36.5. Using an ID view to override the login name of an IdM user on a specific host

Procedure

1. On the IdM server, create a new ID view. For example, to create an ID view named example_for_client1:

   $ ipa idview-add example_for_client1
   ---------------------------
   Added ID View "example_for_client1"
   ---------------------------
     ID View Name: example_for_client1

2. Add a user override to the example_for_client1 ID view. To override the user login:

   • Enter the ipa idoverrideuser-add command
   • Add the name of the ID view
   • Add the user name, also called the anchor

   • Add the --login option:

     $ ipa idoverrideuser-add example_for_client1 idm_user --login=user_1234
     -----------------------------
     Added User ID override "idm_user"
     -----------------------------
       Anchor to override: idm_user
       User login: user_1234

     For a list of the available options, run ipa idoverrideuser-add --help.

     注記

     The ipa idoverrideuser-add --certificate command replaces all existing certificates for the account in the specified ID view. To append an additional certificate, use the ipa idoverrideuser-add-cert command instead:

     $ ipa idoverrideuser-add-cert example_for_client1 user --certificate="MIIEATCC..."

3. Optional: Using the ipa idoverrideuser-mod command, you can specify new attribute values for an existing user override.

4. Apply example_for_client1 to the client1.idm.example.com host:

   $ ipa idview-apply example_for_client1 --hosts=client1.idm.example.com
   -----------------------------
   Applied ID View "example_for_client1"
   -----------------------------
   hosts: client1.idm.example.com
   ---------------------------------------------
   Number of hosts the ID View was applied to: 1
   ---------------------------------------------

   注記

   The ipa idview-apply command also accepts the --hostgroups option. The option applies the ID view to hosts that belong to the specified host group, but does not associate the ID view with the host group itself. Instead, the --hostgroups option expands the members of the specified host group and applies the --hosts option individually to every one of them.

   This means that if a host is added to the host group in the future, the ID view does not apply to the new host.

5. To apply the new configuration to the IdM client system immediately:

   1. SSH to the client system as root:

      $ ssh root@client1
      Password:

   2. On the IdM client, clear the SSSD cache:

      # sss_cache -E

   3. On the IdM client, restart the SSSD daemon:

   # systemctl restart sssd