15.3. Applying Custom Object Classes to New Group Entries
15.3. Applying Custom Object Classes to New Group Entries As with user entries, administrators may create custom object classes with custom attributes. These can be added automatically by adding the object classes to the IdM server configuration. Note that after an administrator modifies the list of default object classes, new entries will contain the custom object classes but the old entries are not automatically modified. 15.3.1. From the Web UI Add all of the custom schema elements to the 389 Directory Server instance used by Identity Management. Adding schema elements is described in the schema chapter of the Directory Server Administrator's Guide . Open the IPA Server tab. Select the Configuration subtab. Scroll to the Group Options area. Figure 15.3. Group Options in Server Configuration Click Add to include a new field for another object class. Important Always include the existing default object classes when the configuration is updated. Otherwise, the current settings will be overwritten. If any object classes required by Identity Management are not included, then subsequent attempts to add an entry will fail with object class violations. When the changes are complete, click Save at the top of the Configuration page. 15.3.2. From the Command Line Add all of the custom schema elements to the 389 Directory Server instance used by Identity Management. Adding schema elements is described in the schema chapter of the Directory Server Administrator's Guide . Add the new object class to the list of object classes added to entries. The option for group object classes is --groupobjectclasses . Important Always include the existing default object classes when the configuration is updated. Otherwise, the current settings will be overwritten. If any object classes required by Identity Management are not included, then subsequent attempts to add an entry will fail with object class violations. All object classes must be included in the list of object classes. The information passed with the config-mod command overwrites the values. This can be done by specifying each object class with a --groupobjectclasses argument or by listing all of the object classes in a comma-separated list inside curly braces with no spaces allowed, such as {attr1,attr2,attr3} . Especially for long lists, it can be easier to use the curly braces than multiple options. For example:
[bjensen@server ~]USD ipa config-mod --groupobjectclasses= {top,groupofnames,nestedgroup,ipausergroup,ipaobject,ipasshuser, employeegroup }