First, be aware that the attributes available depend upon the type of object. 
E.g. a person can have a telephone number, but a host can't. Assuming you have 
a kerberos credential, you can do ldap queries using ldapsearch. (You may need 
to install openldap clients for that to be present.)

E.g. to look up my entry:

ldapsearch -Y GSSAPI -h -b dc=cs,dc=rutgers,dc=edu 

obviously is our hostname. Use your. And 
dc=cs,dc=rutgers,dc=edu is for our domain, which is CS.RUTGERS.EDU. You'll need 
to use yours.

If you look up your entry, you'll see that a lot of the lines are for 
"objectclass." For a person it's typically things like person and 
inetOrgPerson. Each objectclass has certain attributes that are legal. So a 
person entry can have any of the attributes associated with any of its 
objectclasses. To see all available object classes, and the atrributes they 
allow, do

ldapsearch -Y GSSAPI -h -b cn=schema objectclass="*" 

The legal atttributes are may or must, depending upon whether they're mandatory 
or optional.

If you see an attribute you'd like for your users, but the object class that 
has it isn't assigned, to people, you can add it. E.g. the following commands 
add an objectclass hostObject to all users and groups. The objectclass 
hostObject has an attribute host. So this lets us associate hosts with both 
people and groups. The permission-mod commands allow people who can modify 
people and groups to be able to modify those attributes.

ipa config-mod --addattr=ipaUserObjectClasses=hostObject
ipa config-mod --addattr=ipaGroupObjectClasses=hostObject
ipa permission-mod "System: Read User Standard Attributes" --includedattrs=host
ipa permission-mod "System: Read Groups" --includedattrs=host
ipa permission-mod "System: Modify Groups" --includedattrs=host
ipa permission-mod "System: Modify Users" --includedattrs=host

You can create new objectclasses and groups, but it's a bit more complex.
FreeIPA-users mailing list --
To unsubscribe send an email to

Reply via email to