Joseph Fry via FreeIPA-users wrote:
I support a product that natively supports ingesting computers from
Active Directory via an LDAP query.
We are able to ingest users from FreeIPA (actually Redhat IDM) without a problem, but
hosts cannot be ingested because the objectClass and attributes are different than what is
used by ActiveDirectory.
Is there a simple solution in FreeIPA to have the host objects simulate an AD
'computer' object?
I don't really know much about AD but you may be able to configure
cn=compat to provide a different view of the host objects.
There is already a computers subtree which is meant to provide
macaddress for NIS IIRC:
https://pagure.io/freeipa/blob/master/f/install/updates/80-schema_compat....
If you delete this dn: cn=computers, cn=Schema Compatibility,
cn=plugins, cn=config you could create a replacement. I'd recommend you
experiment in a test install, of course.
Write a replacement update file (computers.update) like:
dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config
default:objectClass: top
default:objectClass: extensibleObject
default:cn: computers
default:schema-compat-container-group: cn=compat, $SUFFIX
default:schema-compat-container-rdn: cn=computers
default:schema-compat-search-base: cn=computers, cn=accounts, $SUFFIX
default:schema-compat-search-filter: (&(fqdn=*)(objectClass=ipaHost))
default:schema-compat-entry-rdn: cn=%first("%{fqdn}")
default:schema-compat-entry-attribute: objectclass=computer
default:schema-compat-entry-attribute: objectclass=[whatever you need]
default:schema-compat-entry-attribute: cn=%{fqdn}
default:schema-compat-entry-attribute: sAMAccountType=805306369
Like I said, I'm just guessing on some of this, but hopefully it will
give you a starting point.
To see what the result looks like run:
ldapsearch -x -b cn=computers,cn=compat,dc=example,dc=test
To load this run as root: ipa-ldap-updater computers.update
You'll need to delete this entry again if you want to make changes. Or
you can use ldapupdate if you prefer, but having the update file may be
better documentation.
See ipa-ldap-updater(1) for more details on ipa-ldap-update syntax.
rob