Hi
I installed the latest Fedora and the latest Freeipa version so the
attributes are there now.
But what we noticed today is when the users are created the
attributes edupersontargetedid, edupersonaffiliation and mail is not
added to the new user accounts automatically, how can we get ipa to add
the attributes on user creation?
Hi,
if you are using ipa user-add to create the user, you can use the
--addattr option:
ipa user-add username --addattr edupersontargetedid=<value>
The mail attribute is normally automatically added with a default value
username@<default e-mail domain>. You can check the default e-mail
domain with ipa config-show.
HTH,
Flo
Regards
Per
> On 16 Mar 2018, at 19:24, Per Qvindesland <perq(a)me.com
> <mailto:perq@me.com>> wrote:
>
> Hi
>
> I’m on centos 7 and I just did a yum update and I see:
> 389-ds-base x86_64
> 1.3.6.1-26.el7_4 updates
> 1.7 M
> 389-ds-base-libs x86_64
> 1.3.6.1-26.el7_4 updates
> 681 k
>
> I updated and tried ipa user-mod perq --addattr
> "edupersontargetedid=value” again but with the same results, so it
> looks like I need the same version.
>
> Any idea when it will be released for Centos 7?
>
> Regards
> Per
>
>
>
>
>> On 16 Mar 2018, at 18:10, Rob Crittenden via FreeIPA-users
>> <freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>>
>> Per Qvindesland via FreeIPA-users wrote:
>>> HI
>>>
>>> So what can I do?
>>
>> Flo is right, it is there in 389-ds-base-1.3.7.9-1.fc27. I was looking
>> in the old schema directory. The attribute should be there.
>>
>> rob
>>
>>>
>>> Regards
>>> Per
>>>
>>>
>>>
>>>> On 16 Mar 2018, at 09:43, Florence Blanc-Renaud <flo(a)redhat.com
>>>> <mailto:flo@redhat.com>> wrote:
>>>>
>>>> On 03/16/2018 09:46 AM, Per Qvindesland via FreeIPA-users wrote:
>>>>> Hi
>>>>> Ok so how would I go about creating it?
>>>>> Regards
>>>>> Per
>>>> Hi,
>>>>
>>>> it seems we don't have the same 389-ds-base version. In my version,
>>>> the schema for eduPerson was updated (see ticket
>>>>
https://pagure.io/389-ds-base/issue/49248). I am using
>>>> 389-ds-base.x86_64 1.3.7.9-1.fc27
>>>>
>>>> Flo
>>>>>> On 15 Mar 2018, at 22:06, Rob Crittenden <rcritten(a)redhat.com
>>>>>> <mailto:rcritten@redhat.com>
<mailto:rcritten@redhat.com>> wrote:
>>>>>>
>>>>>> Per Qvindesland via FreeIPA-users wrote:
>>>>>>> Hi Florence
>>>>>>>
>>>>>>> ipa user-show perq —all gives:
>>>>>>> objectclass: top, person, organizationalperson,
inetorgperson,
>>>>>>> inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux,
>>>>>>> ipaobject, ipasshuser, ipaSshGroupOfPubKeys,
>>>>>>> mepOriginEntry, eduPerson
>>>>>>>
>>>>>>> And ldapsearch -x -b cn=schema -LLL -s base -o ldif-wrap=no
>>>>>>> objectclasses | grep -i eduPerson gives:
>>>>>>> objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME
'eduPerson'
>>>>>>> AUXILIARY MAY (
>>>>>>> eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $
>>>>>>> eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
>>>>>>> eduPersonPrincipalName $ eduPersonEntitlement $
>>>>>>> eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation )
X-ORIGIN
>>>>>>> 'http://middleware.internet2.edu/eduperson/‘
>>>>>>> <
http://middleware.internet2.edu/eduperson/%E2%80%98>
>>>>>>> <
http://middleware.internet2.edu/eduperson/%E2%80%98>)
>>>>>>
>>>>>> edupersontargetedid is not an attribute in the objectclass. I
>>>>>> don't have
>>>>>> it defined in the schema on my server at all (though I have a
>>>>>> similar if
>>>>>> not the same eduPerson).
>>>>>>
>>>>>> rob
>>>>>>
>>>>>>>
>>>>>>> So eduperson is listed, seems a bit odd that it then doesn’t
work.
>>>>>>>
>>>>>>> Regards
>>>>>>> Per
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>>> On 15 Mar 2018, at 16:22, Florence Blanc-Renaud
<flo(a)redhat.com
>>>>>>>> <mailto:flo@redhat.com>
<mailto:flo@redhat.com>
>>>>>>>> <mailto:flo@redhat.com>> wrote:
>>>>>>>>
>>>>>>>> On 03/15/2018 02:35 PM, Per Qvindesland via FreeIPA-users
wrote:
>>>>>>>>> Hi Florence
>>>>>>>>> I did that added ipa user-mod perq --addattr
objectclass=eduPerson
>>>>>>>>> which went fine then ipa user-mod perq --addattr
>>>>>>>>> "edupersontargetedid=value” but it still gives
me the error ipa:
>>>>>>>>> ERROR: attribute "edupersontargetedid" not
allowed.
>>>>>>>>> Looking into the logs and there is not much to go on,
the same
>>>>>>>>> error: ERR - oc_check_allowed_sv - Entry
>>>>>>>>>
"uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" -- attribute
>>>>>>>>> "edupersontargetedid" not allowed but
nothing else.
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> I'm not able to reproduce your issue. Can you provide
the output of
>>>>>>>> $ ipa user-show perq --all
>>>>>>>>
>>>>>>>> At the end of the output you should find something like:
>>>>>>>> objectclass: top, person, posixaccount, krbprincipalaux,
>>>>>>>> krbticketpolicyaux,
>>>>>>>> inetuser, ipaobject, ipasshuser,
ipaSshGroupOfPubKeys,
>>>>>>>> eduPerson
>>>>>>>>
>>>>>>>> We need to make sure that eduPerson is listed in the
objectclasses.
>>>>>>>>
>>>>>>>> Then check that the schema definition for eduPerson
properly
>>>>>>>> includes
>>>>>>>> edupersontargetedid:
>>>>>>>> $ ldapsearch -x -b cn=schema -LLL -s base -o
ldif-wrap=no
>>>>>>>> objectclasses | grep -i eduPerson
>>>>>>>> objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME
'eduPerson'
>>>>>>>> AUXILIARY MAY
>>>>>>>> ( eduPersonAffiliation $ eduPersonNickName $
eduPersonOrgDN $
>>>>>>>> eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
>>>>>>>> eduPersonPrincipalName $ eduPersonEntitlement $
>>>>>>>> eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation $
>>>>>>>> eduPersonTargetedID $ eduPersonAssurance $
>>>>>>>> eduPersonPrincipalNamePrior
>>>>>>>> $ eduPersonUniqueId $ eduPersonOrcid ) X-ORIGIN
>>>>>>>> 'http://middleware.internet2.edu/eduperson/' )
>>>>>>>>
>>>>>>>> Flo
>>>>>>>>
>>>>>>>>> Regards
>>>>>>>>> Per
>>>>>>>>>> On 03/15/2018 12:16 PM, Per Qvindesland via
FreeIPA-users wrote:
>>>>>>>>>>> Hi Florence
>>>>>>>>>>> First of all many thanks for responding to me
and the
>>>>>>>>>>> information.
>>>>>>>>>>> Step 1 adding eduPerson was not a problem but
when I tried
>>>>>>>>>>> to run
>>>>>>>>>>> ipa user-mod perq --addattr
"edupersontargetedid=value” it fails
>>>>>>>>>>> with the error ipa: ERROR: attribute
"edupersontargetedid"
>>>>>>>>>>> not allowed
>>>>>>>>>>> When I look in /var/log/messages the only
entry is - ERR -
>>>>>>>>>>> oc_check_allowed_sv - Entry
>>>>>>>>>>>
"uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" --
>>>>>>>>>>> attribute
>>>>>>>>>>> "edupersontargetedid" not allowed
>>>>>>>>>>> Any suggestions on how to resolve this?
>>>>>>>>>> Hi,
>>>>>>>>>>
>>>>>>>>>> the default object classes are applied to *new*
user entries only
>>>>>>>>>> (i.e users created after the default object
classes
>>>>>>>>>> modification).
>>>>>>>>>> So when you added eduPerson to the set of default
object classes,
>>>>>>>>>> the objectclasses for already existing user
entries were not
>>>>>>>>>> modified, hence the error.
>>>>>>>>>>
>>>>>>>>>> You will need to add eduPerson objectclass to the
existing
>>>>>>>>>> user entries:
>>>>>>>>>> ipa user-mod username --addattr
objectclass=eduPerson
>>>>>>>>>>
>>>>>>>>>> After this step you should be able to add the
edupersontargetedid
>>>>>>>>>> attribute.
>>>>>>>>>>
>>>>>>>>>> Hope this clarifies,
>>>>>>>>>> Flo
>>>>>>>>>>
>>>>>>>>>>> Regards
>>>>>>>>>>> Per
>>>>>>>>>>>> On 15 Mar 2018, at 10:31, Florence
Blanc-Renaud via
>>>>>>>>>>>> FreeIPA-users
>>>>>>>>>>>> <freeipa-users(a)lists.fedorahosted.org
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>>>> wrote:
>>>>>>>>>>>>
>>>>>>>>>>>> On 03/15/2018 10:40 AM, Per Qvindesland
via FreeIPA-users
>>>>>>>>>>>> wrote:
>>>>>>>>>>>>> Hi List
>>>>>>>>>>>>> We are currently busy implementing
freeipa with a saml idP
>>>>>>>>>>>>> but we
>>>>>>>>>>>>> noticed that we are missing the
following attributes:
>>>>>>>>>>>>> edupersontargetedid,
edupersonaffiliation, displayname,
>>>>>>>>>>>>> and mail.
>>>>>>>>>>>>> How can we add these attributes into
the freeipa server?
>>>>>>>>>>>>> Regards
>>>>>>>>>>>>> Per
>>>>>>>>>>>>>
_______________________________________________
>>>>>>>>>>>>> FreeIPA-users mailing list
>>>>>>>>>>>>> --
freeipa-users(a)lists.fedorahosted.org
>>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>> To unsubscribe send an email
>>>>>>>>>>>>> to
freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>> Hi,
>>>>>>>>>>>>
>>>>>>>>>>>> the attributes edupersontargetedid,
edupersonaffiliation,
>>>>>>>>>>>> displayname, and mail are already defined
in the LDAP
>>>>>>>>>>>> schema, so
>>>>>>>>>>>> you won't need to add them to the
schema.
>>>>>>>>>>>>
>>>>>>>>>>>> The edupersontargetedid and
edupersonaffiliation attributes are
>>>>>>>>>>>> part of the objectclass eduPerson.
>>>>>>>>>>>> The displayName and mail attributes are
part of the objectclass
>>>>>>>>>>>> inetorgperson.
>>>>>>>>>>>>
>>>>>>>>>>>> If you want to add these attributes to a
user entry, the user
>>>>>>>>>>>> entry needs to contain the relevant
objectclasses (by default,
>>>>>>>>>>>> FreeIPA users already contain the
inetorgperson
>>>>>>>>>>>> objectclass). You
>>>>>>>>>>>> will need to add the eduPerson
objectclass to the default user
>>>>>>>>>>>> object classes, by following the
instructions provided
>>>>>>>>>>>> here: [1]
>>>>>>>>>>>>
>>>>>>>>>>>> Then you will be able to add the
attributes to the new
>>>>>>>>>>>> users by doing:
>>>>>>>>>>>> ipa user-mod username --addattr
"edupersontargetedid=value"
>>>>>>>>>>>>
>>>>>>>>>>>> You may be interested in a description of
the LDAP schema,
>>>>>>>>>>>> available in 389-ds guide [2], in order
to understand what are
>>>>>>>>>>>> objectclasses and attribute types.
>>>>>>>>>>>>
>>>>>>>>>>>> HTH,
>>>>>>>>>>>> Flo
>>>>>>>>>>>>
>>>>>>>>>>>> [1]
>>>>>>>>>>>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>>>>>>>>>>>> [2]
>>>>>>>>>>>>
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
>>>>>>>>>>>>
_______________________________________________
>>>>>>>>>>>> FreeIPA-users mailing list --
>>>>>>>>>>>> freeipa-users(a)lists.fedorahosted.org
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>> To unsubscribe send an email
>>>>>>>>>>>> to
freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>
_______________________________________________
>>>>>>>>>>> FreeIPA-users mailing list
>>>>>>>>>>> --freeipa-users(a)lists.fedorahosted.org
>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>> To unsubscribe send an
>>>>>>>>>>> email
tofreeipa-users-leave(a)lists.fedorahosted.org
>>>>>>>>>>>
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>> _______________________________________________
>>>>>>>>> FreeIPA-users mailing list --
>>>>>>>>> freeipa-users(a)lists.fedorahosted.org
>>>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>> To unsubscribe send an email
>>>>>>>>> to freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> FreeIPA-users mailing list
>>>>>>> --freeipa-users(a)lists.fedorahosted.org
>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>> To unsubscribe send an email
>>>>>>> tofreeipa-users-leave(a)lists.fedorahosted.org
>>>>>>> <mailto:tofreeipa-users-leave@lists.fedorahosted.org>
>>>>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>> To unsubscribe send an email to
>>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>> To unsubscribe send an email to
>>> freeipa-users-leave(a)lists.fedorahosted.org
>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>
>> _______________________________________________
>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>
>> To unsubscribe send an email
>> tofreeipa-users-leave(a)lists.fedorahosted.org
>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org