On 03/15/2018 02:35 PM, Per Qvindesland via FreeIPA-users wrote:
Hi Florence
I did that added ipa user-mod perq --addattr objectclass=eduPerson which
went fine then ipa user-mod perq --addattr "edupersontargetedid=value”
but it still gives me the error ipa: ERROR: attribute
"edupersontargetedid" not allowed.
Looking into the logs and there is not much to go on, the same
error: ERR - oc_check_allowed_sv - Entry
"uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" -- attribute
"edupersontargetedid" not allowed but nothing else.
Hi,
I'm not able to reproduce your issue. Can you provide the output of
$ ipa user-show perq --all
At the end of the output you should find something like:
objectclass: top, person, posixaccount, krbprincipalaux,
krbticketpolicyaux,
inetuser, ipaobject, ipasshuser, ipaSshGroupOfPubKeys,
eduPerson
We need to make sure that eduPerson is listed in the objectclasses.
Then check that the schema definition for eduPerson properly includes
edupersontargetedid:
$ ldapsearch -x -b cn=schema -LLL -s base -o ldif-wrap=no objectclasses
| grep -i eduPerson
objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson' AUXILIARY MAY (
eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $
eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
eduPersonPrincipalName $ eduPersonEntitlement $
eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation $
eduPersonTargetedID $ eduPersonAssurance $ eduPersonPrincipalNamePrior $
eduPersonUniqueId $ eduPersonOrcid ) X-ORIGIN
'http://middleware.internet2.edu/eduperson/' )
Flo
Regards
Per
> On 03/15/2018 12:16 PM, Per Qvindesland via FreeIPA-users wrote:
>> Hi Florence
>> First of all many thanks for responding to me and the information.
>> Step 1 adding eduPerson was not a problem but when I tried to run ipa
>> user-mod perq --addattr "edupersontargetedid=value” it fails with the
>> error ipa: ERROR: attribute "edupersontargetedid" not allowed
>> When I look in /var/log/messages the only entry is - ERR -
>> oc_check_allowed_sv - Entry
>> "uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" -- attribute
>> "edupersontargetedid" not allowed
>> Any suggestions on how to resolve this?
> Hi,
>
> the default object classes are applied to *new* user entries only (i.e
> users created after the default object classes modification). So when
> you added eduPerson to the set of default object classes, the
> objectclasses for already existing user entries were not modified,
> hence the error.
>
> You will need to add eduPerson objectclass to the existing user entries:
> ipa user-mod username --addattr objectclass=eduPerson
>
> After this step you should be able to add the edupersontargetedid
> attribute.
>
> Hope this clarifies,
> Flo
>
>> Regards
>> Per
>>> On 15 Mar 2018, at 10:31, Florence Blanc-Renaud via FreeIPA-users
>>> <freeipa-users(a)lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>>>
>>> On 03/15/2018 10:40 AM, Per Qvindesland via FreeIPA-users wrote:
>>>> Hi List
>>>> We are currently busy implementing freeipa with a saml idP but we
>>>> noticed that we are missing the following attributes:
>>>> edupersontargetedid, edupersonaffiliation, displayname, and mail.
>>>> How can we add these attributes into the freeipa server?
>>>> Regards
>>>> Per
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>>> To unsubscribe send an email to
>>>> freeipa-users-leave(a)lists.fedorahosted.org
>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>>> Hi,
>>>
>>> the attributes edupersontargetedid, edupersonaffiliation,
>>> displayname, and mail are already defined in the LDAP schema, so you
>>> won't need to add them to the schema.
>>>
>>> The edupersontargetedid and edupersonaffiliation attributes are part
>>> of the objectclass eduPerson.
>>> The displayName and mail attributes are part of the objectclass
>>> inetorgperson.
>>>
>>> If you want to add these attributes to a user entry, the user entry
>>> needs to contain the relevant objectclasses (by default, FreeIPA
>>> users already contain the inetorgperson objectclass). You will need
>>> to add the eduPerson objectclass to the default user object classes,
>>> by following the instructions provided here: [1]
>>>
>>> Then you will be able to add the attributes to the new users by doing:
>>> ipa user-mod username --addattr "edupersontargetedid=value"
>>>
>>> You may be interested in a description of the LDAP schema, available
>>> in 389-ds guide [2], in order to understand what are objectclasses
>>> and attribute types.
>>>
>>> HTH,
>>> Flo
>>>
>>> [1]
>>>
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>>> [2]
>>>
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> <mailto:freeipa-users@lists.fedorahosted.org>
>>> To unsubscribe send an email to
>>> freeipa-users-leave(a)lists.fedorahosted.org
>>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
>> _______________________________________________
>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
>> <mailto:freeipa-users@lists.fedorahosted.org>
>> To unsubscribe send an email
>> tofreeipa-users-leave(a)lists.fedorahosted.org
>> <mailto:freeipa-users-leave@lists.fedorahosted.org>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org