4.7. Default user and group attributes in IdM
Identity Management (IdM) uses a template when it creates new entries.
The template for users is more specific than the template for groups. IdM uses default values for several core attributes for IdM user accounts. These defaults can define actual values for user account attributes, such as the home directory location, or they can define the formats of attribute values, such as the user name length. The template also defines the object classes assigned to users.
For groups, the template only defines the assigned object classes.
In the IdM LDAP directory, these default definitions are all contained in a single configuration entry for the IdM server, cn=ipaconfig,cn=etc,dc=example,dc=com.
You can modify the configuration of default user parameters in IdM by using the ipa config-mod command. The table below summarizes some of the key parameters, the command-line options that you can use with ipa config-mod to modify them, and the parameter descriptions.
| Web UI field | Command-line option | Description |
|---|---|---|
| Maximum user name length |
| Sets the maximum number of characters for user names. Default: 32. |
| Root for home directories |
|
Sets the default directory for user home directories. Default: |
| Default shell |
|
Sets the default shell for users. Default: |
| Default user group |
|
Sets the default group for newly created accounts. Default: |
| Default e-mail domain |
| Sets the email domain for creating addresses based on user accounts. Default: server domain. |
| Search time limit |
| Sets the maximum time in seconds for a search before returning results. |
| Search size limit |
| Sets the maximum number of records to return in a search. |
| User search fields |
| Defines searchable fields in user entries, impacting server performance if too many attributes are set. |
| Group search fields |
| Defines searchable fields in group entries. |
| Certificate subject base | Sets the base DN for creating subject DNs for client certificates during setup. | |
| Default user object classes |
| Defines object classes for creating user accounts. Must provide a complete list as it overwrites the existing one. |
| Default group object classes |
| Defines object classes for creating group accounts. Must provide a complete list. |
| Password expiration notification |
| Defines the number of days before a password expires for sending a notification. |
| Password plug-in features | Sets the format of allowable passwords for users. |