Chapter 39. Using ID views for Active Directory users You can use ID views to specify new values for the POSIX attributes of your Active Directory (AD) users in an IdM-AD Trust environment. By default, IdM applies the Default Trust View to all AD users. You can configure additional ID views on individual IdM clients to further adjust which POSIX attributes specific users receive. 39.1. How the Default Trust View works The Default Trust View is the default ID view that is always applied to AD users and groups in trust-based setups. It is created automatically when you establish the trust using the ipa-adtrust-install command and cannot be deleted. Note The Default Trust View only accepts overrides for AD users and groups, not for IdM users and groups. Using the Default Trust View, you can define custom POSIX attributes for AD users and groups, thus overriding the values defined in AD. Table 39.1. Applying the Default Trust View Values in AD Default Trust View Result Login ad_user ad_user ad_user UID 111 222 222 GID 111 (no value) 111 You can also configure additional ID Views to override the Default Trust View on IdM clients. IdM applies the values from the host-specific ID view on top of the Default Trust View: If an attribute is defined in the host-specific ID view, IdM applies the value from this ID view. If an attribute is not defined in the host-specific ID view, IdM applies the value from the Default Trust View. Table 39.2. Applying a host-specific ID view on top of the Default Trust View Values in AD Default Trust View Host-specific ID view Result Login ad_user ad_user (no value) ad_user UID 111 222 333 333 GID 111 (no value) 333 333 Note You can only apply host-specific ID views to override the Default Trust View on IdM clients. IdM servers and replicas always apply the values from the Default Trust View. Additional resources Using an ID view to override a user attribute value on an IdM client 39.2. Defining global attributes for an AD user by modifying the Default Trust View If you want to override a POSIX attribute for an Active Directory (AD) user throughout your entire IdM deployment, modify the entry for that user in the Default Trust View. This procedure sets the GID for the AD user ad_user@ad.example.com to 732000006. Prerequisites You have authenticated as an IdM administrator. A group must exist with the GID or you must set the GID in an ID override for a group. Procedure As an IdM administrator, create an ID override for the AD user in the Default Trust View that changes the GID number to 732000006: Clear the entry for the ad_user@ad.example.com user from the SSSD cache on all IdM servers and clients. This removes stale data and allows the new override value to apply. Verification Retrieve information for the ad_user@ad.example.com user to verify the GID reflects the updated value. 39.3. Overriding Default Trust View attributes for an AD user on an IdM client with an ID view You might want to override some POSIX attributes from the Default Trust View for an Active Directory (AD) user. For example, you might need to give an AD user a different GID on one particular IdM client. You can use an ID view to override a value from the Default Trust View for an AD user and apply it to a single host. This procedure explains how to set the GID for the ad_user@ad.example.com AD user on the host1.idm.example.com IdM client to 732001337. Prerequisites You have root access to the host1.idm.example.com IdM client. You are logged in as a user with the required privileges, for example the admin user. Procedure Create an ID view. For example, to create an ID view named example_for_host1 : Add a user override to the example_for_host1 ID view. To override the user's GID: Enter the ipa idoverrideuser-add command Add the name of the ID view Add the user name, also called the anchor Add the --gidnumber= option: Apply example_for_host1 to the host1.idm.example.com IdM client: Note The ipa idview-apply command also accepts the --hostgroups option. The option applies the ID view to hosts that belong to the specified host group, but does not associate the ID view with the host group itself. Instead, the --hostgroups option expands the members of the specified host group and applies the --hosts option individually to every one of them. This means that if a host is added to the host group in the future, the ID view does not apply to the new host. Clear the entry for the ad_user@ad.example.com user from the SSSD cache on the host1.idm.example.com IdM client. This removes stale data and allows the new override value to apply. Verification SSH to host1 as ad_user@ad.example.com : Retrieve information for the ad_user@ad.example.com user to verify the GID reflects the updated value. 39.4. Applying an ID view to an IdM host group The ipa idview-apply command accepts the --hostgroups option. However, the option acts as a one-time operation that applies the ID view to hosts that currently belong to the specified host group, but does not dynamically associate the ID view with the host group itself. The --hostgroups option expands the members of the specified host group and applies the --hosts option individually to every one of them. If you add a new host to the host group later, you must apply the ID view to the new host manually, using the ipa idview-apply command with the --hosts option. Similarly, if you remove a host from a host group, the ID view is still assigned to the host after the removal. To unapply the ID view from the removed host, you must run the ipa idview-unapply id_view_name --hosts= name_of_the_removed_host command. Follow this procedure to achieve the following goals: How to create a host group and add hosts to it. How to apply an ID view to the host group. How to add a new host to the host group and apply the ID view to the new host. Prerequisites Ensure that the ID view you want to apply to the host group exists in IdM. For example, to create an ID view to override the GID for an AD user, see Overriding Default Trust View attributes for an AD user on an IdM client with an ID view Procedure Create a host group and add hosts to it: Create a host group. For example, to create a host group named baltimore : Add hosts to the host group. For example, to add the host102 and host103 to the baltimore host group: Apply an ID view to the hosts in the host group. For example, to apply the example_for_host1 ID view to the baltimore host group: Add a new host to the host group and apply the ID view to the new host: Add a new host to the host group. For example, to add the somehost.idm.example.com host to the baltimore host group: Optional: Display the ID view information. For example, to display the details about the example_for_host1 ID view: The output shows that the ID view is not applied to somehost.idm.example.com , the newly-added host in the baltimore host group. Apply the ID view to the new host. For example, to apply the example_for_host1 ID view to somehost.idm.example.com : Verification Display the ID view information again: The output shows that ID view is now applied to somehost.idm.example.com , the newly-added host in the baltimore host group.

