Problem browsing LDAP with Outlook
by Chris Bryant
When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS.
When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well.
I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also.
Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration.
Thanks,
Chris
USA.NET
You Run Your Business. We'll Run Your Email.
This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.
3 years, 9 months
ldapsearch is fine but from authentication purpose its not doing anything
by Fosiul Alam
Hi
I have setup ldap server and from client its returning example :
[root@home ~]# ldapsearch -x -ZZ -D "cn=Directory manager" -w xxx -h
ldap-2.fosiul.lan -b "dc=fosiul,dc=lan" "(cn=Fosiul Alam)"
# extended LDIF
#
# LDAPv3
# base <dc=fosiul,dc=lan> with scope subtree
# filter: (cn=Fosiul Alam)
# requesting: ALL
#
# falam, users, uk, fosiul.lan
dn: uid=falam,ou=users,l=uk,dc=fosiul,dc=lan
givenName: Fosiul
sn: Alam
loginShell: /bin/bash/bash
uidNumber: 1000
gidNumber: 3000
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
uid: falam
cn: Fosiul Alam
homeDirectory: /home/falam
userPassword:: e1NTSEF9UGtqNjhvSU1pSR0RrSWNYYkVvYVU2V2c9PQ=
=
# search result
search: 3
result: 0 Success
# numResponses: 2
# numEntries: 1
and in the access log :
28/Jul/2012:15:42:57 +0100] conn=229 fd=70 slot=70 connection from
192.0.0.4 to 192.0.0.9
[28/Jul/2012:15:42:57 +0100] conn=229 op=0 EXT
oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[28/Jul/2012:15:42:57 +0100] conn=229 op=0 RESULT err=0 tag=120
nentries=0 etime=0
[28/Jul/2012:15:42:57 +0100] conn=229 SSL 256-bit AES
[28/Jul/2012:15:42:57 +0100] conn=229 op=1 BIND dn="cn=Directory
manager" method=128 version=3
[28/Jul/2012:15:42:57 +0100] conn=229 op=1 RESULT err=0 tag=97
nentries=0 etime=0 dn="cn=directory manager"
[28/Jul/2012:15:42:57 +0100] conn=229 op=2 SRCH
base="dc=fosiul,dc=lan" scope=2 filter="(cn=Fosiul Alam)" attrs=ALL
[28/Jul/2012:15:42:57 +0100] conn=229 op=2 RESULT err=0 tag=101
nentries=1 etime=0
[28/Jul/2012:15:42:57 +0100] conn=229 op=3 UNBIND
[28/Jul/2012:15:42:57 +0100] conn=229 op=3 fd=70 closed - U1
But From command line , when i do
[root@home ~]# id falam
id: falam: No such user
[28/Jul/2012:15:44:26 +0100] conn=230 fd=70 slot=70 connection from
192.0.0.4 to 192.0.0.9
[28/Jul/2012:15:44:26 +0100] conn=230 op=0 EXT
oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[28/Jul/2012:15:44:26 +0100] conn=230 op=0 RESULT err=0 tag=120
nentries=0 etime=0
[28/Jul/2012:15:44:26 +0100] conn=230 SSL 256-bit AES
[28/Jul/2012:15:44:26 +0100] conn=230 op=1 BIND dn="" method=128 version=3
[28/Jul/2012:15:44:26 +0100] conn=230 op=1 RESULT err=0 tag=97
nentries=0 etime=0 dn=""
[28/Jul/2012:15:44:26 +0100] conn=230 op=2 SRCH
base="dc=fosiul,dc=lan" scope=2
filter="(&(objectClass=posixAccount)(uid=falam))" attrs="uid
userPassword uidNumber gidNumber cn homeDirectory loginShell gecos
description objectClass"
[28/Jul/2012:15:44:26 +0100] conn=230 op=2 RESULT err=0 tag=101
nentries=0 etime=0
[28/Jul/2012:15:44:26 +0100] conn=230 op=-1 fd=70 closed - B1
So basically, ldapsearch is working but authentication is not working ..
Can any one please help me with this .
and i am using Centos 5.8
Fosiul.
11 years, 10 months
Question about users and groups in sub suffixes
by Paul Robert Marino
Hello every one
I have a strange problem Im trying to use 389 server in a large
organization and i have to break the directory into several sub
suffixes or root suffixes.
there is the scenario
I work for Large company A
Large company A owns
1) subsidiary b
2) subsidiary c
3) subsidiary d
Large company A uses domain example.com
subsidiary b uses domain b.example.com
subsidiary c uses domain c.example.com
subsidiary d uses domain d.example.com
I would like to separate each of the subsidiaries into their own sub
suffix partially because of security reasons also to minimize unneeded
replication for local read only slaves at the subsidiary sites, and I
would also like the administrator at each subsidiary to have the
option of manage their own users or having the administrators at the
parent company do it for them.
now creating the sub suffix with its own database is fairly well
documented and works well with ou's but doesn't seem to work with
dc's
if i create the new suffix as a dc and go into the users and groups in
the console and try to add a user to the new dc it wont let me. if i
use the Users drop down menu and try to change directory and set the
base to the new dc (e.g. dc=b,dc=example,dc=com) it tells me the dc
isn't valid
I also tried creating a root suffix and ran into the same problem so
what am i missing?
