Hi
I’m on centos 7 and I just did a yum update and I see:
389-ds-base x86_64 1.3.6.1-26.el7_4
updates 1.7 M
389-ds-base-libs x86_64 1.3.6.1-26.el7_4
updates 681 k
I updated and tried ipa user-mod perq --addattr "edupersontargetedid=value” again but
with the same results, so it looks like I need the same version.
Any idea when it will be released for Centos 7?
Regards
Per
On 16 Mar 2018, at 18:10, Rob Crittenden via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
Per Qvindesland via FreeIPA-users wrote:
> HI
>
> So what can I do?
Flo is right, it is there in 389-ds-base-1.3.7.9-1.fc27. I was looking
in the old schema directory. The attribute should be there.
rob
>
> Regards
> Per
>
>
>
>> On 16 Mar 2018, at 09:43, Florence Blanc-Renaud <flo(a)redhat.com> wrote:
>>
>> On 03/16/2018 09:46 AM, Per Qvindesland via FreeIPA-users wrote:
>>> Hi
>>> Ok so how would I go about creating it?
>>> Regards
>>> Per
>> Hi,
>>
>> it seems we don't have the same 389-ds-base version. In my version, the
schema for eduPerson was updated (see ticket
https://pagure.io/389-ds-base/issue/49248). I
am using 389-ds-base.x86_64 1.3.7.9-1.fc27
>>
>> Flo
>>>> On 15 Mar 2018, at 22:06, Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>> wrote:
>>>>
>>>> Per Qvindesland via FreeIPA-users wrote:
>>>>> Hi Florence
>>>>>
>>>>> ipa user-show perq —all gives:
>>>>> objectclass: top, person, organizationalperson, inetorgperson,
>>>>> inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux,
>>>>> ipaobject, ipasshuser, ipaSshGroupOfPubKeys,
>>>>> mepOriginEntry, eduPerson
>>>>>
>>>>> And ldapsearch -x -b cn=schema -LLL -s base -o ldif-wrap=no
>>>>> objectclasses | grep -i eduPerson gives:
>>>>> objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson'
AUXILIARY MAY (
>>>>> eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $
>>>>> eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
>>>>> eduPersonPrincipalName $ eduPersonEntitlement $
>>>>> eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation ) X-ORIGIN
>>>>> 'http://middleware.internet2.edu/eduperson/‘
<
http://middleware.internet2.edu/eduperson/%E2%80%98>)
>>>>
>>>> edupersontargetedid is not an attribute in the objectclass. I don't
have
>>>> it defined in the schema on my server at all (though I have a similar if
>>>> not the same eduPerson).
>>>>
>>>> rob
>>>>
>>>>>
>>>>> So eduperson is listed, seems a bit odd that it then doesn’t work.
>>>>>
>>>>> Regards
>>>>> Per
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>> On 15 Mar 2018, at 16:22, Florence Blanc-Renaud
<flo(a)redhat.com <mailto:flo@redhat.com>
>>>>>> <mailto:flo@redhat.com>> wrote:
>>>>>>
>>>>>> On 03/15/2018 02:35 PM, Per Qvindesland via FreeIPA-users wrote:
>>>>>>> Hi Florence
>>>>>>> I did that added ipa user-mod perq --addattr
objectclass=eduPerson
>>>>>>> which went fine then ipa user-mod perq --addattr
>>>>>>> "edupersontargetedid=value” but it still gives me the
error ipa:
>>>>>>> ERROR: attribute "edupersontargetedid" not
allowed.
>>>>>>> Looking into the logs and there is not much to go on, the
same
>>>>>>> error: ERR - oc_check_allowed_sv - Entry
>>>>>>>
"uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" -- attribute
>>>>>>> "edupersontargetedid" not allowed but nothing
else.
>>>>>> Hi,
>>>>>>
>>>>>> I'm not able to reproduce your issue. Can you provide the
output of
>>>>>> $ ipa user-show perq --all
>>>>>>
>>>>>> At the end of the output you should find something like:
>>>>>> objectclass: top, person, posixaccount, krbprincipalaux,
>>>>>> krbticketpolicyaux,
>>>>>> inetuser, ipaobject, ipasshuser,
ipaSshGroupOfPubKeys,
>>>>>> eduPerson
>>>>>>
>>>>>> We need to make sure that eduPerson is listed in the
objectclasses.
>>>>>>
>>>>>> Then check that the schema definition for eduPerson properly
includes
>>>>>> edupersontargetedid:
>>>>>> $ ldapsearch -x -b cn=schema -LLL -s base -o ldif-wrap=no
>>>>>> objectclasses | grep -i eduPerson
>>>>>> objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson'
AUXILIARY MAY
>>>>>> ( eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $
>>>>>> eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
>>>>>> eduPersonPrincipalName $ eduPersonEntitlement $
>>>>>> eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation $
>>>>>> eduPersonTargetedID $ eduPersonAssurance $
eduPersonPrincipalNamePrior
>>>>>> $ eduPersonUniqueId $ eduPersonOrcid ) X-ORIGIN
>>>>>> 'http://middleware.internet2.edu/eduperson/' )
>>>>>>
>>>>>> Flo
>>>>>>
>>>>>>> Regards
>>>>>>> Per
>>>>>>>> On 03/15/2018 12:16 PM, Per Qvindesland via FreeIPA-users
wrote:
>>>>>>>>> Hi Florence
>>>>>>>>> First of all many thanks for responding to me and the
information.
