Hi Alex, This question pops from time to time, and if I remember correctly, it is not possible.
You may want to read this message (and thread) on a similar issue (although focused on host access to user data): https://lists.fedoraproject.org/archives/list/[email protected]/message/EO44AJHLZSCTFUZ2I2E5JAVF4I4DOZFV/ Rafael On Tue, Jul 14, 2026 at 9:20 AM Alex Crow via FreeIPA-users < [email protected]> wrote: > I've been trying to no avail to get this to work - I have a couple of > users that I want to be able to bind via simple LDAP over TLS but only see > their own entry. > > I've been playing with Roles, Privileges and Permissions but I can't get > this to work. > > One of the parts I've seen in some online documentation says to create a > normal permissions, with read search and compare rights, and use an "Extra > Target Filter" of "(uid=${user})". > > Despite assigning this to a Privilege and a Role, and giving only that > role to an account, that account can still read everyone else's entries and > attributes. > > Is there any way to make this work? > > This is my permission entry: > > # ipa permission-show "Only access self" > Permission name: Only access self > Granted rights: read, search, compare > Effective attributes: cn, createtimestamp, employeetype, entryusn, > givenname, homedirectory, loginshell, mail, > memberof, mobile, modifytimestamp, objectclass, > ou, sn, title, uid, uidnumber, > usercertificate > Bind rule type: permission > Subtree: cn=users,cn=accounts,dc=ipa,dc=roadtech,dc=internal > Extra target filter: (uid=${user}) > Target DN: cn=users,cn=accounts,dc=ipa,dc=roadtech,dc=internal > Type: user > Permission flags: SYSTEM, V2 > Granted to Privilege: restricted_user > Indirect Member of roles: Only self > > Now what I'm unsure of is the extra filter, does this variable "$user" > even exist? I can't find anything in the IPA docs about variables that can > be used in filters. I've also tried changing $user to the actual UID of the > user I'm working with and it still had no effect, the user can still see > everything (unprivileged attributes only but all the rest are there). > -- > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > Do not reply to spam, report it: > https://forge.fedoraproject.org/infra/tickets/issues/new > -- Rafael Guterres Jeffman Senior Software Engineer FreeIPA - Red Hat
-- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
