Currently IPA only supports a fixed LDAP schema. Changing the schema (e.g. adding a new attribute) might require changing the server plugins and the UI code. There should be a way to simplify the process for IPA admins who will not change the code.

The LDAP schema contains information about object classes, the required/optional attributes, the attribute types, etc. However, the schema alone is not sufficient to define a new attribute. The server plugins have to define the attribute labels for I18n, validation patterns and messages, CLI names, initialization functions, etc. All of these are stored in server metadata, but this too isn't sufficient either. The UI still has to define the list and the order of attributes to be displayed in the dialogs and pages, the sections, the layouts, the handlers, etc.

So in order to make IPA configurable by the admins, at least some of the above information must be moved into LDAP. A new LDAP schema probably will be required to store these configurations. The server plugins and the UI must be modified to read and use the configuration. New CLI/UI will be needed to manage the configuration.

To reduce the impact on the existing code, we can define 2 classes of schema:
1. Standard schema: This is the built-in IPA schema. Changing the standard schema might be possible but will not be supported.
2. Schema extension: This is the schema that can be managed by the admins. In the UI the new attributes will be displayed in a separate section without disturbing the layout for the standard attributes.