add more functionality to your LDAP tree and integrate other systems. The best approach is to stick with standard object classes and attributes when you can and extend when you must.
OpenLDAP usually stores its schema files in /etc/openldap/schema, in files with a .schema extension. Table 3 lists the default schemas along with their purposes.
Table 3. Schemas that ship with OpenLDAP
|File name
|Defines some object classes and attributes for handling Common Object Request Broker Architecture (CORBA) object references across multiple machines.
|Defines many common attributes and object classes. This schema is where you will find the
dcObject, and
organizationalRole. core.schema is the first place you should look if you need to find something.
|Attributes and object classes from the X.500 specifications. While there are some useful things in here, there are often better alternatives in others such as core and inetorgperson.
|An experimental set of objects used with Netscape Enterprise Server.
|Defines the
inetOrgPerson object (which extends objects from core.schema).
|Like corba.schema, this schema defines a series of object classes and attributes to handle the lookup of Java™ classes within an LDAP tree.
|Implements some objects to handle mail lookups within the tree. It is best to consult your e-mail server's documentation to see which schema it uses.
|This is the schema you use if you move authentication to LDAP. nis.schema defines
posixAccount, which provides attributes for storing
authentication data within the user's object. It also has the various map types to handle groups, networks, services, and other files that go into network-based
authentication mechanisms such as the Network Information System (NIS).
|This is more for example purposes and shows some basic objects.
|A set of objects to implement password policies in LDAP, such as aging. Note that some of these are handled by the traditional UNIX shadow mechanisms and are already handled in nis.schema.
In addition, RFC 4519 explains common attributes. After finding the attributes you want, you can then look through the schema files to determine which files need to be included in your LDAP configuration and which object classes you must use for your records.
In this tutorial you learned about LDAP concepts, architecture, and design. LDAP grew out of a need to connect to X.500 directories over IP in a simplified way. A directory presents data to you in a hierarchical manner, much like a tree. Within this tree are records that are identified by a distinguished name and have many attribute-value pairs, including one or more object classes that determine what data can be stored in the record.
LDAP itself refers to the protocol used to search and modify the tree. Practically though, the term LDAP is used for all components, such as LDAP server, LDAP data, or just "It's in LDAP".
Data in LDAP is often imported and exported with LDIF, which is a textual representation of the data. An LDIF file specifies a
changetype, such as
moddn, and
modify. These operations let you add entries, delete entries, move data around in the tree, and change
attributes of the data.
Designing the tree correctly is crucial to long-term viability of the LDAP server. A correct design means fewer change operations are needed, which leads to consistent data that can easily be found by other applications. By choosing common attributes, you ensure that other consumers of the LDAP data understand the meaning of the attributes and that fewer translations are required.
The LDAP schema dictates which attributes can be used in your server. Within the schema are definitions of the attributes, including OIDs to uniquely identify them, instructions on how to store and sort the data, and textual descriptions of what the attributes do. Object classes group attributes together and can be defined as structural, auxiliary, or abstract.
Structural object classes define the record, so a record may only have one structural object class. Auxiliary object classes add more attributes for specific purposes and can be added to any record. An abstract object class must be inherited and cannot be used directly.
Downloadable resources
Related topics
- Review the entire LPI exam prep tutorial series on developerWorks to learn Linux fundamentals and prepare for system administrator certification.
- RFC 1487, X.500 Lightweight Directory Access Protocol, gives you some insight into the development of LDAP and the history of X.500.
- RFC 2247, Using Domains in LDAP/X.500 Distinguished Names, is a brief description of the
domainComponentattribute and how to use it properly in your LDAP tree.
- RFC 2252, Lightweight Directory Access Protocol (v3): Attribute Syntax Definitions, lists the standard syntaxes for attributes, which can help you figure out what format a certain attribute is expecting.
- RFC 2849, The LDAP Data Interchange Format (LDIF) - Technical Specification, describes the LDIF language. It uses Backus-Naur Form (BNF) to specify the language, which can be tricky to understand. RFC 2234, Augmented BNF for Syntax Specifications: ABNF, might help you understand the various operators.
- RFC 4511, Lightweight Directory Access Protocol (LDAP): The Protocol, is the latest draft of the LDAP protocol.
- RFC 4519, Lightweight Directory Access Protocol (LDAP): Schema for User Applications, is an updated list of the commonly-used attributes; this list helps ensure you're using the same attributes everyone else is to describe the same data.
- The OID descriptions for 2.5.13 link to detailed descriptions of how each matching rule (string comparison, substrings, and ordering) works.
- This FAQ entry on object classes gives details on some of trickier rules of dealing with object classes. Some of OpenLDAP's error messages are terse, especially when dealing with LDIF imports.
- The overlay framework in OpenLDAP is key because the meta-directory concept can be carried further than just tying together multiple LDAP servers. A request for a particular tree or OID can be directed to custom code that can call a script, read a database, or call an API.
- "Demystifying LDAP Data" (O'Reilly, November 2006) explains object
class inheritance. It looks at the
inetOrgPersonobject class and describes structural and auxiliary object classes.
- LDAP for Rocket Scientists is an excellent open source guide, despite being a work in progress.
- OpenLDAP is a great choice if you're looking for an LDAP server.
- phpLDAPadmin is a Web-based LDAP administration tool.
- Luma is a good GUI to look at if that's more your style.
- In the developerWorks Linux zone, find more resources for Linux developers, and scan our most popular articles and tutorials.
- See all Linux tips and Linux tutorials on developerWorks.


