[Freeipa-users] HOW to Add employeenumber to user easily? there is account object with emoployee number ttribute

2014-02-06 Thread barrykfl
Hi: I can make it show on ldap browser or the ui but finding where to add it in command base. ipa user-mod ---employeenumber no such parameter. Moreover can i change the attribute just by name and make use of it. E.g. i found car license no really useful for staff so i want to change the

Re: [Freeipa-users] More SSO Strangeness

2014-02-06 Thread Sumit Bose
On Wed, Feb 05, 2014 at 01:44:13PM -0500, Mark Gardner wrote: Okay, Spent some time on this one... Some users can login SSO no problem, others have to put in their password. Strange as it seems, if the length of the username was greater than 4, the SSO worked. So markg@test.local works,

Re: [Freeipa-users] HOW to Add employeenumber to user easily? there is account object with emoployee number ttribute

2014-02-06 Thread Sumit Bose
On Thu, Feb 06, 2014 at 04:31:49PM +0800, barry...@gmail.com wrote: Hi: I can make it show on ldap browser or the ui but finding where to add it in command base. ipa user-mod ---employeenumber no such parameter. There is no specific option for employeenumber, but you can set the

Re: [Freeipa-users] HOW to Add employeenumber to user easily? there is account object with emoployee number ttribute

2014-02-06 Thread Martin Kosek
On 02/06/2014 09:31 AM, barry...@gmail.com wrote: Hi: I can make it show on ldap browser or the ui but finding where to add it in command base. ipa user-mod ---employeenumber no such parameter. Moreover can i change the attribute just by name and make use of it. E.g. i found car

Re: [Freeipa-users] HOW to Add employeenumber to user easily? there is account object with emoployee number ttribute

2014-02-06 Thread Petr Viktorin
On 02/06/2014 09:31 AM, barry...@gmail.com wrote: Hi: I can make it show on ldap browser or the ui but finding where to add it in command base. ipa user-mod ---employeenumber no such parameter. You can use setattr where we don't provide specialized CLI arguments. Also note that

Re: [Freeipa-users] HOW to Add employeenumber to user easily? there is account object with emoployee number ttribute

2014-02-06 Thread Dmitri Pal
On 02/06/2014 05:59 AM, Petr Viktorin wrote: On 02/06/2014 09:31 AM, barry...@gmail.com wrote: Hi: I can make it show on ldap browser or the ui but finding where to add it in command base. ipa user-mod ---employeenumber no such parameter. You can use setattr where we don't provide

Re: [Freeipa-users] HOW to Add employeenumber to user easily? there is account object with emoployee number ttribute

2014-02-06 Thread Petr Viktorin
On 02/06/2014 01:08 PM, Dmitri Pal wrote: On 02/06/2014 05:59 AM, Petr Viktorin wrote: On 02/06/2014 09:31 AM, barry...@gmail.com wrote: Hi: I can make it show on ldap browser or the ui but finding where to add it in command base. ipa user-mod ---employeenumber no such parameter. You can

[Freeipa-users] Specifying gid/uid range

2014-02-06 Thread Mauricio Tavares
Where can I configure the range, or at least starting value, for the uid and gid that will be used when creating user accounts? ___ Freeipa-users mailing list Freeipa-users@redhat.com https://www.redhat.com/mailman/listinfo/freeipa-users

Re: [Freeipa-users] Specifying gid/uid range

2014-02-06 Thread Christian Horn
On Thu, Feb 06, 2014 at 09:33:08AM -0500, Mauricio Tavares wrote: Where can I configure the range, or at least starting value, for the uid and gid that will be used when creating user accounts? I think this helps:

Re: [Freeipa-users] HOW to Add employeenumber to user easily? there is account object with emoployee number ttribute

