<div dir="ltr">If I do this <div>
<p class="">ldapsearch -LLL -H ldaps://DOMAIN:636 -x -D "uid=mac_slave,cn=users,cn=accounts,dc=domain,dc=com" -w 'nachopassword' -b "uid=awesomeuser,cn=users,cn=accounts,dc=domain,dc=com"</p><p class="">
It works fine</p><p class="">**Mac_Slave is my automation user.</p><p class=""><br></p></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 2, 2014 at 3:40 PM, Chris Whittle <span dir="ltr"><<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">
<p>For testing I'm using</p><p>ldapsearch -LLL -H ldaps://DOMAIN636 -x -D "cn=directory manager" -w 'nachopassword' -b "cn=canlogin,cn=compat,dc=domain,dc=com"</p><div class="gmail_extra">
If I do it with directory manager it works fine, if I use my automation user (just a generic user with no extra permissions) it returns nothing, no error, just empty space</div><div class="gmail_extra"><br></div><div class="gmail_extra">
if I add -v (verbose) i get </div><div class="gmail_extra">
<p>ldap_initialize( ldaps://<a href="http://domain.com:636/??base" target="_blank">domain.com:636/??base</a> )</p>
<p>filter: (objectclass=*)</p>
<p>requesting: All userApplication attributes</p><p><br></p><p>Thanks everyone!</p><div><div class="h5"><br><div class="gmail_quote">On Tue, Sep 2, 2014 at 3:31 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>Chris Whittle wrote:<br>
> hmmm...<br>
> Is there not a permission or role in freeIPA that I could give a group<br>
> or role just to see everything in<br>
> my CN "cn=canlogin,cn=compat,dc=DOMAIN,dc=com"<br>
<br>
</div>Can you provide more details on what you're doing, and how you are<br>
binding? Can you search the cn=users,cn=compat,dc=DOMAIN,dc=com tree?<br>
<br>
AFAICT you should be able to read cn=compat as long as you bind as a user.<br>
<span><font color="#888888"><br>
rob<br>
</font></span><div><br>
><br>
><br>
><br>
> On Tue, Sep 2, 2014 at 3:06 PM, Dmitri Pal <<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a><br>
</div><div>> <mailto:<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>>> wrote:<br>
><br>
> On 09/02/2014 09:34 PM, Chris Whittle wrote:<br>
>> Ok Dmitri, I got it added using what you sent and the following links<br>
>> <a href="https://git.fedorahosted.org/cgit/slapi-nis.git/tree/doc/sch-getting-started.txt" target="_blank">https://git.fedorahosted.org/cgit/slapi-nis.git/tree/doc/sch-getting-started.txt</a><br>
>> and<br>
>> <a href="https://www.redhat.com/archives/freeipa-users/2009-August/msg00013.html" target="_blank">https://www.redhat.com/archives/freeipa-users/2009-August/msg00013.html</a><br>
>><br>
>> I think i'm 90% there with the caveat that I can't seem to see<br>
>> what permissions I need to give a user to view my NIS "view".<br>
>> Right now Directory Manager can see it but that is it.<br>
>><br>
>> Any ideas?<br>
>><br>
> You got me :-)<br>
> I would defer to specialist in this area to solve this problem.<br>
><br>
><br>
>><br>
>><br>
>> On Tue, Sep 2, 2014 at 9:00 AM, Chris Whittle <<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a><br>
</div><div>>> <mailto:<a href="mailto:cwhittl@gmail.com" target="_blank">cwhittl@gmail.com</a>>> wrote:<br>
>><br>
>> Thanks Dimitri, before I get too far this rabbit hole (cause<br>
>> it looks a little scary) let me make sure I get it.<br>
>><br>
>> So using Slap-NIS I should be able to create a view into<br>
>> FreeIPA that would show only a subset of user based on<br>
>> something like a group or an attribute?<br>
>><br>
>> Then using the built in MAC Directory Utility (or any LDAP<br>
>> client) I should be able to use that Slap-NIS view as a<br>
>> searchbase and it would return just people I wanted. This<br>
>> could be used keep anyone outside that view from logging in?<br>
>><br>
>> I'm sorry for the noob questions but there isn't a lot of good<br>
>> documentation on SlapNIS from first glance and I don't want to<br>
>> spend 2 days figuring it out if it's not going to work.<br>
>><br>
>> As always extremely appreciated!<br>
>> Whitt<br>
>><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>> On Tue, Sep 2, 2014 at 3:54 AM, Dmitri Pal <<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a><br>
</div><div><div>>> <mailto:<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>>> wrote:<br>
>><br>
>> On 09/02/2014 03:04 AM, Chris Whittle wrote:<br>
>>> I am trying to limit who can login to my macs and I'm<br>
>>> having to stick to what OSX will let me do.<br>
>>><br>
>>> Currently I can only limit users using the searchbase and<br>
>>> right now it's "cn=users,cn=accounts,dc=DOMAIN,dc=com"<br>
>>><br>
>>> This works fine unless I wanted to create a user that I<br>
>>> wanted in LDAP for other purposes but not to login.<br>
>>><br>
>>> So my questions are,<br>
>>> A)Can we create different OUs in FreeIPA like most LDAP<br>
>>> servers?<br>
>><br>
>> You can use slapi-nis to create an alternative view of the<br>
>> tree or trees and point your special client to that tree.<br>
>> There you might be able to expose a small subset of users<br>
>> that match your special criteria.<br>
>> The slapi-nis and compat docs are in the doc folder in the<br>
>> corresponding git repo.<br>
>><br>
>> IPA uses compat tree for its own purposes but you can<br>
>> tweak it if you need or create a different view.<br>
>><br>
>> HTH<br>
>><br>
>><br>
>><br>
>>> B)If not anyone have any idea on how I could do this with<br>
>>> OSX's directory Utility?<br>
>>><br>
>>> Thanks!<br>
>>><br>
>>><br>
>>><br>
>><br>
>><br>
>> --<br>
>> Thank you,<br>
>> Dmitri Pal<br>
>><br>
>> Sr. Engineering Manager IdM portfolio<br>
>> Red Hat, Inc.<br>
>><br>
>><br>
>><br>
><br>
><br>
> --<br>
> Thank you,<br>
> Dmitri Pal<br>
><br>
> Sr. Engineering Manager IdM portfolio<br>
> Red Hat, Inc.<br>
><br>
><br>
><br>
><br>
<br>
</div></div></blockquote></div><br></div></div></div></div>
</blockquote></div><br></div>