text:
Cauldron to Kitchen
Paganism, food and spirituality
Evolution and Ethics
While ethics is one of my favorite subjects, Pagans don't have a set that we all agree upon. (duh) Some follow the Charge of the Star Goddess, or the Three-fold Law, and some work to cultivate virtues as opposed to following laws. But if we're all working to be good people, why can't we mange to get along a little better? In his TED talk, social psychologist Jonathan Haidt, says that if you've ever been confused about why people just can't get along, he might have an answer for you.
Haidt researches human morals and started by asking the question of why do human morals around the world have more to do with just how people treat each other? The norm in all cultures but Western, is that morals have to do with all sort of things that we often mock. For example, what you can and cannot do during menstruation, what you eat and with whom, and what you wear. For most Americans – let alone the small subset that is our religion – such questions are weird and alien. That's because we live in a WEIRD culture. The term WEIRD stands for Western, educated, industrialized, rich, and democratic, and was created by psychology researchers Joe Henrich, Steve Heine, and Ara Norenzayan. As Pagans in an industrialized culture, we cannot escape this.
The reason I am excited about Haidt's work is because he is interested in the biological basis for our moral behavior. And it seems there are evolutionary arguments to be made that much of our moral preference is, in Haidt's words, "organized in advance of experience." Haidt postulates six moral foundations:
1) Care/harm: This foundation is related to our long evolution as mammals with attachment systems and an ability to feel (and dislike) the pain of others. It underlies virtues of kindness, gentleness, and nurturance.
2) Fairness/cheating: This foundation is related to the evolutionary process of reciprocal altruism. It generates ideas of justice, rights, and autonomy.
3) Loyalty/betrayal: This foundation is related to our long history as tribal creatures able to form shifting coalitions. It underlies virtues of patriotism and self-sacrifice for the group. It is active anytime people feel that it's "one for all, and all for one."
4) Authority/subversion: This foundation was shaped by our long primate history of hierarchical social interactions. It underlies virtues of leadership and followership, including deference to legitimate authority and respect for traditions.
5) Sanctity/degradation: This foundation was shaped by the psychology of disgust and contamination. It underlies religious notions of striving to live in an elevated, less carnal, more noble way. It underlies the widespread idea that the body is a temple which can be desecrated by immoral activities and contaminants (an idea not unique to religious traditions).
6) Liberty/oppression: This foundation is about the feelings of reactance and resentment people feel toward those who dominate them and restrict their liberty. Its intuitions are often in tension with those of the authority foundation. The hatred of bullies and dominators motivates people to come together, in solidarity, to oppose or take down the oppressor.
Which brings me back to Pagan ethics.
In my own experience that not all of these foundations are meaningful to all of my Pagan friends. My Wiccan friends tend to favor the first two, while my Heathen friends find all of them important to some degree. The reason for my interest is that these morals tend to fall out on both on intra-Pagan and political lines and could easily explain some of the difficulties in communication.
I have believed for some time that we need to be aware the biological basis of our behaviors. Tied to the Earth as we are, biology is a sacred ground of being. I encourage you to check out Haidt's book and his other lectures on Youtube.
Wednesday, 29 January 2014
Thanks for posting! I appreciated your insights and the insights presented in the Ted talk you linked.· Selina Rifkin likes this comment.
Please login first in order for you to submit comments

subset: commoncrawl


text:
email@example.com 530608
To help reduce spam, please enter CDJEX into the box below:
01547 530608
The page you are looking for cannot be found
You're currently using a very outdated web browser which is no longer supported by Microsoft, this can lead to problems viewing our website and the rest of the world wide web.
We recommend upgrading to a much more powerful browser, such as Google Chrome.
Feel free to close this window and continue browsing.


text:
Please fill in your details to download the Table of Contents of this report for free. We also do customization of these reports so you can write to us at email@example.com in case you need any other additional information.
Reference No :
Business Lead : Selling Offer
We are a prominent manufacturer and exporter of Bags such as Jute Bags, Jute Promotional Bags, Jute Wine Bottle Bags, Ladies Jute Bags, Jute Beach Bags & Canvas Promotional Bags. Export Market: U.S
Contact Now
Address :
A-33, 1st Floor Rajouri Garden
, New Delhi , Delhi , India , 110 027
Price :
Price on request
Profile / Brief Description :
Price on request
Women Felt Bags
Price on request
Men's Bag
Price on request
Women's Bags
Price on request
Men's Bags
Price on request
Garment Bags
Price on request
Luggage Bags
Price on request
Jute Bags
Price on request
Garment Packaging Bag
Price on request
Cotton Carry Bags
18 INR / Pieces
Travel /Carry Bags
250 INR / Pieces
Jute Cotton Bags
200 INR / Pieces
Jute Bag
200 INR / Pieces
Subscribe today and get the latest information on Textiles, Fashion, Apparel.
Thank you.
We will shortly contact you.


text:
Switch to the light mode that's kinder on your eyes at day time.
Switch to the dark mode that's kinder on your eyes at night time.
1.6M Views
1.5M Views
© 2020 Netpopflix Worldwilde
Please Make sure you wait between 10 to 30 seconds before the stream starts or refresh the page.


text:
Room Rental
Library Spaces Available for Rent
Program and conference rooms are available for rent at all five Plano Library locations. There is a two hour minimum for rentals and fees (listed below) are nonrefundable.
Library Room Rental Fees
|Conference Room
|$15 per hour
($30 minimum)
|Conference Room
|$60 per hour
($120 minimum)
|Program Room
|$25 per hour
($50 minimum)
|Program Room
|$75 per hour
($150 minimum)
Spaces Available for Rent
|Rooms and Capacity
|Davis Library
|Conference Room: 10
|Program Room: 100
|Haggard Library
|Program Room: 100
|Genealogy Program Room: 53
Note: no kitchen facilities
|Harrington Library
|Program Room: 100
|Parr Library
|Conference Room: 25
|Program Room: 100
|Schimelpfenig Library
|Program Room Capacity: 100
Capacity with Tables & Chairs: 40
Capacity with Chairs: 70
|Conference Room Capacity: 18
Please note: Due to fire code regulations, these numbers cannot be exceeded.
- Group or organization is responsible for setting up chairs, tables, etc, and replacing them where designated.
- Equipment and supplies must be removed at end of reservation. The Library will not store or be held responsible for any items left in the room.
- Nails, thumbtacks, etc. cannot be used to attach decorations to the structure or to the furnishings.
- Decorations may be used on the tables only. No candles are permitted.
- Kitchen facilities are available for the program rooms in all Library locations and food is allowed.
- There are no kitchen facilities for the conference rooms. Already prepared refreshments are allowed.
- Alcoholic beverages and tobacco products are prohibited.
- Only equipment using 110 volts is allowed.
- The program / conference room must be vacated by the end of the scheduled time.
Library Room Rental Policy
Renters must first read and accept the PPLS Program Room Use Policy before reserving a space. Rental fees are nonrefundable and reservation of a room indicates acceptance of this policy.


