ldapsearch for compat tree does not display the AD trust users

[iulian roman]

Hello, 

I try to run some ldapsearch queries on the compat tree from some old clients.
Unfortunately it does display only the Idm posix users, not the AD trust users. The query
I am running for a particular AD user :

ldapsearch  -Y GSSAPI  -h  ipaserver01.ipa.example.com -b
"cn=compat,dc=ipa,dc=example,dc=com"  "uid=aduser(a)example.com"

Any idea how to debug or where to look into  ?

[Mohammad Rizwan Yusuf]

I tried following and it worked for me.


ldapsearch -Y GSSAPI -b "cn=compat,dc=ipa,dc=example,dc=com"
'(&(objectClass=posixAccount)(uid=aduser@<AD-DOMAIN>
<uid=aduser1(a)win2016.test&gt;))&#39;


On Tue, Aug 24, 2021 at 12:22 PM iulian roman via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  Hello,
>
>  I try to run some ldapsearch queries on the compat tree from some old
>  clients. Unfortunately it does display only the Idm posix users, not the AD
>  trust users. The query I am running for a particular AD user :
>
>  ldapsearch  -Y GSSAPI  -h  ipaserver01.ipa.example.com -b
>  "cn=compat,dc=ipa,dc=example,dc=com"  &quot;uid=aduser(a)example.com&quot;
>
>  Any idea how to debug or where to look into  ?
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>  

-- 

--

Regards

Mohammad Rizwan

He/Him/His

Senior Software Quality Engineer

Red Hat Pune <https://www.redhat.com>

myusuf(a)redhat.com
M: [phone]     IM: rizwan
<https://red.ht/sig>

[Sumit Bose]

Am Tue, Aug 24, 2021 at 06:51:25AM -0000 schrieb iulian roman via FreeIPA-users:
>  Hello, 
>  
>  I try to run some ldapsearch queries on the compat tree from some old clients.
> Unfortunately it does display only the Idm posix users, not the AD trust users. The query
> I am running for a particular AD user :
>  
>  ldapsearch  -Y GSSAPI  -h  ipaserver01.ipa.example.com -b
> "cn=compat,dc=ipa,dc=example,dc=com"  "uid=aduser(a)example.com" 
Hi,

have you tried, as Florence suggested,

    ldapsearch  -Y GSSAPI  -h  ipaserver01.ipa.example.com -b
"cn=compat,dc=ipa,dc=example,dc=com" 
"(&(objectClass=posixAccount)(uid=aduser(a)example.com))"

HTH

bye,
Sumit

>  
>  Any idea how to debug or where to look into  ?
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure