Joseph Fry via FreeIPA-users wrote:

I support a product that natively supports ingesting computers from Active Directory via an LDAP query.

We are able to ingest users from FreeIPA (actually Redhat IDM) without a problem, but hosts cannot be ingested because the objectClass and attributes are different than what is used by ActiveDirectory.

Is there a simple solution in FreeIPA to have the host objects simulate an AD 'computer' object?

I don't really know much about AD but you may be able to configure cn=compat to provide a different view of the host objects. There is already a computers subtree which is meant to provide macaddress for NIS IIRC: https://pagure.io/freeipa/blob/master/f/install/updates/80-schema_compat.upd...

If you delete this dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config you could create a replacement. I'd recommend you experiment in a test install, of course.

Write a replacement update file (computers.update) like:

dn: cn=computers, cn=Schema Compatibility, cn=plugins, cn=config default:objectClass: top default:objectClass: extensibleObject default:cn: computers default:schema-compat-container-group: cn=compat, $SUFFIX default:schema-compat-container-rdn: cn=computers default:schema-compat-search-base: cn=computers, cn=accounts, $SUFFIX default:schema-compat-search-filter: (&(fqdn=*)(objectClass=ipaHost)) default:schema-compat-entry-rdn: cn=%first("%{fqdn}") default:schema-compat-entry-attribute: objectclass=computer default:schema-compat-entry-attribute: objectclass=[whatever you need] default:schema-compat-entry-attribute: cn=%{fqdn} default:schema-compat-entry-attribute: sAMAccountType=805306369

Like I said, I'm just guessing on some of this, but hopefully it will give you a starting point.

To see what the result looks like run:

ldapsearch -x -b cn=computers,cn=compat,dc=example,dc=test

To load this run as root: ipa-ldap-updater computers.update

You'll need to delete this entry again if you want to make changes. Or you can use ldapupdate if you prefer, but having the update file may be better documentation.

See ipa-ldap-updater(1) for more details on ipa-ldap-update syntax.

rob