8.2. About the IdM Client Tools
ipa. This script is a parent or control script for associated subcommands; each subcommand relates to a specific entry type.
- The scripts allow management tasks to be automated and performed repeatedly in a consistent way without manual intervention.
- Entries can be added with all possible attributes configured (or a desired subset of attributes) in a single step. The web UI frequently requires two steps to fully configure an entry: the first to create the entry and the next to add optional attributes.
- The command-line scripts support adding additional attributes which may not be available in the UI or even custom attributes to entries, if the schema is configured.
8.2.1. The Structure of the ipa Command
ipacommand is essentially a big plug-in container. It supports dozens of subcommands; these subcommands are actually plug-ins which manage specific types of objects in Identity Management.
ipa objectType-operation objectName --option=value
ipa user-add entryName options
dnsrecord-addall belong to the dns module or topic. All of the information for managing a specific area, with all of the supported commands and examples for each, are available by viewing the help for that topic:
ipa help topic
ipa help topics
184.108.40.206. Adding, Editing, and Deleting Entries with ipa
$ ipa user-add jsmith
addoperations, commands usually prompt for any required configuration attributes, which can be passed as command-line options or using
--set/addattroptions (Section 8.2.3, “Managing Entry Attributes with --setattr, --addattr, and --delattr”).
$ ipa user-add First name: John Last name: Smith User login [jsmith]: jsmith -------------------- Added user "jsmith" -------------------- ...
*-modcommands, and then any new or edited attributes are listed as options after it.
$ ipa user-mod jsmith --title="Editor III"
*-delcommand and the entry's name.
$ ipa user-del jsmith
220.127.116.11. Finding and Displaying Entries with ipa
*-findcommand and an optional search criterion. The criterion is a string which can either be an exact match or a substring of any of the search attribute values. For example, this searches both for the exact match on the string smith (such as an
snvalue of Smith) and a substring search for values such as a username of jsmith or a longer surname, such as Smithson.
ipa user-find smith
*-findcommand) have certain limits imposed as part of the server configuration, specifically how many entries are returned (size limits) and how long a search will run (time limits). This is covered in Section 18.104.22.168.2, “Setting IdM Search Limits”. Part of the server configuration is setting global defaults for size and time limits on searches. While these limits are always enforced in the web UI, they can be overridden with any
*-findcommand with the
--timelimitoptions. For example, if the default time limit is 60 seconds and a search is going to take longer, the time limit can be increased to 120 seconds:
[jsmith@ipaserver ~]$ ipa user-find smith --timelimit=120
*-showcommand and the entry name. As with searches, only a subset of attributes is displayed with the entry unless the
--alloption is used.
22.214.171.124. Adding Members to Groups and Containers with ipa
*-add-member, although the command may specify an entry type, such as
8.2.2. Positional Elements in ipa Commands
ipasubcommands have only two elements: the name of the entry being modified (the object) and then any options available for the subcommand:
ipa command entryName --options=values
automountcommands, for example. With automount, the location must be included whenever a new key or map is created.
ipa command parentEntryName childEntryName --childOptions=childValues
8.2.3. Managing Entry Attributes with --setattr, --addattr, and --delattr
ipacommand uses specified command-line arguments to set values. For example, adding a mail attribute to a user can be done with the
--allow-dynupdateoption with zone commands; and a map key for an automount map is given in the
--setattroption sets one value for the given attribute; any existing values are overwritten, even for multi-valued attributes.
--addattroption adds a new value for an attribute; for a multi-valued attribute, it adds the new value while preserving any existing values.
--addattrcan be used multiple times in the same command invocation. For example:
$ ipa user-mod jsmith --firstname.lastname@example.org --email@example.com --setattr=description="backup IT manager for the east coast branch"
--delattroption. For a single-valued attribute, this removes the attribute; for a multi-valued attribute, it removes only the specified value. For example:
$ ipa user-mod jsmith --firstname.lastname@example.org
$ ipa user-mod jsmith --email@example.com --firstname.lastname@example.org
8.2.4. Using Special Characters with IdM Tools
8.2.5. Logging into the IdM Domain Before Running
ipa-server-install), the user must first authenticate to the IdM domain by obtaining a Kerberos ticket. This is done using
[jsmith@ipaserver ~]$ kinit admin