Chapter 4. Searching Identity Management entries from the command line

Procedure

1. Use the ipa show-mappings command with the IPA command name to display the LDAP attribute mappings:

   $ ipa show-mappings <command>

   For example, to list the LDAP attribute mappings for the config-mod command:

   $ ipa show-mappings config-mod
   -----------------------------
   Number of entries returned 77
   -----------------------------
     ca_renewal_master_server: caRenewalMaster
     enable_migration: ipaMigrationEnabled
     ...
     userobjectclasses: ipauserobjectclasses *
     ...

2. Optional: If the output contains too many entries, pipe the command through grep to filter for the option you need:

   $ ipa show-mappings <command> | grep <option>

   For example:

   $ ipa show-mappings config-mod | grep userobjectclasses
     userobjectclasses: ipauserobjectclasses *

3. Note the symbol after the LDAP attribute name, which indicates whether the attribute is required and how many values it can hold:

   Expand

   Symbol	Meaning
   (none)	Mandatory, single-valued
   +	Mandatory, multi-valued
   ?	Optional, single-valued
   *	Optional, multi-valued

   Show more

   For example, ipauserobjectclasses * means the attribute is optional and multi-valued.

4. Use the LDAP attribute name to add or remove a value:

   • To add a new value, use --addattr <attribute>=<value>. For example, to add the mailRecipient object class to the list of user object classes:

     $ ipa config-mod --addattr ipauserobjectclasses=mailRecipient

   • To remove an existing value, use --delattr <attribute>=<value>. For example, to remove the mailRecipient object class from the list of user object classes:

     $ ipa config-mod --delattr ipauserobjectclasses=mailRecipient

     Note

     In this example, mailRecipient is an object class name. The LDAP attribute ipauserobjectclasses stores a list of object class names, so each value you add or remove with --addattr or --delattr is an object class name, not an LDAP attribute.