text:
We think you are located in EuropeTo ensure you are seeing career content relevant to your location, please select your correct region using menu on the right
Featured Story
Exceptional technology for an exceptional mission
Two MTU-powered Search And Rescue cruisers will be going into service in 2020.
Featured Solution
The MTU Natural gas-powered Series 4000
Economical, sustainable, reliable and flexible.
Power range 776 - 2.535 kWe (50Hz) / 762 – 2521kWe (60Hz)
Featured Solutions
Hybrid Systems for Yachts
Take your leisure to the next level with quiet, clean and intelligent solutions.
Submerged treasure
MTU supplies drive and propulsion systems for oil platform operations around the globe.
"Ice Explorer" Glacier Tour Vehicles to Meet Tier 4 Standards
Deep in the Canadian Rockies, straddling two national parks, lies one of the largest non-polar ice fields in the world – the Columbia Icefield.
Mining ValueCare Agreements
More Uptime = More Downtime
Whether it's uptime or free time, making the most of every moment is what really matters. ValueCare Agreements give you the power, performance and peace of mind to do just that.
MTU Hybrid PowerPack
It takes revolutionary thinking to develop a smart rail drive system like the Hybrid PowerPack.
Marine Automation System
MTU Callosum
Developed on the basis of many years of extensive naval experience and perfected by constant dialog with its users, MTU Callosum ensures that the technology works reliably in every situation.
Eastern Europe & CIS
Turkey, Africa & Middle East
North America & Canada
Latin & South America
South East Asia & India
North East Asia
DCD Virginia Virtual
Further Information
Data Center China
Shanghai, China
Press Mailing List
MTU Report Subscription
I agree to the use of my data for further processing and contact according to the Privacy Policy.
Thank you for signing up for our newsletter
Many thanks for signing up for the MTU eReport newsletter. A confirmation email will be sent shortly to the email address you have provided. There you will find further instructions.
An error occurred, please try again later
Form submission unsuccessful due to an error. Please try again later.
Customer Assistance Center
We are here to take your Sales & Service questions around the clock, 365 days a year.
Read more
Sales & Service Locator
Find your local partner for Sales & Service.
MTU Stories
Reports and interviews about MTU products and solutions.


text:
You've thrilled to the death-defying acts at the circus, but have you ever been to the Shriners' Circus, where they string cables from the rafters at precisely the right height to take out motorcycle jumpers?
20-year-old Josh Headford was filling in for another rider when he came crashing to earth on Saturday night at the Elf Khurafeh Shrine Circus in Saginaw, Mich. According to an arena executive, the guy-wire above the floor had not been completely raised out of the way. It was to have been the final act of the evening anyway, but a super-professional ringmaster decided to call an end to the festivities right then and there.
Headford broke his femur, fractured a shoulder blade, and injured his wrist and elbow, and a clown on the ground was hurt when the cable hit him in the face. It could have been much, much worse, which is why you shouldn't feel bad if you want to watch the video again.


text: Welcome to Western Springs Recreation! Login User Name: Password: Remember Me? (If this is a public machine it is recommended that you do NOT turn this on). If you have registered for an activity with us in the past, you were sent an email with your User Name and Password. If you have an account with us, but you`ve forgotten your password, please click here for a reminder email. If you are unsure of your User Name or Password, you may also wish to contact our office. If you`re a brand new patron with us, please click here to register for a new account.


text:
KAM Exhibition | Homemade, with Love: More Living RoomThu - 10.08.2020 - ALL DAY
Contemporary Gallery at Krannert Art Museum | 500 E Peabody Dr., Champaign
Free; timed reservation required due to COVID-19 protocols
What would it mean to co-create and be in a homemade space of interior world making imagined for and with Black girls, women, and femmes as part of their everyday creative livelihoods? Homemade, with Love: More Living Room is a multimedia performance installation of artwork made during Saving Our Lives Hear Our Truth's (SOLHOT) sessions locally at Urbana and Franklin Middle Schools; a portion of Unheard Sounds, Come Through, an installation by St. Louis-based artist Jen Everett; and works by Black women artists in Krannert Art Museum's collection, including Carrie Mae Weems, Margo Humphry, and Doris Derby. In addition, the installation will include films on view that explore Black girls relationships to home, land and Black girlhood from Kamari Smalls, Ruth Nicole Brown and Paris Cian. The artists featured visualize and sound Black everyday life, celebration, and interiority with Black girlhood and feminist poetics, art, and collective care in mind. Homemade, more than an art exhibition, will be co-curated with SOLHOT as a home space that prioritizes Black girls' creative lives. This evolving installation makes room for celebration, creativity and imagination of Black girls, women, and femmes.
Curated by Blair Ebony Smith, DRIVE Postdoctoral Fellow in Art Education


text:
Harvey Weinstein's wife Georgina Chapman has announced she is leaving her husband, following allegations he sexually harassed dozens of women. This is the first time Chapman, the British fashion designer behind the luxury label Marchesa, has addressed the accusations made against her husband. Weinstein, 65, and Chapman, 41, married in 2007 and have two children together: India Pearl, 7, and Dashiell Max Robert, 4.
Editorial credit: Denis Makarenko / Shutterstock.com


