help to configure reset by question with FreeIPA

[Paulpatou]

Hi
I'm new to LDAP and I'm trying to configure the reset by question in my FreeIPA test environment. I think I have a "insufficient right" error as written in the error message.
A little help would be appreciated, thanks

erro_ldap.log

[coudot]

You should be able to configure FreeIPA to add permission to edit the LDAP attribute configured to store answers.

See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html-single/configuring_and_managing_identity_management/index#role-based-access-control-in-idm-webui_managing-role-based-access-controls-using-the-idm-web-ui

[Paulpatou]

Thanks for the doc, how do I know which attribute needs to be modified?

[coudot]

You need to configure attribute and object class in SSP : https://self-service-password.readthedocs.io/en/latest/config_questions.html#attribute-and-object-class

[Paulpatou]

I understood how to add by default in Freeipa a user object class but I must first create this object class via a ldif file and import it. I know that it has nothing to do with that but if someone has the skills to explain me how to create and import it, I would be very grateful.
Happy Friday