First, be aware that the attributes available depend upon the type of object. E.g. a person can have a telephone number, but a host can't. Assuming you have a kerberos credential, you can do ldap queries using ldapsearch. (You may need to install openldap clients for that to be present.)

E.g. to look up my entry:

ldapsearch -Y GSSAPI -h krb1.cs.rutgers.edu -b dc=cs,dc=rutgers,dc=edu uid=hedrick

obviously krb1.cs.rutgers.edu is our hostname. Use your. And dc=cs,dc=rutgers,dc=edu is for our domain, which is CS.RUTGERS.EDU. You'll need to use yours.

If you look up your entry, you'll see that a lot of the lines are for "objectclass." For a person it's typically things like person and inetOrgPerson. Each objectclass has certain attributes that are legal. So a person entry can have any of the attributes associated with any of its objectclasses. To see all available object classes, and the atrributes they allow, do

ldapsearch -Y GSSAPI -h krb1.cs.rutgers.edu -b cn=schema objectclass="*" objectclasses

The legal atttributes are may or must, depending upon whether they're mandatory or optional.

If you see an attribute you'd like for your users, but the object class that has it isn't assigned, to people, you can add it. E.g. the following commands add an objectclass hostObject to all users and groups. The objectclass hostObject has an attribute host. So this lets us associate hosts with both people and groups. The permission-mod commands allow people who can modify people and groups to be able to modify those attributes.

ipa config-mod --addattr=ipaUserObjectClasses=hostObject ipa config-mod --addattr=ipaGroupObjectClasses=hostObject ipa permission-mod "System: Read User Standard Attributes" --includedattrs=host ipa permission-mod "System: Read Groups" --includedattrs=host ipa permission-mod "System: Modify Groups" --includedattrs=host ipa permission-mod "System: Modify Users" --includedattrs=host

You can create new objectclasses and groups, but it's a bit more complex.