Hi
I installed the latest Fedora and the latest Freeipa version so the attributes are there
now.
But what we noticed today is when the users are created the attributes
edupersontargetedid, edupersonaffiliation and mail is not added to the new user accounts
automatically, how can we get ipa to add the attributes on user creation?
Regards
Per
On 16 Mar 2018, at 19:24, Per Qvindesland <perq(a)me.com> wrote:
Hi
I’m on centos 7 and I just did a yum update and I see:
389-ds-base x86_64 1.3.6.1-26.el7_4
updates 1.7 M
389-ds-base-libs x86_64 1.3.6.1-26.el7_4
updates 681 k
I updated and tried ipa user-mod perq --addattr "edupersontargetedid=value” again
but with the same results, so it looks like I need the same version.
Any idea when it will be released for Centos 7?
Regards
Per
> On 16 Mar 2018, at 18:10, Rob Crittenden via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>
> Per Qvindesland via FreeIPA-users wrote:
>> HI
>>
>> So what can I do?
>
> Flo is right, it is there in 389-ds-base-1.3.7.9-1.fc27. I was looking
> in the old schema directory. The attribute should be there.
>
> rob
>
>>
>> Regards
>> Per
>>
>>
>>
>>> On 16 Mar 2018, at 09:43, Florence Blanc-Renaud <flo(a)redhat.com
<mailto:flo@redhat.com>> wrote:
>>>
>>> On 03/16/2018 09:46 AM, Per Qvindesland via FreeIPA-users wrote:
>>>> Hi
>>>> Ok so how would I go about creating it?
>>>> Regards
>>>> Per
>>> Hi,
>>>
>>> it seems we don't have the same 389-ds-base version. In my version, the
schema for eduPerson was updated (see ticket
https://pagure.io/389-ds-base/issue/49248
<
https://pagure.io/389-ds-base/issue/49248>). I am using 389-ds-base.x86_64
1.3.7.9-1.fc27
>>>
>>> Flo
>>>>> On 15 Mar 2018, at 22:06, Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com> <mailto:rcritten@redhat.com
<mailto:rcritten@redhat.com>>> wrote:
>>>>>
>>>>> Per Qvindesland via FreeIPA-users wrote:
>>>>>> Hi Florence
>>>>>>
>>>>>> ipa user-show perq —all gives:
>>>>>> objectclass: top, person, organizationalperson, inetorgperson,
>>>>>> inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux,
>>>>>> ipaobject, ipasshuser, ipaSshGroupOfPubKeys,
>>>>>> mepOriginEntry, eduPerson
>>>>>>
>>>>>> And ldapsearch -x -b cn=schema -LLL -s base -o ldif-wrap=no
>>>>>> objectclasses | grep -i eduPerson gives:
>>>>>> objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME 'eduPerson'
AUXILIARY MAY (
>>>>>> eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN $
>>>>>> eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
>>>>>> eduPersonPrincipalName $ eduPersonEntitlement $
>>>>>> eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation )
X-ORIGIN
>>>>>> 'http://middleware.internet2.edu/eduperson/‘
<
http://middleware.internet2.edu/eduperson/%E2%80%98>
<
http://middleware.internet2.edu/eduperson/%E2%80%98
<
http://middleware.internet2.edu/eduperson/%E2%80%98>>)
>>>>>
>>>>> edupersontargetedid is not an attribute in the objectclass. I
don't have
>>>>> it defined in the schema on my server at all (though I have a similar
if
>>>>> not the same eduPerson).
>>>>>
>>>>> rob
>>>>>
>>>>>>
>>>>>> So eduperson is listed, seems a bit odd that it then doesn’t
work.
>>>>>>
>>>>>> Regards
>>>>>> Per
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>> On 15 Mar 2018, at 16:22, Florence Blanc-Renaud
<flo(a)redhat.com <mailto:flo@redhat.com> <mailto:flo@redhat.com
<mailto:flo@redhat.com>>
>>>>>>> <mailto:flo@redhat.com
<mailto:flo@redhat.com>>> wrote:
>>>>>>>
>>>>>>> On 03/15/2018 02:35 PM, Per Qvindesland via FreeIPA-users
wrote:
>>>>>>>> Hi Florence
>>>>>>>> I did that added ipa user-mod perq --addattr
objectclass=eduPerson
>>>>>>>> which went fine then ipa user-mod perq --addattr
>>>>>>>> "edupersontargetedid=value” but it still gives me
the error ipa:
>>>>>>>> ERROR: attribute "edupersontargetedid" not
allowed.