text:
Bill Clinton may be seeking to help Barack Obama win again in November, but the former president may have to be careful that he doesn't overshadow the man he's trying to help get re-elected.
"I thought he was awesome," said one Pershing colleague to another at the close of the former president's keynote address on Wednesday at the BNY Mellon company's annual conference in Hollywood, Fla.
This enthusiastic comment came in response to the charismatic Clinton's assertion that while he is happy to support the re-election of President Barack Obama, he also values his friendships with former U.S. presidents on both sides of the aisle – including both George Bush Sr. and his son George W.
"I love the guy," Clinton said of Bush Sr. Of George W., he quipped: "We go to the same events together now and roll our eyes at each other's answers."
Speaking very much in a spirit of bipartisanship before an audience of nearly 2,000 at Pershing Insite 2012, Clinton conceded that it's easier to be a former U.S. president than an incumbent one. He certainly looked the part of a relaxed retired president, tall and slim with silver hair and sporting a sober suit along with a handwoven multicolored bracelet around his wrist.
And to the biggest round of applause during his entire keynote address, Clinton added that he is frustrated with the poor level of collaboration between Democrats and Republicans in Washington and the "frivolous" commentary of the political media.
"At some point we have to re-establish trust between the two parties in Washington," Clinton said. "If I say something nice about Mitt Romney, the political press acts like I endorsed him even though I oppose his political policies."
To be sure, Clinton came out in favor of Obama.
"I think Obama is more moderate than his critics think, and he should be re-elected," Clinton said.
Asked by Pershing Managing Director Frank La Salla during a question-and-answer period how he would fix the nation's fiscal woes, Clinton pointed to a three-part strategy:
- Resolution of the ongoing U.S. mortgage market crisis, so that consumers can start spending and taking out loans again.
- Repatriation of $2 trillion of U.S. company assets overseas as well as an infrastructure bank to be created by the repatriated capital.
- Reform of U.S. energy policy, which would include jobs creation from the green retrofitting of old buildings.
Audience member Gerald Wood, a chief financial officer with PRS International Advisory Service in Miami, said after Clinton's speech that his support of Obama during the election process is a mixed blessing.
"I thought he was great," Wood said of Clinton. "He manages to be noncontroversial for a president who was so controversial. But if I were Obama, I wouldn't know how to fit him into my campaign. Clinton overshadows everybody."
Prior to his Pershing engagement, Clinton was on the road with electioneering visits in Pittsburgh and Orlando. Next on his list of campaign stops is a visit to Rahm Emanuel, the mayor of Chicago and Obama's former chief of staff.
Read Advisors Want Romney, Resigned to Obama at AdvisorOne.


text:
Orionintie 1
Espoo, 02100
Orion is globally operating Finnish developer of pharmaceuticals. Orion provides contract manufacturing services for various formulation like potent drugs, semisolid hormones, oral cytotoxic, topicals, oral solids, nasals, liquids and small volume sterile injectable, packaging & seriliazation and API's as well. Our facilities comply with EMA, FDA, JP, ANVISA etc. quality standards.


text:
Kris Humphries has reportedly found himself a new woman – and she looks eerily similar to his ex-wife Kim Kardashian. Well, sort of.
The 27-year-old basketball player, best-known for his role of Mr. Kardashian (for a mere 72 days!), has reportedly been dating 25-year-old hotel employee Fatmire Sinanaj.
Humphries and "Myla" are said to have met last October in New York, at the dark-haired woman's place of work.
Humphries has denied the duo's relationship, according to celebrity gossip website TMZ.com, but recent shots of the Kardashian clone show her courtside at one of his basketball games and beachside with the athlete in a skimpy bikini.
Kardashian and Humphries made headlines with their hasty divorce after throwing a lavish TV wedding in August 2011. The former couple's court deposition is set to take place in Minnesota at the end of June, according to reports.
The basketball stud has openly criticized his ex for her rebound with hip-hop superstar Kanye West.
Guess we can see who has upgraded after the divorce.


text:
Butchery open online Free Weekly Deliveries Andover, Newbury, Winchester, BasingstokeCall 07815 904084 Login
£28.80 – £32.00
Bere Mill lamb is known for its unrivalled quality and flavour. Our animals are fed exclusively on the green pastures and hay made on the farm, and kept outside year round. Because the animals have a natural life outdoors they produce fantastically succulent, well-marbled meat that is bursting with flavour.


text:
Export 47 results:
Filtres: Author is Amélie Achim [Enlever les filtres]
Fronto-temporal disconnectivity and clinical short-term outcome in first episode psychosis: a DTI-tractography study. J Psychiatr Res. 2011;45(3):369-77.
How prevalent are anxiety disorders in schizophrenia? A meta-analysis and critical review on a significant association. Schizophr Bull. 2011;37(4):811-21.
The role of recollection in source memory: an examination of schizophrenia patients and their first-degree relatives. Brain Cogn. 2011;75(2):147-53.
The study of social cognition with neuroimaging methods as a means to explore future directions of deficit evaluation in schizophrenia? Psychiatry Res. 2011;190(1):23-31.
Familiarity and recollection processes in patients with recent-onset schizophrenia and their unaffected parents. Psychiatry Res. 2010;175(1-2):15-21.
Parietal cortex and episodic memory retrieval in schizophrenia. Psychiatry Res. 2010;182(3):191-9.
Insights from the examination of verbal and spatial memory errors in relation to clinical symptoms of patients with recent-onset schizophrenia. Cogn Neuropsychiatry. 2009;14(6):542-58.
Selective pair recognition memory impairment with no response bias in schizophrenia. Psychiatry Res. 2009;169(1):39-42.
No evidence for a differential deficit of reality monitoring in schizophrenia: a meta-analysis of the associative memory literature. Cogn Neuropsychiatry. 2008;13(5):369-84.
Structural neural correlates of impairments in social cognition in first episode psychosis. Soc Neurosci. 2008;3(1):79-88.
Medial temporal lobe activations during associative memory encoding for arbitrary and semantically related object pairs. Brain Res. 2007;1161:46-55.
Selective abnormal modulation of hippocampal activity during memory formation in first-episode psychosis. Arch Gen Psychiatry. 2007;64(9):999-1014.
Social cognitive impairments in first episode psychosis. Schizophr Res. 2007;95(1-3):124-33.
Associative memory encoding and recognition in schizophrenia: an event-related fMRI study. Biol Psychiatry. 2006;60(11):1215-23.
Associative interference does not affect recognition memory in schizophrenia. Schizophr Res. 2005;80(2-3):185-96.
Cognitive and clinical moderators of recognition memory in schizophrenia: a meta-analysis. Schizophr Res. 2005;74(2-3):233-52.
Dorsolateral prefrontal cortex involvement in memory post-retrieval monitoring revealed in both item and associative recognition tests. Neuroimage. 2005;24(4):1113-21.
Episodic memory-related activation in schizophrenia: meta-analysis. Br J Psychiatry. 2005;187:500-9.
The interfering effect of related events on recognition memory discriminability: a functional magnetic resonance imaging study. Brain Res Cogn Brain Res. 2005;22(3):429-37.
Neural correlates of memory for items and for associations: an event-related functional magnetic resonance imaging study. J Cogn Neurosci. 2005;17(4):652-67.
Is associative recognition more impaired than item recognition memory in Schizophrenia? A meta-analysis. Brain Cogn. 2003;53(2):121-4.


