<div dir="ltr">
<p class="">Success here is my LDIF if anyone needs to do this with a MAC</p><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<p class="">dn: cn=Mac Users, cn=Schema Compatibility, cn=plugins, cn=config</p><p class="">objectClass: top</p><p class="">objectClass: extensibleObject</p><p class="">cn: Mac Users</p><p class="">schema-compat-search-base: cn=users,cn=accounts,dc=DOMAIN,dc=com</p>
<p class="">schema-compat-search-filter: (&(objectClass=posixaccount)(memberOf=cn=canlogin,cn=groups,cn=accounts,dc DOMAIN,dc=com))</p><p class="">schema-compat-container-group: cn=compat,dc=DOMAIN,dc=com</p><p class="">
schema-compat-container-rdn: cn=canlogin</p><p class="">schema-compat-entry-rdn: cn=%{cn}</p><p class="">schema-compat-entry-attribute: objectclass=inetOrgPerson</p><p class="">schema-compat-entry-attribute: objectclass=posixAccount</p>
<p class="">schema-compat-entry-attribute: gecos=%{cn}</p><p class="">schema-compat-entry-attribute: cn=%{cn}</p><p class="">schema-compat-entry-attribute: uid=%{uid}</p><p class="">schema-compat-entry-attribute: uidNumber=%{uidNumber}</p>
<p class="">schema-compat-entry-attribute: gidNumber=%{gidNumber}</p><p class="">schema-compat-entry-attribute: loginShell=%{loginShell}</p><p class="">schema-compat-entry-attribute: homeDirectory=%{homeDirectory}</p></blockquote>
<div> </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Sep 3, 2014 at 1:04 PM, Chris Whittle <span dir="ltr"><<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Thanks Rob for the explanation!<div><br></div><div>I think I have it working, I just have to test a machine and verify. </div>
</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Sep 3, 2014 at 12:47 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Chris Whittle wrote:<br>
> That worked, but having issues get it to work with the OSX Directory<br>
> Utility.<br>
> I'm wondering if it's because when you go against the OU normally it's<br>
> returning more info about the user versus what's being returned from the<br>
> compat "view" I'm going to experiment with the attributes it's returning<br>
> and see if that's it.<br>
><br>
> I'm also wondering why FreeIPA doesn't support multiple OU's natively,<br>
> this would be so much easier with multiple OUs (one for my non-users and<br>
> one for my users)<br>
<br>
</div>Because they are so very often used really, really poorly, resulting in<br>
having to move entries around a lot with no real technical reason behind<br>
it. Think about the number of times an IT department gets renamed, oops,<br>
today they are called Global Support Services, oh no, didn't you hear,<br>
now they are ... Each one requiring an entire subtree move. Where the<br>
users exist in LDAP does not generally need to reflect the<br>
organizational structure.<br>
<br>
Your case is a bit different from most, where you want to host two<br>
completely separate kinds of users.<br>
<span><font color="#888888"><br>
rob<br>
</font></span><div><br>
><br>
><br>
> On Wed, Sep 3, 2014 at 9:10 AM, Martin Kosek <<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a><br>
</div><div><div>> <mailto:<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>>> wrote:<br>
><br>
> On 09/03/2014 03:08 PM, Rob Crittenden wrote:<br>
> > Martin Kosek wrote:<br>
> >> On 09/03/2014 09:02 AM, Martin Kosek wrote:<br>
> >>> In the meantime, you can use the workaround that Rob sent, you<br>
> would just need<br>
> >>> to delete it again when the fix is in, so that the permissions<br>
> do not step on<br>
> >>> each other.<br>
> >><br>
> >> Actually, wait a minute. I think Rob's ACI example may be too<br>
> wide, it may<br>
> >> expose any attribute in the compat tree, including a potential<br>
> userPassword.<br>
> ><br>
> > The ACI was on his custom cn=canlogin subtree, not all of cn=compat.<br>
> ><br>
> >> As I see, it seems that slapi-nis plugin do not fortunately<br>
> expose that, but it<br>
> >> is safer to just list the attributes that one wants to display<br>
> (this is also<br>
> >> what we did in FreeIPA 4.0, no global wildcard allowing ACIs any<br>
> more).<br>
> >><br>
> >> I added a respective permission via Web UI (one part of it cannot<br>
> be added via<br>
> >> CLI, see <a href="https://fedorahosted.org/freeipa/ticket/4522" target="_blank">https://fedorahosted.org/freeipa/ticket/4522</a>) and compat<br>
> tree now<br>
> >> works for me. See attached example.<br>
> >><br>
> >> Resulting permission shown in CLI:<br>
> >><br>
> >> # ipa permission-show "TEMPORARY - Read compat tree"<br>
> >> Permission name: TEMPORARY - Read compat tree<br>
> >> Granted rights: read, search, compare<br>
> >> Effective attributes: cn, description, gecos, gidnumber,<br>
> homedirectory,<br>
> >> loginshell, memberuid,<br>
> >> objectclass, uid, uidnumber<br>
> >> Bind rule type: all<br>
> >> Subtree: dc=mkosek-fedora20,dc=test<br>
> >> ACI target DN: cn=compat,dc=mkosek-fedora20,dc=test<br>
> >><br>
> >> It is much easier to manipulate than ACI added via ldapmodify.<br>
> ><br>
> > I see you filed a bug on the missing CLI option. That's why I did the<br>
> > ACI, because I couldn't demonstrate how to add this ACI on the CLI. I<br>
> > hadn't gotten around to doing that last night.<br>
> ><br>
> > rob<br>
><br>
> Right. Surprisingly, the option was available in Web UI, thus the Web UI<br>
> screenshot I attached to the thread :) But we have the CLI option fixed<br>
> already, will be part of FreeIPA 4.0.2 which will be released very soon.<br>
><br>
> Martin<br>
><br>
><br>
<br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div><br></div>