Commands:
ipa idoverrideuser-add 'Default Trust View' ad_user@ad.example.com --gidnumber=732000006
sssctl cache-expire -u ad_user@ad.example.com
id ad_user@ad.example.com uid=702801456(ad_user@ad.example.com) gid=732000006(ad_admins) groups=732000006(ad_admins),702800513(domain users@ad.example.com)
ipa idview-add example_for_host1 --------------------------- Added ID View "example_for_host1" --------------------------- ID View Name: example_for_host1
ipa idoverrideuser-add example_for_host1 ad_user@ad.example.com --gidnumber=732001337 ----------------------------- Added User ID override "ad_user@ad.example.com" ----------------------------- Anchor to override: ad_user@ad.example.com GID: 732001337
ipa idview-apply example_for_host1 --hosts=host1.idm.example.com ----------------------------- Applied ID View "example_for_host1" ----------------------------- hosts: host1.idm.example.com --------------------------------------------- Number of hosts the ID View was applied to: 1 ---------------------------------------------
sssctl cache-expire -u ad_user@ad.example.com
ssh ad_user@ad.example.com@host1.idm.example.com
[ad_user@ad.example.com@host1 ~]USD id ad_user@ad.example.com uid=702801456(ad_user@ad.example.com) gid=732001337(admins2) groups=732001337(admins2),702800513(domain users@ad.example.com)
ipa hostgroup-add --desc="Baltimore hosts" baltimore --------------------------- Added hostgroup "baltimore" --------------------------- Host-group: baltimore Description: Baltimore hosts
ipa hostgroup-add-member --hosts={host102,host103} baltimore Host-group: baltimore Description: Baltimore hosts Member hosts: host102.idm.example.com, host103.idm.example.com ------------------------- Number of members added 2 -------------------------
ipa idview-apply --hostgroups=baltimore ID View Name: example_for_host1 ----------------------------------------- Applied ID View "example_for_host1" ----------------------------------------- hosts: host102.idm.example.com, host103.idm.example.com --------------------------------------------- Number of hosts the ID View was applied to: 2 ---------------------------------------------
ipa hostgroup-add-member --hosts=somehost.idm.example.com baltimore Host-group: baltimore Description: Baltimore hosts Member hosts: host102.idm.example.com, host103.idm.example.com,somehost.idm.example.com ------------------------- Number of members added 1 -------------------------
ipa idview-show example_for_host1 --all dn: cn=example_for_host1,cn=views,cn=accounts,dc=idm,dc=example,dc=com ID View Name: example_for_host1 [...] Hosts the view applies to: host102.idm.example.com, host103.idm.example.com objectclass: ipaIDView, top, nsContainer
ipa idview-apply --host=somehost.idm.example.com ID View Name: example_for_host1 ----------------------------------------- Applied ID View "example_for_host1" ----------------------------------------- hosts: somehost.idm.example.com --------------------------------------------- Number of hosts the ID View was applied to: 1 ---------------------------------------------
ipa idview-show example_for_host1 --all dn: cn=example_for_host1,cn=views,cn=accounts,dc=idm,dc=example,dc=com ID View Name: example_for_host1 [...] Hosts the view applies to: host102.idm.example.com, host103.idm.example.com, somehost.idm.example.com objectclass: ipaIDView, top, nsContainer