It's not clear in the API or python-freeapi module that all is a keyword
argument, so all=true solves my first problem.
I added the objectclasses _before_ users were created using a python import
script, which keeps their attributes up-to-date.
I added the objectclasses using the following method:
git clone https://github.com/nesi/auEduPerson.git
chown dirsrv:dirsrv /etc/dirsrv/slapd-MY-ORG/schema/60aueduperson.ldif
Though, I did not do the last line using the CLI, but used the web UI to set
objectclasses so that I didn't drop any by missing them out of the list.
From: Alexander Bokovoy [mailto:aboko...@redhat.com]
Sent: Friday, 3 November 2017 7:10 PM
To: FreeIPA users list <email@example.com>
Cc: Aaron Hicks <aaron.hi...@nesi.org.nz>
Subject: Re: [Freeipa-users] Searching for user by extended attribute
On pe, 03 marras 2017, Aaron Hicks via FreeIPA-users wrote:
>We've added two objectclasses to the default user in our FreeIPA instance.
>We're able to set and modify them fine, however we need two additional
>We need two additional attributes auedupersonsharedtoken and
>edupersonprinciplename to be included in the user attributes when
>executing user-find with the python-freeipa module. It works fine from
>the command line by adding the --all argument, but there's no
>equivalent to --all the python-freeipa module.
It is all there.
$ ipa console
(Custom IPA interactive Python console)
>We need to be able to user-find to search for users by these
>attributes, both from the command line and the python-freeipa module.
>There does not seem to be an equivalent of the --setattr command on the
>find function to search by attributes provided by additional objectclass
This is a bit different. You need to make sure you injected those attributes
into existing object definitions if you want to see them used by the
Can you show a code you use to extend IPA classes?
/ Alexander Bokovoy
FreeIPA-users mailing list -- firstname.lastname@example.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org