text:
Showing results 7 results found
C/ Químicas, 57 . Alcorcón
The solution to event production. Audiovisual, sound, technology, stages, tents, furniture, catering, entertainment and artists. Benefit from cost advantages and responsibility.
Offices in: Madrid
Cl Gremio del Cuero, 14 40195. Segovia
The largest supplyer of leisure material for events in Spain. More than 200 options to animate your event. Activities, productions, robots, shows. We provide mater
Offices in: Segovia
Garibay, 7 28007. Madrid
We are specialize in props and furniture rentals for events.
Offices in: Madrid
Denia, 8 . Barcelona
Lightcase™ is an exclusive collection of light volumes for your event. 100% customizable, 100% Autonomous and 100% unique.
Offices in: Barcelona
Avenida 3 del Parc Logistic, nº15 08040. Barcelona
Leading company in rental of design furniture and floorcovering for events.
Offices in: Barcelona
Polígon industrial C/Indústria, 11-13 Fornells de la Selva, Girona 17458. Fornells de la Selva
His career is backed by over 70 years of history.
Offices in: Girona
Avda. Sistema Solar 13, Nave 7 y 8 . San Fernando de Henares
LAGO EMPEDRADO we offer that and much more.
Offices in: Madrid


text:
Review: The most affordable Geforce 500 series card
Nvidia launched the GT 520 at the beginning of April. We're talking about a low-end card from the company's Geforce 500 series. Gainward decided to re-tailor it in order to cater to those who prefer their cards silent and dubbed the card GT 520 1GB SilentFX.
Geforce GT 520 is a budget card for workstations and HTPCs and it's quite an affordable alternative to integrated graphics. Geforce GT 520 1GB SilentFX goes for about €35 and comes with passive cooling and three different video outs. Gainward's cooler is inaudible but we believe that many HTPC users will not like the fact that the card is dual slot. Geforce GT 520 1GB SilentFX comes with one VGA, one HDMI and one dual-link DVI so most users will be covered.
Geforce GT 520 is based on the GF119 chip, one of the most basic Fermi GPUs. Specs-wise, the GF119 is half of the GF108, which can be found on GT 430 cards. Note that Nvidia followed up on its Geforce GT 220 (no DX11 support) with the GT 420 (with DX11 support) but the GT 420 was reserved for OEMs. Thus, the GT 520 can be considered as the GT 220's successor.
As you'd expect, Geforce GT 520 consumes very little with a 29W TDP. The card has DX11 support but only 48 CUDA processors (shaders).
Geforce GT 520 1GB SilentFX comes in a small but sturdy box that emphasizes that the card received the 'Good' design treatment, which means that Gainward uses special cooling. This time around, it's a dual slot passive cooler. The box holds the card, a short user manual and driver CD.
Just like most Nvidia's mainstream cards, Geforce GT 520 comes with support for 3D Vision, PhysX acceleration, PureVideo HD, blu-ray acceleration, CUDA support, DX11. Naturally, all these features are emphasized on the box.
Gainward Geforce GT 520 SilentFX is a low profile graphics card that measures about 168mm in length. The low profile slot bracket is not included although the card's VGA connector can be removed. The cooler is quite simple and made of a single massive aluminum block with tall fins, which makes it a dual slot card. The large dissipation surface does not require grand cooling inside the case but, naturally, it will require at least some airflow in order to dissipate heat.
The PCB is about 14.5cm long but as you can see from the picture, the cooler is longer than the card. You can see that the card has no SLI connectors but two GT 520 cards can be daisy chained in SLI mode with data transferred via PCI Express bus.
The memory chips are on the GPU side of the PCB. Although it seems as if the cooler touches the memory chips, there are a few millimeters between them.
Gainward opted for Elpida EDJ1108BDSE-DJ-F DDR3 chips which run at 1070MHz but, according to the specs, can run up to 1333MHz at 1.5 volts. The memory interface is a 64 bit, which is why the card has a low bandwidth of only 8.6GB/s.
Geforce GT 520 SilentFX has VGA, HDMI 1.4a and dual-link DVI outputs, one of each to be precise. Audio is routed directly via HDMI connector with bitstreaming support for both Dolby True HD and DTS-HD Master Audio.
The following picture shows the GT 520 SilentFX next to Gainward's GTX 570 GX sample card (reviewed here) just to get a size comparison point. Both cards have dual slot coolers.
Since it's a low-power GPU, there's no need for additional power, i.e. the card gets all the power it needs via PCI Express. Still, users are advised to use a 300W+ PSU.
Gainward's GT 520 SilentFX runs at reference GPU clocks – 810MHz. However, Gainward increased the memory clocks from reference 900MHz to 1070MHz. Nvidia did not want to intrude on the GT 430 but we'd still like to have seen a bit better performance by the GT 520.
Video processing and power consumption
Most users who want Nvidia?s GT 520 will use it for viewing HD movies, off of their own media servers or online, i.e. they'll utilize to the max solely for multimedia. Linux users on the other hand will prefer Nvidia to AMD due to the former's superior driver support. Relatively low consumption, passive cooling and enough juice for postprocessing effects are the pros for GT 520 because, as you've seen yourself, it's not quite tailored for gaming. The cheaper GT 430 on the other hand would be much better for this purpose.
Load Temp Gaming
GPUZ showed fan speed as well, although the GT 520 SilentFX is passively cooled.
Load Temp 1080p
Idle Temp
GT 520 is Gainward's most affordable Geforce 500 series card. The company offers three different models based on the GF119 GPU, one of which is Geforce GT 520 SilentFX. We're talking about a passively cooled card aimed at workstation and HTPC users. Passive operation and quality audio video reproduction are one of the main advantages of the GT 520 SilentFX over similar cards. The card has a low power GPU whose TDP is only 29W, thus allowing for passive cooling.
The GF119's GPU is enough for processing video in any format but as far as gaming is concerned – users are stuck with 1280x1024, or even lower depending on specific game demands. Geforce GT 430 can still be found on the shelves and it goes for only €5-10 more than the GT 520. So, if you're keen on gaming, we'd advise you to go for the GT430.
Bitstreaming support for both Dolby True HD and DTS-HD Master Audio via HDMI-a is perfect for home theatre computers but the GT 520's advantage over Intel's and AMD's integrated solutions is that it can run two displays. Apart from the HDMI connectors, GT 520 SilentFX has one VGA and one dual-link DVI out.
Gainward's GT 520 SilentFX uses dual slot heatsink that may cause problems in some smaller HTPC cases, although the card's main downside, i.e. lack of graphics performance, is down to Nvidia's design. On the other hand, if you're looking for a passively cooled card, it's definitely worth checking out, if nothing else then to upgrade integrated graphics solutions.


