OAM with AD IdS - is necessary to extend schema?

Hi all,

I have a OAM Server used for OIF purposes. Active Directory is the Identity Store used for authenticating users.

Actually I have for this IDS a raw user configured, only with OU browse permission and entry read. It works fine for authenticating, but it lacks of other functionalities such as user locking after X failed login attempts.

I have requested a user with entry modify permissions besides browse and read. Can this be enough, or I have to extend AD schema with the oblix classes? In a first place I though that the extension goal was for OIM-OAM integration, but is neccesary to do some other OAM authentication functions, or with a more privileged user should be enough?