On la, 07 syys 2019, Kevin Vasko via FreeIPA-users wrote:
Thanks Louis! Will be trying this as soon as I get in on Monday (no
remote
access). If I wanted to validate my configuration how do I go about getting
this information out of my FreeIPA installation?
Since the EMC by default includes the schema I attached is it old/out of
date or is it for something entirely different?
I was the impression that FreeIPA includes the 389 Directory Service and
that Fedora Directory Service, 389 Directory Service, and FreeIPA Directory
Service were all synonymous.
While software is the same, the way how LDAP tree is
arranged is
specific to a particular deployment design. FreeIPA deployments use a
tree arrangement that is not using organizational units.
In FreeIPA there is a flat subtree per each object type. This means that
all objects of that type are placed in the same subtree. All users are
in cn=users,cn=accounts, while all groups are in cn=groups,cn=accounts.
In their own turn, these subtrees are subtrees of the main tree suffix
which we always call $SUFFIX or $BASEDN (base dn) -- it is always a
sequence of DC=.. components from your primary domain/realm:
example.com -> dc=example,dc=com
Louis is correct with the subtrees, please use that arrangement.
If you want to know all subtrees for each object type, you can use IPA
command line tool to discover that:
ipa env basedn
ipa env |grep container_
You can ask the tool 'ipa env' for a value of a specific variable by its
name or just list all of them and grep by some substring like above.
I'll post back Monday with results. Thanks again.
-Kevin
On Fri, Sep 6, 2019 at 10:30 PM Louis Abel via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
> At first glance, it looks like you're doing 1 and 2 correctly. But I'll
> leave that up to someone else to point that out.
>
> As for number 3, those settings are incorrect. What it should look like is
> this:
>
> nss_base_passwd cn=users,cn=accounts,dc=ny,dc=example,dc=com
> nss_base_group cn=groups,cn=accounts,dc=ny,dc=example,dc=com
> nss_base_hosts cn=computers,cn=accounts,dc=ny,dc=example,dc=com
> nss_base_netgroup cn=ng,cn=alt,dc=ny,dc=example,dc=com
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland