On ma, 28 kesä 2021, Joseph Fry via FreeIPA-users wrote:
Perfect, thanks!
Just curious... Can you explain why %deref_r works in this line, but
just a plain %deref does't? default:schema-compat-entry-attribute:
member=cn=%deref_r("member","fqdn"),cn=adcomputers,cn=compat,$SUFFIX
Essentially I am just taking the fqdn of the ipahost member attribute
and inserting inline to form:
cn=<fqdn>,cn=adcomputers,cn=compat,dc=lab,dc=local
Doing member=%deref("member","fqdn") by itself returned all of the
values I needed, but when I tried to use it within a string I got no
member attribute at all.
I see nothing in the documentation that explains the difference in the
output, only a difference in how the return values are determined.
Apparently I just got lucky that %deref_r did what I wanted, as I don't
suspect that it was intended to work that differently than %deref
(based on the documentation).
%deref() looks for directly referenced entries' content. %deref_r()
chases all links by the attribute until the end. It allows you do
hierarchical group traversal. This is all described in the
format-specifiers.txt documentation.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland