Red Hat SummitEste conteúdo não está disponível no idioma selecionado.
15.2. Applying Custom Object Classes to New User Entries
User and group accounts are created with a predefined set of LDAP object classes applied to the entry. Any attributes which belong to the object class can be added to the user entry.
While the standard and IdM-specific LDAP object classes will cover most deployment scenarios, administrators can create custom object classes with custom attributes. Note that after an administrator modifies the list of default object classes, new entries will contain the custom object classes but the old entries are not automatically modified.
15.2.1. From the Web UI
- Add all of the custom schema elements to the 389 Directory Server instance used by Identity Management. Adding schema elements is described in the schema chapter of the Directory Server Administrator's Guide.
- Open the IPA Server tab.
- Select the Configuration subtab.
- Scroll to the User Options area.
Figure 15.1. User Options in Server Configuration
- At the bottom of the users area, click Add to include a new field for another object class.ImportantAlways include the existing default object classes when the configuration is updated. Otherwise, the current settings will be overwritten. If any object classes required by Identity Management are not included, then subsequent attempts to add an entry will fail with object class violations.
Figure 15.2. Changing Default User Object Classes
- When the changes are complete, click Save at the top of the Configuration page.
15.2.2. From the Command Line
- Add all of the custom schema elements to the 389 Directory Server instance used by Identity Management. Adding schema elements is described in the schema chapter of the Directory Server Administrator's Guide.
- Add the new object class to the list of object classes added to entries. The option for user object classes is
--userobjectclasses.ImportantAlways include the existing default object classes when the configuration is updated. Otherwise, the current settings will be overwritten. If any object classes required by Identity Management are not included, then subsequent attempts to add an entry will fail with object class violations.All object classes must be included in the list of object classes. The information passed with the config-mod command overwrites the previous values. This can be done by specifying each object class with a--userobjectclassesargument or by listing all of the object classes in a comma-separated list inside curly braces with no spaces allowed, such as {attr1,attr2,attr3}. Especially for long lists, it can be easier to use the curly braces than multiple options. For example:[bjensen@server ~]$ ipa config-mod
--userobjectclasses={top,person,organizationalperson,inetorgperson,inetuser,posixaccount,krbprincipalaux,krbticketpolicyaux,ipaobject,ipasshuser,employeeinfo}
Note
To use the curly braces option, the
brace expansion feature must be switched on. To activate the feature, use the set command:
# set -o braceexpand
