Unable to query additional user attributes

[ondrejv2]

I am trying to query additional user attributes with

[ifp]
debug_level = 10
user_attributes = +extensionAttribute3
allowed_uids = root

now sssctl user-checks <username> does not show extensionAttribute3.
Also tried busctl get-property org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users/<domain>/<uidnumber> org.freedesktop.sssd.infopipe.Users.User extensionAttribute3 to no avail.

It works if I try to query attributes that sssd already caches, i.e. works with

user_attributes = +mail

Is that expected?

[sumit-bose]

Hi,

this is not expected and I think we already have test for this use-case in src/tests/system/tests/test_infopipe.py. Do you see in the backend logs that extensionAttribute3 is read from the server and added to the cache? Are you using a matching ldap_user_extra_attrs option in the [domain/...] section of sssd.conf?

bye,
Sumit

[ondrejv2]

Hi,
No I am not using any ldap_user_extra_attrs option as per in both man sssd.conf or man sssd-ifp there is no mention that this would be needed.
Also, there is no trace of extensionAttribute3 in the logs suggesting it would be ever queried from the ldap server.

Thanks

[eisenmann-b1]

Hi,
does it work if you lookup extraAttributes instead?
I.e. if you run busctl get-property org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users/<domain>/<uidnumber> org.freedesktop.sssd.infopipe.Users.User extraAttributes, do you see extensionAttribute3 in the output there?

That is where non-standard attributes should go, according to a recent version of sssd-ifp(5).
The relevant wording was changed in this commit.

[ondrejv2]

Hello,

yes, it works now with extraAttributes, but still does not solve the problem.

The problem is, that in order for this to work, you need to make sssd to cache that attributes first via ldap_user_extra_attrs as @sumit-bose mentioned. This should be IMO mentioned in the man page as well.

The other problem is that it is not direct replacement of the (now obsoleted) GetUserAttr method as this method takes username as an argument whereas busctl get-property approach requires a known UIDNumber to work with - something which might not be actually available - see Application typed domains (not sure if that's also deprecated feature or not)