text:
If you've upgraded to Ubuntu 11.10, you may have noticed your movie files not looking as they should in the default Movie Player (Totem), and probably others like SMPlayer and MPlayer. For me, the clips actually looked fine first off, but only in Totem, as SMPlayer kept crashing. Then, after getting some updates, Totem started displaying the colours all mixed up (as did SMPlayer, which wasn't crashing any more). I tested GNOME MPlayer, and that was fine, but all my other players were affected.
From the looks of comments I've seen around, updating/installing Medibuntu is a likely suspect, but whatever the cause, it should actually be quite easy to fix. Simply go to Edit > Preferences > Display in Totem, and adjust the Hue from the default 50% mark all the way up to 100%. If yours is all the way down at 0%, as some have reported, then you definitely need to do the same. You may need to do this with each player, but in my case changing the setting in Totem immediately rectified the problem in SMPlayer. If it doesn't for you, however, then you know how to fix this easily.
Lastly, don't be surprised if later on you go to play a vid and your colours are all mucked up again. This time, you'll probably find the Hue is still at 100%, so you'll need to drop it back to the default of 50%. It might be a bit of a hassle, but this should be fixed up at the development end soon enough, and at least it only takes a few seconds to get your movies looking as they should.
Did this information make your day? Did it rescue you from hours of headache? Then please consider making a donation via PayPal, to buy me a donut, beer, or some fish'n'chips for my time and effort! Many thanks!


text:
Report errors and broken links here
More options
Galleries: Please register to list your site on this page at no cost
Sphinx Fine Art, London, UKA river sceneEsaias left an extensive painted oeuvre of over 180 pictures, 117 of which are landscapes. In addition to landscapes, Esaias van de Velde also painted genre and military paintings.
All images and text on this Esaias van de Velde page are copyright 2010 by John Malyon/Artcyclopedia, unless otherwise noted. Note that the listings on this site are a unique compilation of information and are protected by copyright worldwide.


text:
The conventional Coil Feeding Line is the classical way of configuration for Coil Feeding Lines.
Usually it consists of non-driven decoiler, straightener, material loop (including loop bridge) and a roll feed. The straightener is equipped with variable speed drive and loop control and is pulling the coil material against a braked pull-off decoiler.
The very sensitive braking of the decoiler usually is done by an (in most cases pneumatically) adjustable disk brake. After straightening the straightener pushes the coil material into a material loop, out of which the roll feed takes the material for feeding it into the press.
In case of a high rate of feeds per minute with long feeding lengths the Coil Feeding Line will be completed with a loop pit, to assure enough material stock within the loop.
In order to assure that even in case of big coil weights the straightener can pull the material from the decoiler dynamically, it is recommended to drive this line within a "closed loop" mode. In this case the decoiler is equipped with a variable speed drive and the drive of the decoiler is coupled to the drive of the straightener by means of balancing of the encoders of both drives. The unit, built in this way, can accelerate very dynamically and is able to assure the necessary stock of material within the loop even in case of a high number of feeds per minute with big feeding lenghs.
Therefore the Coil Feeding Line as a conventional version specially qualifies for processing of surface-delicate, scratch-free or coated materials as well as for high line speed and for fast acceleration during feeding into the press.
In case of extremely delicate material such a conventional Coil Feeding Line can be completed with a loop between decoiler and straightener. In this case the decoiler also will be equipped with a variable speed drive and feeds the material into a loop, out of which the straightener will take the material. By this procedure it will be possible to prevent the material from any kind of damage which can arise due to the pulling forces which can arise during pulling the material from the decoiler.
Please let us have information regarding the desired capability of such a conventional Coil Feeding Line and regarding the available space. We will offer to you a tailor-made solution.
If you will have questions regarding our conventional Coil Feeding Lines, we will be at your disposal at any time. Please do not hesitate to contact us:
|+49 2156 419193
|+49 2156 4979325


text:
Pre-Owned 2016 Chevrolet Silverado 1500 LT Standard Bed
VIN: 1GCNKREC9GZ394918. Miles: 70,833. The Internet Price is reflective after 1995 down. Price subject to change. Subject to primary lenders approval. All prices exclude tax, title, $695 dealer fees, tags, license & DMV. Must finance through dealer when applicable & take same-day delivery. Sorry but we cannot extend special Internet pricing without a printed copy of the on-line pricing, and your in-store price may exceed our special on-line pricing. To take advantage of our special Internet discounts, please print this page and present it to your salesperson.


