On to, 15 maalis 2018, Per Qvindesland via FreeIPA-users wrote:
Hi List
We are currently busy implementing freeipa with a saml idP but we
noticed that we are missing the following attributes:
edupersontargetedid, edupersonaffiliation, displayname, and mail.
How can we add these attributes into the freeipa server?
It would help to see more
details on how you are configuring things.
1. displayname and mail are already part of IPA user account information
2. edupersontargetedid and edupersonaffiliation aren't part of IPA, so
you'd need to add them yourself.
Next part would be to see who is allowed to see these attributes.
Access to 'displayname' is part of 'System: Read User Standard
Attributes'
permission which allows anonymous access as wel. Access to 'mail'
attribute is regulated by 'System: Read User Addressbook Attributes'
which allows access to all authenticated users.
For your own attributes you'd need to create a plugin that adds
attributes and objectclasses to the schema and then adds methods to
manipulate these attributes in the IPA objects.
I have a demo plugin at
https://github.com/abbra/freeipa-userstatus-plugin that shows how to add
such attributes to a user object.
--
/ Alexander Bokovoy