I have added some new custom attributes to my FreeIPA and so far I was using the admin account to check them in the WebUI. But today I accessed the WebUI using a regular user account and I was surprised to see that the new attributes are not visible. when I used "inspect elements" to view the page code I found the attribute's code as this:

<dev class="widget text-widget" name="bloodtype" style="display: none;">...</dev>

note that the attribute is still visible for the admin.

attribute schema:

dn: cn=schema
changetype: modify
add: attributeTypes
attributeTypes: (
  NAME 'bloodtype'
  DESC 'Employee Blood type'
  X-ORIGIN 'Oracle Unified Directory Server'
  USAGE userApplications )

Object class:

objectclasses: ( 2.16.840.1.113730. NAME 'customPerson' SUP person STRUCTURAL MAY bloodtype X-ORIGIN ( 'Extending FreeIPA' 'user defined' ) )

python plugin:

from ipalib.plugins import user
from ipalib.parameters import Str
from ipalib import _
def validate(ugettext,value):
    if value not in ['A','B','AB','O']:
    return _("Blood type must be either A, B, AB or O.")
user.user.takes_params = user.user.takes_params + (
        label=_('Blood Type'),

javascript plugin:

    function(phases, user_mod) {
    // helper function
        function get_item(array, attr, value) {
            for (var i=0,l=array.length; i<l; i++) {
                if (array[i][attr] === value) return array[i];
            return null;
    var plugin = {};
    plugin.add_fields = function() {
        var facet = get_item(user_mod.entity_spec.facets, '$type', 'details');
        var section = get_item(facet.sections, 'name', 'identity');
            label:'Blood type',
        return true;
    phases.on('customization', plugin.add_fields);
    return plugin;

What is the problem and how can I allow all users to view it?


you must add the new attribute to ACI.

You can modify ACI in cn=users,cn=accounts,dn=example,=dn=com directly

or you can add new attribute into 'managed_permissions' in the user class, for permission you want to allow to access them. You need to run ipa-ldap-updater --upgrade after that.

or you can create a new ACI permission and add it to existing privileges.

  • I added the attribute to the ACI using an ldif schema depending on the examples in link but it didn't change anything – Muhmmad Aziz May 25 '15 at 11:08
  • Ok it worked, I added the attribute into a permission and gave it to the user. Thank you for your help. – Muhmmad Aziz May 25 '15 at 11:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.