<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#FFFFFF"> <div class="moz-cite-prefix">On 08/12/2014 05:26 PM, Chris Whittle wrote: </div> <blockquote cite="mid:CANyEwjRy4V8FG0kv24A_SiEvmqKWb9s7pCUJaXaTfB4c9dc+Og@mail.gmail.com" type="cite"> <div dir="ltr">Thanks Martin! </div> </blockquote> Thank you for the contribution! Really appreciated. <blockquote cite="mid:CANyEwjRy4V8FG0kv24A_SiEvmqKWb9s7pCUJaXaTfB4c9dc+Og@mail.gmail.com" type="cite"> <div class="gmail_extra"> <div class="gmail_quote">On Tue, Aug 12, 2014 at 9:50 AM, Martin Kosek <<a moz-do-not-send="true" href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thank you! I liked this page to <a moz-do-not-send="true" href="http://www.freeipa.org/page/HowTos#Authentication" target="_blank">http://www.freeipa.org/page/HowTos#Authentication</a> and also improved formatting of the page. I am not sure about the "role" section though, we do not use "role" objectclass, so Okta's search probably returns no results anyway. It may be better to keep that blank IMO. Martin <div class="HOEnZb"> <div class="h5"> On 08/12/2014 03:46 PM, Chris Whittle wrote: > <a moz-do-not-send="true" href="http://www.freeipa.org/page/HowTo/Integrate_With_Okta" target="_blank">http://www.freeipa.org/page/HowTo/Integrate_With_Okta</a> > > > On Sat, Aug 9, 2014 at 11:31 PM, Dmitri Pal <<a moz-do-not-send="true" href="mailto:dpal@redhat.com">dpal@redhat.com</a>> wrote: > >> On 08/08/2014 04:26 PM, Chris Whittle wrote: >> >> Hey Dimitri, What do you mean? Both of them gave me the same answer and >> it worked. >> >> >> Right, now you have the knowledge which is burred in a mail thread and >> would be hard to find for others that might want to follow your steps. >> I was hoping you would find some time to summarize your setup and >> experience and share with others via a HOWTO page on the FreeIPA site [1]. >> >> [1] <a moz-do-not-send="true" href="http://www.freeipa.org/page/HowTos" target="_blank">http://www.freeipa.org/page/HowTos</a> >> >> Thanks >> Dmitri >> >> >> On Aug 8, 2014 3:25 PM, "Dmitri Pal" <<a moz-do-not-send="true" href="mailto:dpal@redhat.com">dpal@redhat.com</a>> wrote: >> >>> On 08/07/2014 02:21 PM, Chris Whittle wrote: >>> >>> Thanks guys that works! >>> >>> >>> >>> And what about HOWTO? ;-) >>> >>> >>> >>> >>> On Thu, Aug 7, 2014 at 12:22 PM, Lucas Yamanishi <<a moz-do-not-send="true" href="mailto:lyamanishi@sesda3.com">lyamanishi@sesda3.com</a>> >>> wrote: >>> >>>> On 08/07/2014 12:18 PM, Chris Whittle wrote: >>>> >>>> I'm currently working on a trial with OKTA and have installed their >>>> server agent with no issues. Now I'm trying to map FreeIPA attributes with >>>> OKTA's >>>> >>>> I'm getting no entries found, which leads me to think I'm missing >>>> something >>>> [image: Inline image 1] >>>> [image: Inline image 2] >>>> [image: Inline image 3] >>>> Thanks! >>>> >>>> >>>> The objectClass values look incorrect. Try posixAccount and posixGroup >>>> for users and groups. Roles are groupOfNames, but that’s a little less >>>> specific and will match non-role entries without a search base. >>>> >>>> You can easily look up raw entries to check your mappings with commands >>>> like these (the —all and —raw options are available for all *-show >>>> commands, afaik): >>>> >>>> ipa user-show --all --raw $USER_NAME >>>> ipa group-show --all --raw $GROUP >>>> ipa role-show --all --raw $ROLE >>>> >>>> Or pure ldaputils: >>>> >>>> ldapsearch -LLL -YGSSAPI -b 'cn=users,cn=accounts,dc=example,dc=com' 'uid=$USER_NAME' >>>> >>>> >>>> >>>> -- >>>> ----- >>>> *question everything*learn something*answer nothing* >>>> ------------ >>>> Lucas Yamanishi >>>> ------------------ >>>> Systems Administrator, ADNET Systems, Inc. >>>> NASA Space and Earth Science Data Analysis (606.9) >>>> 7515 Mission Drive, Suite A100 >>>> Lanham, MD 20706 * 301-352-4646 * 0xD354B2CB >>>> >>>> >>>> -- >>>> Manage your subscription for the Freeipa-users mailing list: >>>> <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> >>>> Go To <a moz-do-not-send="true" href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project >>>> >>> >>> >>> >>> >>> >>> -- >>> Thank you, >>> Dmitri Pal >>> >>> Sr. Engineering Manager IdM portfolio >>> Red Hat, Inc. >>> >>> >>> -- >>> Manage your subscription for the Freeipa-users mailing list: >>> <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> >>> Go To <a moz-do-not-send="true" href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project >>> >> >> >> -- >> Thank you, >> Dmitri Pal >> >> Sr. Engineering Manager IdM portfolio >> Red Hat, Inc. >> >> > > > </div> </div> </blockquote> </div> </div> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc.</pre> </body> </html>