freeipa

#6667 Feature Request - objectCategory support ("behave like AD mode")
Closed: wontfix Opened by glrichard.

Closed: wontfix
Reopen Issue

I am writing on behalf of Ground Labs (www.groundlabs.com).

Our product Enterprise Recon is designed to link to a LDAP server to allow user authentication. Most of our customers use Active Directory, but we've got one who is attempting to connect to freeIPA and they have been unable to do so.

We built a freeIPA installation in our test environment to triage this, and after some investigation we have determined that the root cause of this behaviour is two things. First, freeIPA does not appear to default objectClass to user (though we have spotted that this is configurable). Second and more importantly, objectCategory is not set at all. Our code follows the following guidelines when attempting to establish a connection, and this does not work with freeIPA.

https://msdn.microsoft.com/en-us/library/ms677643(v=vs.85).aspx

I suspect we're not the only AD-compatible product that isn't fully happy with freeIPA, and given that I thought I'd open an enhancement request; is it possible that a future release might have a "behave like Active Directory" mode or similar? Meanwhile we will also look at the feasibility of a "generic LDAP" option on our side.

Many thanks for your consideration.

Thank you for opening a ticket. The problem is that IPA does not have a notion of objectCategory. I suspect that objectCategory and the filter that MSFT suggest is a pure AD thing. Since we do not have any use for this attribute it is unlikely we will add it. The recommended approach for any client software that wants to be server agnostic is to be able to configure:
- base DN
- filter
- scope
for the searches you conduct. Your request is first of a kind. We suspect that if you want to support other vendors and directory services you will be more successful in making filter configurable than in making each vendor follow MSFT.

Thanks for the reply :)

This is a new one for us too; we've never been asked to support anything other than AD before.

As I said in my original comment, we will look at what we can do with our own code for a future release on our side.

Metadata Update from @glrichard:
- Issue assigned to someone
- Issue set to the milestone: 0.0 NEEDS_TRIAGE

I'm closing this item as it needs to be implemented on your side. But ask, if you need to help with anything IPA related.

Metadata Update from @pvoborni:
- Custom field affects_doc reset
- Custom field tester adjusted to wanted
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
High
enhancement
IPA
wanted
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.