Hi Florence
ipa user-show perq —all gives:
objectclass: top, person, organizationalperson, inetorgperson,
inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux,
ipaobject, ipasshuser, ipaSshGroupOfPubKeys,
mepOriginEntry, eduPerson
And ldapsearch -x -b cn=schema -LLL -s base -o ldif-wrap=no
objectclasses | grep -i eduPerson gives:
objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson' AUXILIARY MAY (
eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $
eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
eduPersonPrincipalName $ eduPersonEntitlement $
eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation ) X-ORIGIN
'http://middleware.internet2.edu/eduperson/‘ )
edupersontargetedid is not an attribute in the objectclass. I don't have
it defined in the schema on my server at all (though I have a similar if
not the same eduPerson).
rob
So eduperson is listed, seems a bit odd that it then doesn’t work.
Regards
Per
> On 15 Mar 2018, at 16:22, Florence Blanc-Renaud <flo(a)redhat.com
> <mailto:flo@redhat.com>> wrote:
>
> On 03/15/2018 02:35 PM, Per Qvindesland via FreeIPA-users wrote:
>> Hi Florence
>> I did that added ipa user-mod perq --addattr objectclass=eduPerson
>> which went fine then ipa user-mod perq --addattr
>> "edupersontargetedid=value” but it still gives me the error ipa:
>> ERROR: attribute "edupersontargetedid" not allowed.
>> Looking into the logs and there is not much to go on, the same
>> error: ERR - oc_check_allowed_sv - Entry
>> "uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" -- attribute
>> "edupersontargetedid" not allowed but nothing else.
> Hi,
>
> I'm not able to reproduce your issue. Can you provide the output of
> $ ipa user-show perq --all
>
> At the end of the output you should find something like:
> objectclass: top, person, posixaccount, krbprincipalaux,
> krbticketpolicyaux,
> inetuser, ipaobject, ipasshuser, ipaSshGroupOfPubKeys,
> eduPerson
>
> We need to make sure that eduPerson is listed in the objectclasses.
>
> Then check that the schema definition for eduPerson properly includes
> edupersontargetedid:
> $ ldapsearch -x -b cn=schema -LLL -s base -o ldif-wrap=no
> objectclasses | grep -i eduPerson
> objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson' AUXILIARY MAY
> ( eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $
> eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
> eduPersonPrincipalName $ eduPersonEntitlement $
> eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation $
> eduPersonTargetedID $ eduPersonAssurance $ eduPersonPrincipalNamePrior
> $ eduPersonUniqueId $ eduPersonOrcid ) X-ORIGIN
> 'http://middleware.internet2.edu/eduperson/' )
>
> Flo
>
>> Regards
>> Per
>>> On 03/15/2018 12:16 PM, Per Qvindesland via FreeIPA-users wrote:
>>>> Hi Florence
>>>> First of all many thanks for responding to me and the information.
>>>> Step 1 adding eduPerson was not a problem but when I tried to run
>>>> ipa user-mod perq --addattr "edupersontargetedid=value” it fails
>>>> with the error ipa: ERROR: attribute "edupersontargetedid" not
allowed
>>>> When I look in /var/log/messages the only entry is - ERR -
>>>> oc_check_allowed_sv - Entry
>>>> "uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" --
attribute
>>>> "edupersontargetedid" not allowed
>>>> Any suggestions on how to resolve this?
>>> Hi,
>>>
>>> the default object classes are applied to *new* user entries only
>>> (i.e users created after the default object classes modification).
>>> So when you added eduPerson to the set of default object classes,
>>> the objectclasses for already existing user entries were not
>>> modified, hence the error.
>>>
>>> You will need to add eduPerson objectclass to the existing user entries:
>>> ipa user-mod username --addattr objectclass=eduPerson
>>>
>>> After this step you should be able to add the edupersontargetedid
>>> attribute.
>>>
>>> Hope this clarifies,
>>> Flo
>>>
>>>> Regards
>>>> Per
>>>>> On 15 Mar 2018, at 10:31, Florence Blanc-Renaud via FreeIPA-users
>>>>> <freeipa-users(a)lists.fedorahosted.org
>>>>>
<mailto:freeipa-users@lists.fedorahosted.org> <mailto:freeipa-users@lists.fedorahosted.org>>
>>>>> wrote:
>>>>>
>>>>> On 03/15/2018 10:40 AM, Per Qvindesland via FreeIPA-users wrote:
>>>>>> Hi List
>>>>>> We are currently busy implementing freeipa with a saml idP but
we
>>>>>> noticed that we are missing the following attributes:
>>>>>> edupersontargetedid, edupersonaffiliation, displayname, and
mail.
>>>>>> How can we add these attributes into the freeipa server?
>>>>>> Regards
>>>>>> Per
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list
>>>>>> -- freeipa-users(a)lists.fedorahosted.org
>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>> To unsubscribe send an email
>>>>>> to freeipa-users-leave(a)lists.fedorahosted.org
>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>> Hi,
>>>>>
>>>>> the attributes edupersontargetedid, edupersonaffiliation,
>>>>> displayname, and mail are already defined in the LDAP schema, so
>>>>> you won't need to add them to the schema.
>>>>>
>>>>> The edupersontargetedid and edupersonaffiliation attributes are
>>>>> part of the objectclass eduPerson.
>>>>> The displayName and mail attributes are part of the objectclass
>>>>> inetorgperson.
>>>>>
>>>>> If you want to add these attributes to a user entry, the user
>>>>> entry needs to contain the relevant objectclasses (by default,
>>>>> FreeIPA users already contain the inetorgperson objectclass). You
>>>>> will need to add the eduPerson objectclass to the default user
>>>>> object classes, by following the instructions provided here: [1]
>>>>>
>>>>> Then you will be able to add the attributes to the new users by
doing:
>>>>> ipa user-mod username --addattr
"edupersontargetedid=value"
>>>>>
>>>>> You may be interested in a description of the LDAP schema,
>>>>> available in 389-ds guide [2], in order to understand what are
>>>>> objectclasses and attribute types.
>>>>>
>>>>> HTH,
>>>>> Flo
>>>>>
>>>>>
[
1] https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux...
>>>>>
[
2] https://access.redhat.com/documentation/en-us/red_hat_directory_server...
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>>>
<mailto:freeipa-users@lists.fedorahosted.org> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>> To unsubscribe send an email
>>>>> to freeipa-users-leave(a)lists.fedorahosted.org
>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>> _______________________________________________
>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>>>>
<mailto:freeipa-users@lists.fedorahosted.org> <mailto:freeipa-users@lists.fedorahosted.org>
>>>> To unsubscribe send an
>>>> email tofreeipa-users-leave(a)lists.fedorahosted.org
>>>>
<mailto:tofreeipa-users-leave@lists.fedorahosted.org> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>
>> To unsubscribe send an email
>> to freeipa-users-leave(a)lists.fedorahosted.org
>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org