<div dir="ltr"><div>Bit late to the conversation here, but if you want another example of a quasi-system account within IPA, there is the need for a user to handle automated enrollment/re-enrollment of servers.<br><br></div>
Charlie<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Feb 15, 2013 at 11:32 PM, Brian Cook <span dir="ltr"><<a href="mailto:bcook@redhat.com" target="_blank">bcook@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><br><div><div><div class="h5"><div>On Feb 15, 2013, at 3:11 PM, Simo Sorce <<a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>> wrote:</div>
<br><blockquote type="cite">On Fri, 2013-02-15 at 17:34 -0500, Dmitri Pal wrote:<br><blockquote type="cite">On 02/15/2013 05:12 PM, John Dennis wrote:<br><blockquote type="cite">On 02/15/2013 04:54 PM, Orion Poplawski wrote:<br>
<blockquote type="cite">On 02/15/2013 02:34 PM, John Dennis wrote:<br><blockquote type="cite">On 02/15/2013 04:16 PM, Orion Poplawski wrote:<br><blockquote type="cite"><br>Hmm, that is the filter in TB for me too, but:<br>
<br> [15/Feb/2013:11:17:21 -0700] conn=931 op=1 SRCH<br>base="ou=people,dc=nwra,dc=com" scope=2<br>filter="(|(mail=*apache*)(cn=*apache*)(givenName=*apache*)(sn=*apache*))"<br><br>attrs="description notes title sn sn mozillaHomeLocalityName givenName<br>
mozillaHomeState mail mozillaWorkUrl workurl labeledURI o company<br>mozillaNickname mozillaNickname mobile cellphone carphone<br>modifyTimestamp<br>nsAIMid nsAIMid telephoneNumber birthyear c c mozillaHomeStreet cn cn<br>
postalCode zip mozillaCustom1 custom1 mozillaHomeCountryName<br>homePhone st<br>region mozillaCustom2 custom2 mozillaSecondEmail mozillaSecondEmail<br>facsimileTelephoneNumber facsimileTelephoneNumber mozillaCustom3<br>custom3<br>
mozillaUseHtmlMail mozillaUseHtmlMail mozillaHomeStreet2 birthday<br>street<br>street postOfficeBox mozillaCustom4 custom4 mozillaHomeUrl homeurl<br>l l pager<br>pagerphone ou department departmentNumber orgunit birthmonth<br>
mozillaWorkStreet2 mozillaHomePostalCode objectClass"<br><br>is what I see in the LDAP server log<br><br></blockquote><br>I don't know, beats me as to why there is no objectclass filter<br>component.<br>Perhaps TB is smart enough to know (objectclass=*) is effectively a<br>
no-op and<br>ignores it when it builds the final filter.<br><br>What happens if you set the TB filter to (objectclass=person)?<br><br></blockquote><br>Yup, then it adds it:<br><br><br>filter="(&(objectClass=person)(|(mail=*apac*)(cn=*apac*)(givenName=*apac*)(sn=*apac*)))"<br>
<br><br></blockquote><br>O.K. I presume it's obvious the consequence of this little experiment<br>is that if we do an an RFE that results in removing the person<br>objectclass from non-human users you'll have to configure a custom<br>
LDAP search filter in every client in your enterprise if you don't<br>want them to see non-human users in their search results.<br><br></blockquote>Can it be managed via Puppet?<br></blockquote><br>Unlikely, thunderbird preferences are per user and stored in user<br>
preference files, which cannot be arbitrarily overridden.<br><br></blockquote><div><br></div></div></div>Following URL details a deployment method that configures thunderbird for address book in AD with a custom search string. Maybe you can use it or it will inspire you as to how to accomplish your deployment.</div>
<div><br></div><div><a href="http://wpkg.org/Thunderbird#System-wide" target="_blank">http://wpkg.org/Thunderbird#System-wide</a></div><div class="im"><div><br></div><div><br><blockquote type="cite">Simo.<br><br>-- <br>Simo Sorce * Red Hat, Inc * New York<br>
<br>_______________________________________________<br>Freeipa-users mailing list<br><a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
</blockquote></div><br></div></div><br>_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br></blockquote></div><br></div>