text:
About the ProductInspired by the repetitive formality of a classical arched colonnade, the Society table is both modern and minimalist and timeless. Its simplicity lends well to any setting, while the subtle curvature of its profile adds drama and depth to its form. Carved from solid maple, the Society table features subtle curves under the tabletop and precise facets behind the legs. Available in several sizes and range of dark and light wood finishes.
The BrandMore about this Brand
Orphaned at 13, John Bernhardt jumped a box-car to Oregon hoping to become a government surveyor. He returned home three years later to pursue a career as a timber cutter. After buying a sawmill he saw the opportunity to use timber to make solid oak bedroom furniture. Pretty soon folks in Chicago and New York City started buying this furniture for their homes. And so in 1889 the Bernhardt Furniture Company was born in North Carolina. Berhardt's skill was in leveraging the area's plentiful supply of beautiful timbers, and local woodworking skills. Never one to do things by halves, he opened his factory with 25 employees.
Environmental Performance


text: February 28 22:59 (Ukrainian News) The Ukrainian national team has completed its performance in the Winter Olympic Games in Vancouver, Canada, without any medals. Ahead of the start of the Winter Olympic Games in Vancouver the Ministry for Affairs of Family, Youth Policy, and Sport expected Ukrainians to win medals in figure skating, freestyle, tobogganing, and skiing. The best achievement of Ukrainian athletes during the Winter Olympic Games in Vancouver became the fifth place in biathlon from Andrii Deryzemlia. As for Ukrainian women, the best result was the sixth place in the biathlon relay race. The best achievement in figure skating was the eighth place of Tetiana Volosozhar and Stanislav Morozov. In the cross country race the best result belongs to Valentyna Shevchenko - the ninth place in the ten-kilometer race. As for the freestyle, both Ukrainian men and women failed to pass through the qualification round. In tobogganing, Natalia Yakushenko took the 11th place and Lilia Ludan took the 19th place. Other kinds of winter sport did not give Ukraine any pleasant surprises.


text:
"American Idol" is another step closer to revealing its 36 semifinalists.
Following group performances by the remaining 104 crooners, host Ryan Seacrest announced at the end of Wednesday's episode that about 75 hopefuls made it through to the next round of Hollywood Week on the eighth season of the popular Fox singing competition.
Much of the episode focused on bickering and sobbing singers rather than their group routines performed for the judges.
Among the hopefuls cut: Katrina "Bikini Girl" Darrell, confrontational Nancy Wilson, happy-go-lucky Austin Sisneros, dreadlocked Rose Flack, Southern belle Deanna Brown and David Osmond, the son of the eldest singing Osmond brother.


text:
Download the Florida Tech Education Centers Brochure
Learn more about getting a master's from Florida Tech...
Download our informative brochure and learn why a graduate degree from Florida Tech is a valuable career move for you
Learn about the
exciting graduate degrees and disciplines
available at the many education center locations throughout the eastern United States.
Understand why you should join a
world-class university
Learn about how earning a graduate degree from Florida Tech is
designed for working professionals
Check out why other
professionals worldwide chose Florida Tech
To receive this brochure with all the information you'll need, fill out the form on the right.
Download the Brochure Now!
Packed with information you can use to make one of the most important decisions of your life!
Florida Institute of Technology is accredited by the Southern Association of Colleges and Schools Commission on Colleges to award associate, baccalaureate, master's, education specialist and doctoral degrees. Contact the Commission on Colleges at 1866 Southern Lane, Decatur, Georgia 30033-4097 or call 404-679-4500 for questions about the accreditation of Florida Institute of Technology. Florida Institute of Technology does not discriminate on the basis of race, gender, color, religion, creed, national origin, ancestry, marital status, age, disability, sexual orientation, Vietnam-era veterans status or any other discrimination prohibited by law in the admission of students, administration of its educational policies, scholarship and loan programs, employment policies, and athletic or other university sponsored programs or activities.


text:
David McLean
Microsoft: "We won" 2011 in Australia, not Sony
Microsoft has issued its own response to the NPD Group Australia's 2011 report, highlighting data in opposition to Sony's claim to have won the year.
David McLean headlines
Microsoft: Kinect voice coming to Australia by end of 2011, statistics revealed
Microsoft Australia's Xbox boss, David McLean, has said Kinect will be voice enabled in the country by the end of the year, and also dropped a few interesting statistics for Aussie use of the console.
360 sells 630,000 units in Australia
Microsoft's confirmed to Gamespot that Xbox 360's now sold more than 630,000 units in Australia.The figure's an increase of 93,000 since January this year.Xbox regional director for Australia and New Zealand David McLean dropped the news at E3, and also confirmed that the console's Video Marketplace would launch Down Under later this year.


text:
London-based post-something-core experimentalists twentysixfeet have announced a fairly hefty tour that'll take in such beauty spots as Leeds, Norwich, Romford, and Cindy Crawford's face.
The above sentence may contain at least one lie.
The band - who released their fairly excellent indeed EP-cum-mini-album thing Two Hours Of Passionless Tango earlier in the summer - will play the following venues on the dates noted beside them...
27 London Catch with Luxembourg and Royal Treatment Plant
13 London Purple Turtle, Camden
21 Leeds The Brundell Social
23 Norwich Hog In Armour with Immune
24 London Catch with Immune and Akira
26 Oxford The Cellar with Immune
27 Manchester Glasswerk (In The City)
28 Romford The Bitter End Immune
29 Buckley The Tivoli with Immune and Cyril Snear
31 Huddersfield Huddersfield College
1 Sheffield D'n'R with Immune
2 Nottingham The Rose Of England with Immune
3 Leeds Woodhouse with Immune
5 Date TBC - please contact band with offers!
Wanna get in touch with twentysixfeet? Their MySpace site is here.


