FreeIPA无法看到LDAP自定义属性

Question

我尝试新的属性添加到FreeIPA，我用“的ldapmodify”添加自定义属性和对象类的LDAP，

#color.ldif 
dn: cn=schema 
changetype: modify 
add: attributeTypes 
attributeTypes: (2.25.28639311321113238241701611583088740684.14.2.2 
    NAME 'favoriteColorName' 
    EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch 
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 
    X-ORIGIN 'Extending FreeIPA') 

dn: cn=schema 
changetype: modify 
add: objectclasses 
objectclasses: (2.25.28639311321113238241701611583088740684.14.2.1 
    NAME 'customPerson' SUP person 
    STRUCTURAL 
    MAY (favoriteColorName) 
    X-ORIGIN 'Extending FreeIPA') 

然后重新启动服务器和使用

ipa config-mod --addattr=ipaUserObjectClasses=customPerson 

的指示在Extending the FreeIPA Server，它出了所有罚款，终于我的插件添加到freeIPA

#color.py 
from ipalib.plugins import user 
from ipalib.parameters import Str 
from ipalib import _ 
user.user.takes_params = user.user.takes_params + (
    Str('favoritecolorname?', 
     cli_name='color', 
     label=_('Favorite color'), 
    ), 
) 
user.user.default_attributes.append('favoritecolorname') 

，当我尝试运行命令：

ipa user-mod admin --color=red 

我得到的错误：

ipa: ERROR: attribute "favoriteColorName" not allowed

Answer 1

，我发现我的问题的原因。看起来用户'admin'没有包含在其中的新创建的类'customPerson'。

[[email protected] ~]# ipa user-show admin --all 
    dn: uid=admin,cn=users,cn=accounts,dc=sample,dc=com 
    User login: admin 
    Last name: Administrator 
    Full name: Administrator 
    Home directory: /home/admin 
    GECOS: Administrator 
    Login shell: /bin/bash 
    Kerberos principal: [email protected] 
    UID: 1236600000 
    GID: 1236600000 
    Account disabled: False 
    Password: True 
    Member of groups: admins, trust admins 
    Kerberos keys available: True 
    objectclass: top, person, posixaccount, krbprincipalaux, krbticketpolicyaux, 
       inetuser, ipaobject, ipasshuser, ipaSshGroupOfPubKeys 

因此，任何尝试使用未包含在这些对象类中的属性都是不允许的。但修改为其他用户的颜色值被允许：

[[email protected] ~]# ipa user-mod test --color=blue 
-------------------- 
Modified user "test" 
-------------------- 
    User login: test 
    First name: test 
    Last name: test 
    Home directory: /home/test 
    Login shell: /bin/bash 
    Email address: [email protected] 
    UID: 1236600007 
    GID: 1236600007 
    Account disabled: False 
    Favorite color: blue 
    Password: True 
    Member of groups: ipausers 
    Kerberos keys available: True