>>>>>>>>> Step 1 adding eduPerson was not a problem but when I
tried to run
>>>>>>>>> ipa user-mod perq --addattr
"edupersontargetedid=value” it fails
>>>>>>>>> with the error ipa: ERROR: attribute
"edupersontargetedid" not allowed
>>>>>>>>> When I look in /var/log/messages the only entry is -
ERR -
>>>>>>>>> oc_check_allowed_sv - Entry
>>>>>>>>>
"uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" -- attribute
>>>>>>>>> "edupersontargetedid" not allowed
>>>>>>>>> Any suggestions on how to resolve this?
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> the default object classes are applied to *new* user
entries only
>>>>>>>> (i.e users created after the default object classes
modification).
>>>>>>>> So when you added eduPerson to the set of default object
classes,
>>>>>>>> the objectclasses for already existing user entries were
not
>>>>>>>> modified, hence the error.
>>>>>>>>
>>>>>>>> You will need to add eduPerson objectclass to the
existing user entries:
>>>>>>>> ipa user-mod username --addattr objectclass=eduPerson
>>>>>>>>
>>>>>>>> After this step you should be able to add the
edupersontargetedid
>>>>>>>> attribute.
>>>>>>>>
>>>>>>>> Hope this clarifies,
>>>>>>>> Flo
>>>>>>>>
>>>>>>>>> Regards
>>>>>>>>> Per
>>>>>>>>>> On 15 Mar 2018, at 10:31, Florence Blanc-Renaud
via FreeIPA-users
>>>>>>>>>> <freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>> wrote:
>>>>>>>>>>
>>>>>>>>>> On 03/15/2018 10:40 AM, Per Qvindesland via
FreeIPA-users wrote:
>>>>>>>>>>> Hi List
>>>>>>>>>>> We are currently busy implementing freeipa
with a saml idP but we
>>>>>>>>>>> noticed that we are missing the following
attributes:
>>>>>>>>>>> edupersontargetedid, edupersonaffiliation,
displayname, and mail.
>>>>>>>>>>> How can we add these attributes into the
freeipa server?
>>>>>>>>>>> Regards
>>>>>>>>>>> Per
>>>>>>>>>>>
_______________________________________________
>>>>>>>>>>> FreeIPA-users mailing list
>>>>>>>>>>> -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>> To unsubscribe send an email
>>>>>>>>>>> to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>> Hi,
>>>>>>>>>>
>>>>>>>>>> the attributes edupersontargetedid,
edupersonaffiliation,
>>>>>>>>>> displayname, and mail are already defined in the
LDAP schema, so
>>>>>>>>>> you won't need to add them to the schema.
>>>>>>>>>>
>>>>>>>>>> The edupersontargetedid and edupersonaffiliation
attributes are
>>>>>>>>>> part of the objectclass eduPerson.
>>>>>>>>>> The displayName and mail attributes are part of
the objectclass
>>>>>>>>>> inetorgperson.
>>>>>>>>>>
>>>>>>>>>> If you want to add these attributes to a user
entry, the user
>>>>>>>>>> entry needs to contain the relevant objectclasses
(by default,
>>>>>>>>>> FreeIPA users already contain the inetorgperson
objectclass). You
>>>>>>>>>> will need to add the eduPerson objectclass to the
default user
>>>>>>>>>> object classes, by following the instructions
provided here: [1]
>>>>>>>>>>
>>>>>>>>>> Then you will be able to add the attributes to
the new users by doing:
>>>>>>>>>> ipa user-mod username --addattr
"edupersontargetedid=value"
>>>>>>>>>>
>>>>>>>>>> You may be interested in a description of the
LDAP schema,
>>>>>>>>>> available in 389-ds guide [2], in order to
understand what are
>>>>>>>>>> objectclasses and attribute types.
>>>>>>>>>>
>>>>>>>>>> HTH,
>>>>>>>>>> Flo
>>>>>>>>>>
>>>>>>>>>> [1]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>>>>>>>>>> [2]
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
>>>>>>>>>> _______________________________________________
>>>>>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>>> To unsubscribe send an email
>>>>>>>>>> to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>> _______________________________________________
>>>>>>>>> FreeIPA-users mailing list
--freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>>>> To unsubscribe send an
>>>>>>>>> email tofreeipa-users-leave(a)lists.fedorahosted.org
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>
>>>>>>>>>
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>> _______________________________________________
>>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>>>>> To unsubscribe send an email
>>>>>>> to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>>>
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>>>> To unsubscribe send an email
tofreeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>