freeipa

#9394 setattr in update user method is not successful
Closed: invalid by frenaud. Opened by sarwar026.

Closed: invalid
Reopen Issue

Request for enhancement

I want to update an attribute named "uniqueMember" of user

Issue

The curl command is showing "attribute \"uniqueMember\" not allowed" with code 4205.

Steps to Reproduce

  1. Login to IPA
  2. apply the following curl command
    {
    "method": "user_mod",
    "params": [
    [
    "dejan.chandra"
    ],
    {
    "setattr": "uniqueMember=uid=dejan.chandra,cn=users,cn=accounts,dc=bcc-ndc,dc=gov,dc=bd"
    }
    ],
    "id": 0
    }

Actual behavior

(what happens)
This is the output of curl command:
{
"result": null,
"error": {
"code": 4205,
"message": "attribute \"uniqueMember\" not allowed",
"data": {
"info": "attribute \"uniqueMember\" not allowed"
},
"name": "ObjectclassViolation"
},
"id": 0,
"principal": "admin@HWDOMAIN.LAN",
"version": "4.10.1"
}

Expected behavior

I want to get updated value of uniqueMember

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

Additional Info:
I have update another attribute named "o" successfully by following line:
"setattr": "o=Security Service Division"

Please guide me what I am missing.

Please use freeipa-users@lists.fedorahosted.org mailing list for "How-To" questions. Closing this issue as invalid.

Since the command user-mod is used, I assume that your goal is to modify a user entry, and add a uniquemember attribute to this entry.
The issue is that a user cannot contain uniquemember values, because a user doesn't have the required objectclass. uniquemember attributes can exist in groupofuniquenames entries (representing groups, not users).

Can you explain what you want to do?

Metadata Update from @frenaud:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

@frenaud: Thanks for the clarification.

I want to add uniqueMember to group. How to achieve this? How should I use groupofuniquenames ? Can you please explain with an example.

Thanks in advance

@sarwar026
FreeIPA uses the objectclass "groupofnames" to represent groups, not "groupofuniquenames".

For instance, "mygroup" is stored in LDAP as the following object:

dn: cn=mygroup,cn=groups,cn=accounts,dc=ipa,dc=test
cn: mygroup
objectClass: top
objectClass: nestedgroup
objectClass: ipausergroup
objectClass: ipaobject
objectClass: groupofnames
objectClass: posixgroup
objectClass: ipantgroupattrs
ipaUniqueID: efbddffa-ee71-11ed-8fae-fa163eaf69aa
gidNumber: 205400097
ipaNTSecurityIdentifier: S-1-5-21-1166032515-3431855665-2561613534-1097
member: uid=myuser,cn=users,cn=accounts,dc=ipa,dc=test

A group represented as "groupofuniquenames" would look roughly the same but have objectclass: groupofuniquenames instead of objectclass: groupofnames and uniquemember: uid=... instead of member: uid=...
But IPA tools such as IPA user-show or ipa group-show would not properly show the users's groups or the group members as they are managing only groups with "groupofnames" objectclass.

I guess that you are integrating IPA with external tools that require groupofuniquenames. In this case you can refer to https://www.freeipa.org/page/HowTo/vsphere5_integration that explain how to use the compat tree and make groupofnames appear as groupofuniquenames.

Thanks for your clarification.

I have solved the issue with "setattr": {"objectclass":"groupOfUniqueNames"} first and then "setattr": {"uniqueMember":"uid=abc.def,cn=users,cn=accounts,dc=bcc-ndc,dc=gov,dc=bd"}

Thanks.
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.