<div dir="ltr"> For testing I'm usingldapsearch -LLL -H ldaps://DOMAIN636 -x -D "cn=directory manager" -w 'nachopassword' -b "cn=canlogin,cn=compat,dc=domain,dc=com"<div class="gmail_extra"> If I do it with directory manager it works fine, if I use my automation user (just a generic user with no extra permissions) it returns nothing, no error, just empty space</div><div class="gmail_extra"> </div><div class="gmail_extra"> if I add -v (verbose) i get </div><div class="gmail_extra"> ldap_initialize( ldaps://<a href="http://domain.com:636/??base">domain.com:636/??base</a> ) filter: (objectclass=*) requesting: All userApplication attributes Thanks everyone! <div class="gmail_quote">On Tue, Sep 2, 2014 at 3:31 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="">Chris Whittle wrote: > hmmm... > Is there not a permission or role in freeIPA that I could give a group > or role just to see everything in > my CN "cn=canlogin,cn=compat,dc=DOMAIN,dc=com" </div>Can you provide more details on what you're doing, and how you are binding? Can you search the cn=users,cn=compat,dc=DOMAIN,dc=com tree? AFAICT you should be able to read cn=compat as long as you bind as a user. rob <div class="im"> > > > > On Tue, Sep 2, 2014 at 3:06 PM, Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> </div><div class="im">> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>> wrote: > > On 09/02/2014 09:34 PM, Chris Whittle wrote: >> Ok Dmitri, I got it added using what you sent and the following links >> <a href="https://git.fedorahosted.org/cgit/slapi-nis.git/tree/doc/sch-getting-started.txt" target="_blank">https://git.fedorahosted.org/cgit/slapi-nis.git/tree/doc/sch-getting-started.txt</a> >> and >> <a href="https://www.redhat.com/archives/freeipa-users/2009-August/msg00013.html" target="_blank">https://www.redhat.com/archives/freeipa-users/2009-August/msg00013.html</a> >> >> I think i'm 90% there with the caveat that I can't seem to see >> what permissions I need to give a user to view my NIS "view". >> Right now Directory Manager can see it but that is it. >> >> Any ideas? >> > You got me :-) > I would defer to specialist in this area to solve this problem. > > >> >> >> On Tue, Sep 2, 2014 at 9:00 AM, Chris Whittle <<a href="mailto:cwhittl@gmail.com">cwhittl@gmail.com</a> </div><div class="im">>> <mailto:<a href="mailto:cwhittl@gmail.com">cwhittl@gmail.com</a>>> wrote: >> >> Thanks Dimitri, before I get too far this rabbit hole (cause >> it looks a little scary) let me make sure I get it. >> >> So using Slap-NIS I should be able to create a view into >> FreeIPA that would show only a subset of user based on >> something like a group or an attribute? >> >> Then using the built in MAC Directory Utility (or any LDAP >> client) I should be able to use that Slap-NIS view as a >> searchbase and it would return just people I wanted. This >> could be used keep anyone outside that view from logging in? >> >> I'm sorry for the noob questions but there isn't a lot of good >> documentation on SlapNIS from first glance and I don't want to >> spend 2 days figuring it out if it's not going to work. >> >> As always extremely appreciated! >> Whitt >> >> >> >> >> >> >> >> On Tue, Sep 2, 2014 at 3:54 AM, Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a> </div><div class=""><div class="h5">>> <mailto:<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>>> wrote: >> >> On 09/02/2014 03:04 AM, Chris Whittle wrote: >>> I am trying to limit who can login to my macs and I'm >>> having to stick to what OSX will let me do. >>> >>> Currently I can only limit users using the searchbase and >>> right now it's "cn=users,cn=accounts,dc=DOMAIN,dc=com" >>> >>> This works fine unless I wanted to create a user that I >>> wanted in LDAP for other purposes but not to login. >>> >>> So my questions are, >>> A)Can we create different OUs in FreeIPA like most LDAP >>> servers? >> >> You can use slapi-nis to create an alternative view of the >> tree or trees and point your special client to that tree. >> There you might be able to expose a small subset of users >> that match your special criteria. >> The slapi-nis and compat docs are in the doc folder in the >> corresponding git repo. >> >> IPA uses compat tree for its own purposes but you can >> tweak it if you need or create a different view. >> >> HTH >> >> >> >>> B)If not anyone have any idea on how I could do this with >>> OSX's directory Utility? >>> >>> Thanks! >>> >>> >>> >> >> >> -- >> Thank you, >> Dmitri Pal >> >> Sr. Engineering Manager IdM portfolio >> Red Hat, Inc. >> >> >> > > > -- > Thank you, > Dmitri Pal > > Sr. Engineering Manager IdM portfolio > Red Hat, Inc. > > > > </div></div></blockquote></div> </div></div>