2014-02-06 Thread Martin Kosek
On 02/06/2014 01:12 PM, Petr Viktorin wrote: On 02/06/2014 01:08 PM, Dmitri Pal wrote: On 02/06/2014 05:59 AM, Petr Viktorin wrote: On 02/06/2014 09:31 AM, barry...@gmail.com wrote: Hi: I can make it show on ldap browser or the ui but finding where to add it in command base. ipa user-mod

Re: [Freeipa-users] Cross domain trust

2014-02-06 Thread Steve Dainard
So I've completed the setup, and can see the trust on the Windows side. I've joined a client to the IPA realm, and can login with a IPA user. When I try to login (console, ssh, su -) as a domain user I get: CLIENT SIDE [root@rhel6-client ~]# su - sdainard@miovision su: user

Re: [Freeipa-users] Cross domain trust

2014-02-06 Thread Alexander Bokovoy
On Thu, 06 Feb 2014, Steve Dainard wrote: So I've completed the setup, and can see the trust on the Windows side. I've joined a client to the IPA realm, and can login with a IPA user. When I try to login (console, ssh, su -) as a domain user I get: CLIENT SIDE

Re: [Freeipa-users] HOW to Add employeenumber to user easily? there is account object with emoployee number ttribute

2014-02-06 Thread Martin Kosek
On 02/06/2014 11:59 AM, Petr Viktorin wrote: On 02/06/2014 09:31 AM, barry...@gmail.com wrote: Hi: I can make it show on ldap browser or the ui but finding where to add it in command base. ipa user-mod ---employeenumber no such parameter. You can use setattr where we don't provide

Re: [Freeipa-users] Cross domain trust

2014-02-06 Thread Steve Dainard
On Thu, Feb 6, 2014 at 11:14 AM, Alexander Bokovoy aboko...@redhat.comwrote: On Thu, 06 Feb 2014, Steve Dainard wrote: So I've completed the setup, and can see the trust on the Windows side. I've joined a client to the IPA realm, and can login with a IPA user. When I try to login (console,

Re: [Freeipa-users] Cross domain trust

2014-02-06 Thread Alexander Bokovoy
On Thu, 06 Feb 2014, Steve Dainard wrote: In newer versions (FreeIPA 3.3+, SSSD 1.11+) this is done on IPA master automatically by setting ipa_master_mode = True On RHEL 6.x one needs to add the parameters manually. 2. /etc/krb5.conf has to contain auth_to_local rules that map

Re: [Freeipa-users] Cross domain trust

2014-02-06 Thread Steve Dainard
On Thu, Feb 6, 2014 at 12:42 PM, Alexander Bokovoy aboko...@redhat.comwrote: On Thu, 06 Feb 2014, Steve Dainard wrote: In newer versions (FreeIPA 3.3+, SSSD 1.11+) this is done on IPA master automatically by setting ipa_master_mode = True On RHEL 6.x one needs to add the

[Freeipa-users] CentOS 6.5 client install failing

2014-02-06 Thread Dave Jablonski
FreeIPA Server: Fedora 16, freeipa 2.1.4 Latest CentOS 6.5 client When running: ipa-client-install --mkhomedir --enable-dns-updates The install fails with: trying https://server-name/ipa/xml Forwarding 'env' to server u'https://server-name/ipa/xml' Traceback (most recent call last): File

Re: [Freeipa-users] Cross domain trust

2014-02-06 Thread Alexander Bokovoy
On Thu, 06 Feb 2014, Steve Dainard wrote: On Thu, Feb 6, 2014 at 12:42 PM, Alexander Bokovoy aboko...@redhat.comwrote: On Thu, 06 Feb 2014, Steve Dainard wrote: In newer versions (FreeIPA 3.3+, SSSD 1.11+) this is done on IPA master automatically by setting ipa_master_mode =

[Freeipa-users] ipa-client-install fails on replica because of kinit cannot contact any KDC

2014-02-06 Thread Shree
First of all, the ipa-replica-install did not allow me to use the --setup-ca option complaining that a cert already exists, replicate creation was successful after I skipped the option. Seems like the replica is one except  1) There is no CA Service running on the replica (which I guess is