>>>>>>>> Looking into the logs and there is not much to go on, the
same
>>>>>>>> error: ERR - oc_check_allowed_sv - Entry
>>>>>>>>
"uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" -- attribute
>>>>>>>> "edupersontargetedid" not allowed but nothing
else.
>>>>>>> Hi,
>>>>>>>
>>>>>>> I'm not able to reproduce your issue. Can you provide the
output of
>>>>>>> $ ipa user-show perq --all
>>>>>>>
>>>>>>> At the end of the output you should find something like:
>>>>>>> objectclass: top, person, posixaccount, krbprincipalaux,
>>>>>>> krbticketpolicyaux,
>>>>>>> inetuser, ipaobject, ipasshuser,
ipaSshGroupOfPubKeys,
>>>>>>> eduPerson
>>>>>>>
>>>>>>> We need to make sure that eduPerson is listed in the
objectclasses.
>>>>>>>
>>>>>>> Then check that the schema definition for eduPerson properly
includes
>>>>>>> edupersontargetedid:
>>>>>>> $ ldapsearch -x -b cn=schema -LLL -s base -o ldif-wrap=no
>>>>>>> objectclasses | grep -i eduPerson
>>>>>>> objectclasses: ( 1.3.6.1.4.1.5923.1.1.2 NAME
'eduPerson' AUXILIARY MAY
>>>>>>> ( eduPersonAffiliation $ eduPersonNickName $ eduPersonOrgDN
$
>>>>>>> eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $
>>>>>>> eduPersonPrincipalName $ eduPersonEntitlement $
>>>>>>> eduPersonPrimaryOrgUnitDN $ eduPersonScopedAffiliation $
>>>>>>> eduPersonTargetedID $ eduPersonAssurance $
eduPersonPrincipalNamePrior
>>>>>>> $ eduPersonUniqueId $ eduPersonOrcid ) X-ORIGIN
>>>>>>> 'http://middleware.internet2.edu/eduperson/
<
http://middleware.internet2.edu/eduperson/>' )
>>>>>>>
>>>>>>> Flo
>>>>>>>
>>>>>>>> Regards
>>>>>>>> Per
>>>>>>>>> On 03/15/2018 12:16 PM, Per Qvindesland via
FreeIPA-users wrote:
>>>>>>>>>> Hi Florence
>>>>>>>>>> First of all many thanks for responding to me and
the information.
>>>>>>>>>> Step 1 adding eduPerson was not a problem but
when I tried to run
>>>>>>>>>> ipa user-mod perq --addattr
"edupersontargetedid=value” it fails
>>>>>>>>>> with the error ipa: ERROR: attribute
"edupersontargetedid" not allowed
>>>>>>>>>> When I look in /var/log/messages the only entry
is - ERR -
>>>>>>>>>> oc_check_allowed_sv - Entry
>>>>>>>>>>
"uid=perq,cn=users,cn=accounts,dc=domain,dc=ac,dc=uk" -- attribute
>>>>>>>>>> "edupersontargetedid" not allowed
>>>>>>>>>> Any suggestions on how to resolve this?
>>>>>>>>> Hi,
>>>>>>>>>
>>>>>>>>> the default object classes are applied to *new* user
entries only
>>>>>>>>> (i.e users created after the default object classes
modification).
>>>>>>>>> So when you added eduPerson to the set of default
object classes,
>>>>>>>>> the objectclasses for already existing user entries
were not
>>>>>>>>> modified, hence the error.
>>>>>>>>>
>>>>>>>>> You will need to add eduPerson objectclass to the
existing user entries:
>>>>>>>>> ipa user-mod username --addattr
objectclass=eduPerson
>>>>>>>>>
>>>>>>>>> After this step you should be able to add the
edupersontargetedid
>>>>>>>>> attribute.
>>>>>>>>>
>>>>>>>>> Hope this clarifies,
>>>>>>>>> Flo
>>>>>>>>>
>>>>>>>>>> Regards
>>>>>>>>>> Per
>>>>>>>>>>> On 15 Mar 2018, at 10:31, Florence
Blanc-Renaud via FreeIPA-users
>>>>>>>>>>> <freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>>
>>>>>>>>>>> wrote:
>>>>>>>>>>>
>>>>>>>>>>> On 03/15/2018 10:40 AM, Per Qvindesland via
FreeIPA-users wrote:
>>>>>>>>>>>> Hi List
>>>>>>>>>>>> We are currently busy implementing
freeipa with a saml idP but we
>>>>>>>>>>>> noticed that we are missing the following
attributes:
>>>>>>>>>>>> edupersontargetedid,
edupersonaffiliation, displayname, and mail.
>>>>>>>>>>>> How can we add these attributes into the
freeipa server?
>>>>>>>>>>>> Regards
>>>>>>>>>>>> Per
>>>>>>>>>>>>
_______________________________________________
>>>>>>>>>>>> FreeIPA-users mailing list
>>>>>>>>>>>> -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>>>> To unsubscribe send an email
>>>>>>>>>>>> to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>>>>>>> Hi,
>>>>>>>>>>>
>>>>>>>>>>> the attributes edupersontargetedid,
edupersonaffiliation,
>>>>>>>>>>> displayname, and mail are already defined in
the LDAP schema, so
>>>>>>>>>>> you won't need to add them to the
schema.
>>>>>>>>>>>
>>>>>>>>>>> The edupersontargetedid and
edupersonaffiliation attributes are
>>>>>>>>>>> part of the objectclass eduPerson.
>>>>>>>>>>> The displayName and mail attributes are part
of the objectclass
>>>>>>>>>>> inetorgperson.
>>>>>>>>>>>
>>>>>>>>>>> If you want to add these attributes to a user
entry, the user
>>>>>>>>>>> entry needs to contain the relevant
objectclasses (by default,
>>>>>>>>>>> FreeIPA users already contain the
inetorgperson objectclass). You
>>>>>>>>>>> will need to add the eduPerson objectclass to
the default user
>>>>>>>>>>> object classes, by following the instructions
provided here: [1]
>>>>>>>>>>>
>>>>>>>>>>> Then you will be able to add the attributes
to the new users by doing:
>>>>>>>>>>> ipa user-mod username --addattr
"edupersontargetedid=value"
>>>>>>>>>>>
>>>>>>>>>>> You may be interested in a description of the
LDAP schema,
>>>>>>>>>>> available in 389-ds guide [2], in order to
understand what are
>>>>>>>>>>> objectclasses and attribute types.
>>>>>>>>>>>
>>>>>>>>>>> HTH,
>>>>>>>>>>> Flo
>>>>>>>>>>>
>>>>>>>>>>> [1]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
<
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
>>>>>>>>>>> [2]
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
<
https://access.redhat.com/documentation/en-us/red_hat_directory_server/10...
>>>>>>>>>>>
_______________________________________________
>>>>>>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>>>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>>> To unsubscribe send an email
>>>>>>>>>>> to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>>>>>>>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>>>>>> _______________________________________________
>>>>>>>>>> FreeIPA-users mailing list
--freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>>>> To unsubscribe send an
>>>>>>>>>> email
tofreeipa-users-leave(a)lists.fedorahosted.org
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>
<mailto:tofreeipa-users-leave@lists.fedorahosted.org
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>>
>>>>>>>>>>
<mailto:tofreeipa-users-leave@lists.fedorahosted.org
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>>>> _______________________________________________
>>>>>>>> FreeIPA-users mailing list --
freeipa-users(a)lists.fedorahosted.org <mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>> <mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>>>> To unsubscribe send an email
>>>>>>>> to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>>>> <mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> FreeIPA-users mailing list --freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
<mailto:freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>>
>>>>>> To unsubscribe send an email
tofreeipa-users-leave(a)lists.fedorahosted.org
<mailto:tofreeipa-users-leave@lists.fedorahosted.org>
<mailto:freeipa-users-leave@lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>>
>>>> _______________________________________________
>>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>>>> To unsubscribe send an email to
freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>
>>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
<mailto:freeipa-users-leave@lists.fedorahosted.org>