White, Daniel E. (GSFC-770.0)[NICS] wrote: > Finally found a reference: > https://docs.microfocus.com/itom/Network_Node_Manager_i:10.50/Administer/NNMi_Deployment/Advanced_Configurations/Deploy_LDAP#Task5 > > > > <roleSearch> > > > > Placeholder element to include the user role information. > > <roleBase>/member/={1}</roleBase> > > > > Replace /member/ with the name of the group attribute that stores the > directory service user ID in the directory service domain. > > <roleContextDN> > > </roleContextDN> > > > > Specify the portion of the directory service domain that stores group > records. > > The format is a comma-separated list of directory service attribute > names and values. For example: > > /For Microsoft Active Directory/ > > CN=Users,DC=ldapserver,DC=mycompany,DC=com > > /For other LDAP technologies/ > > ou=Groups,o=/example/.com > > </roleSearch>
My gosh their documentation is...interesting. For the domain example.test you'd use the following configuration: Users are stored in cn=users,cn=accounts,dc=example,dc=test Groups are stored in cn=groups,cn=accounts,dc=example,dc=test Groups use the member attribute. Users use memberof. Note too that I saw in their documentation that the administrator user account must be unique. IPA uses the account 'admin' just like MNA, so be aware that one side will need to be changed. > > FreeIPA/IdM does not support OU's > > https://pagure.io/freeipa/issue/2973 > > > > FWIW, Rob, you closed that RFE IPA uses a flat tree. Lots of LDAP admins over the years have tried to reflect an company's organization using OU's with "interesting" results, particularly as teams are re-organized, acquisitions, etc. You end up moving entries around for artificial reasons (Tech Support is now called Global User Support, rename the OU tomorrow). rob > > Any suggestions other than to gripe to the other vendor ? > > *______________________________________________________________________________________________* > > * * > > *Daniel E. White** > **[email protected] <mailto:[email protected]>*** > > *NICS Linux Engineer > NASA Goddard Space Flight Center > 8800 Greenbelt Road > Building 14, Room E175 > Greenbelt, MD 20771*** > > *Office: (301) 286-6919*** > > *Mobile: (240) 513-5290* > > > > *From: *Rob Crittenden <[email protected]> > *Date: *Wednesday, December 4, 2019 at 17:55 > *To: *FreeIPA users list <[email protected]> > *Cc: *Daniel White <[email protected]> > *Subject: *[EXTERNAL] Re: [Freeipa-users] Anyone using FreeIPA/IdM and > MicroFocus Network Automation ? > > > > White, Daniel E. (GSFC-770.0)[NICS] via FreeIPA-users wrote: > > Despite the fact that we selected "Generic LDAP" rather than "Active > > Directory", it is still looking for Security Groups and Organization > Units. > > > > I've never used it and couldn't find much in their docs. Do you have > > more information on what the configuration screen looks like and what > > the 389-ds access log is showing? > > > > rob > > > > > _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