text:
Your shopping cart is empty!
|Surya Rugs
|Product Code:
|Alfresco Outdoor Rugs
|Predominant Color:
|Sage and Khaki
The beautiful area rugs in the Alfresco Outdoor Collection can be used on the porch, deck, and patio; or hose them down and use them in your kitchen, sunroom and bathroom! This versatile collection offers rugs that are stain, humidity, and UV Ray resistant. Complement your home decor with the beauty of Alfresco rugs that flow smoothly with your lifestyle.
The Alfresco Outdoor Collection area rugs are available in rectangular, round and square shapes, and runners in some styles. See the drop-down option menu above for available sizes and prices.
Color note: Rug colors include Sage, Khaki, Black, and Camel.
To view the entire collection, click on the following link: Alfresco Outdoor Collection


text:
http://www.techradar.com/news/top-5-bes ... os-in-20175. Debian
We can hear you shouting from here. "But TechRadar," you bellow, "Debian is massive! How can you call it 'rising'?" Here's how: it is definitely a rising distro. While Ubuntu did a great job bringing Linux to the masses, many users brought on board by its orange-and-brown glitz and glamour have moved away thanks to a few controversial changes. The natural post-Ubuntu route, given the huge amount of shared DNA, is its parent OS, Debian.
There may not be a better time to make the leap than now, with the latest of Debian's 'when it's ready' releases about to drop. Version 9, subtitled 'Stretch', is frozen and ready for release once its list of bugs is ironed out. Given Debian's huge range of application options, its massive list of possible desktops, and the stability and almost universal compatibility of its package manager, plain old Debian is one of the strongest Linux choices going.


text:
A western Pennsylvania school board is reviewing a request by a transgender male student who wants to appear on the ballot for homecoming king.
The student, Kasey Caron, was disappointed that the Richland School Board did not immediately rule on the request Monday night, saying, ``I thought they were going to have a change of heart. I am still hoping for one,'' the Johnstown Tribune-Democrat reported.
Caron was denied a spot on the ballot after a driver's license listed his gender as female, though Caron contends that has been changed to "male.''
Breaking news and the stories that matter to your neighborhood.
But school board Solicitor Timothy Leventry said the state's legal standard is higher and that there's no doubt that Caron is legally female.
"The law defines whether a person is male or female,'' Leventry said. "If you want to change legally to be a male in Pennsylvania, you have to have been certified by a physician who is qualified, and you have to have your birth certificate changed.''
That doesn't necessarily mean the school board might not allow Caron on the ballot for homecoming king, however.
"Administration, based on advice of counsel, believes as a female, you have to be on the female ballot,'' Leventry said. "If the school board wishes to change that, they have the right to do that.''
John DeBartola, president of the Keystone Alliance-Gay Life Newsletter, said, ``It is important that we respect their rights of choice _ the rights for them to be the person that they are.''
The school board expects to discuss the matter in executive session in time to vote on Caron's request at its Sept. 23 meeting. The homecoming game is Oct. 5.
The dispute is similar to one earlier this year in the Red Lion Area School District in York County.
In that case, a transgender student wanted his male name announced at graduation. That student was allowed to wear a boy's-style black graduation gown, but school officials issued a diploma in his female birth name and announced his birth name because the diploma is a legal document.


text:
Nevada governor candidate Bob Goodman defends against residency questions
Democratic gubernatorial nominee Bob Goodman defended himself June 13 against questions about whether he's actually a Nevada resident entitled to run against Gov. Brian Sandoval.
Goodman gathered 24.7 percent of the Democratic primary votes Tuesday in a field of eight. That total was second to "None of the Above," which collected 29.9 percent of the vote — some 4,000 more than Goodman.
The issue was raised in a Las Vegas Sun story that reported Goodman, in an interview earlier this year, said he lived in the Philippines where he has a business.
But a check of his election filings shows he claims to live in Las Vegas but the phone number on that document rings to a recorded message which doesn't accept incoming calls. His financial disclosure statement with the Secretary of State's Elections Division lists that address but lists zero income or property, no contributions and no campaign expenses.
In an email response Friday, Goodman said he's in the Philippines on a trip planned earlier to Hong Kong, China and other parts of Asia "on a trade and tourism mission" to bring business to Nevada.
As for how he makes a living, he said, "My grown sons support me and I live modestly." He also receives Social Security.
If challenged, Goodman could become the second candidate disqualified this election cycle. The first was John Michael Schaefer, who was removed from the ballot because he didn't meet the two-year residency requirement to run for Controller. The Secretary of State's office found Schaefer ran for Los Angeles City Council just a year ago, claiming residence in that state.
Goodman said despite the huge public lead Sandoval enjoys, he believes he has a strong chance to win the governor's race, citing tea party candidate David Brat's victory over House Majority Leader Eric Cantor.
In addition to being a former Marine, he said his experience as former Director of Economic Development for Mike O'Callaghan — governor in the 1970s — is key to his ability to bring economic development to Nevada.
Also on Friday, losing congressional hopeful Niger Innis says he wants an investigation into why a virtually unknown candidate made such a strong showing in the Nevada Republican primary, according to the Associated Press.
Innis issued a statement Thursday saying he would call on Secretary of State Ross Miller to audit the 4th District results, in which Assemblyman Cresent Hardy earned 43 percent of the vote, Innis took 33 percent and Mike Monroe earned 22 percent. About 24,000 votes were cast. Innis asked whether a computer error might be behind Monroe's large share of the vote, even though Monroe did virtually no campaigning.
He acknowledged Hardy won the nomination and "we need to move forward."
Secretary of State spokeswoman Catherine Lu said Miller's office had not received a formal request for an investigation as of Friday morning.