Is there some initial database population step I didn't see in the
documentation or do i need to setup some ACIs or what?
11 years, 10 months
How create nisnetgrouptriple
by Fosiul Alam
HI
every where i see, it tells me to create nisnetgrouptriple by using from ldif .
but i am quite new to do that.
So i want to know how will i create this by using "centos-idm-console"
I already created organization group, nisgetgroupclass
Ou=netgroup
cn=puppet
Now i need to create nisnetgrouptriple where i will be able to enter
server name
but dont understand how will i create that .
Can any one please give me some light how I will create that by using
centos-idm-console
Thanks for help
Fosiul.
11 years, 10 months
How to export CA certificate into client from server
by Fosiul alam
Hi
I think i am very close to fix the issue
Please have a look to the bellow commands
I can do this from SErver or client ..
this result i get
root@home ~]# ldapsearch -x -ZZ -D "cn=Directory manager" -w xxxx -h
ldap-2.fosiul.lan -b "dc=fosiul,dc=lan"
# extended LDIF
#
# LDAPv3
# base <dc=fosiul,dc=lan> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# fosiul.lan
dn: dc=fosiul,dc=lan
dc: fosiul
objectClass: domain
objectClass: top
# uk, fosiul.lan
dn: l=uk,dc=fosiul,dc=lan
l: uk
objectClass: locality
objectClass: top
# groups, uk, fosiul.lan
dn: ou=groups,l=uk,dc=fosiul,dc=lan
objectClass: organizationalUnit
objectClass: top
ou: groups
# users, uk, fosiul.lan
dn: ou=users,l=uk,dc=fosiul,dc=lan
objectClass: organizationalUnit
objectClass: top
ou: users
# techops-uk, groups, uk, fosiul.lan
dn: cn=techops-uk,ou=groups,l=uk,dc=fosiul,dc=lan
gidNumber: 3000
objectClass: top
objectClass: groupofuniquenames
objectClass: posixgroup
cn: techops-uk
# falam, users, uk, fosiul.lan
dn: uid=falam,ou=users,l=uk,dc=fosiul,dc=lan
givenName: Fosiul
sn: Alam
loginShell: /bin/bash/bash
uidNumber: 1000
gidNumber: 3000
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
uid: falam
cn: Fosiul Alam
homeDirectory: /home/falam
userPassword:: e1NTSEF9UGtqNjhvazF1SFR0NUR5T0Roa2FSU1pSR0RrSWNYYkVvYVU2V2c9PQ=
=
# search result
search: 3
result: 0 Success
# numResponses: 7
# numEntries: 6
so falam is in LDAP
so from linux client or server
if i type
id falam
or ssh falam@ldap-2
it should accept the password
but i get this
[root@home ~]# id falam
id: falam: No such user
or
Jul 28 13:31:33 ldap-2 sshd[6071]: pam_succeed_if(sshd:auth): error
retrieving information about user falam
Jul 28 13:31:34 ldap-2 sshd[6071]: Failed password for invalid user
falam from 192.0.0.4 port 60072 ssh2
Please help with my last problem
thanks
11 years, 10 months
How to export CA certificate into client from server
by Fosiul alam
Hi Thanks
no i think its fine ..
I was trying with ldap-2 only
but when i use faqdn name its work
llike bellow
ldapsearch -x -ZZ -D "cn=Directory manager" -w password -h
ldap-2.fosiul.lan -b "dc=fosiul,dc=lan"
Which is returning all result ( if i try from server)
example (last few lines)
uid: falam
cn: Fosiul Alam
homeDirectory: /home/falam
userPassword:: NUR5T0Roa2FSU1pSR0RrSWNYYkVvYVU2V2c9PQ=
=
# search result
search: 3
result: 0 Success
# numResponses: 7
- Ignored:
# numEntries: 6
does it mean its ok ??
but when when i do : ( From ldap server)
[root@ldap-2 ~]# ldapsearch -x -ZZ '(uid=falam)'
# extended LDIF
#
# LDAPv3
# base <> with scope subtree
# filter: (uid=falam)
# requesting: ALL
#
# search result
search: 3
result: 0 Success
its not getting anything ..
what to do
Thanks for your help
11 years, 10 months
How to export CA certificate into client from server
by Fosiul alam
Hi
thanks I understand i will have to start from scratch for certificate
.. but few explanation i need
My ldapserver host name is : ldap-2.fosiul.lan
and I just cn="Directory Manager"
so according to those info.. what shall i put in ,
dc=directory ???
and
cn=directory.example.com" ???
My server hostname or "Directory Manager"
# certutil -S -n "CA certificate" -s "cn=CA
cert,dc=directory,dc=example,dc=com" -2 -x -t "CT,," -m 1000 -v 720 -d . -k
rsa
Make sure you say yes to "Is this a CA certificate [y/N]?" and everything
else will be default.
Next we create your server cert. Make sure your cn is your FQDN of this
server.
# certutil -S -n "directory-Server-Cert" -s "cn=directory.example.com" -c
"CA certificate" -t "u,u,u" -m 1001 -v 720 -d . -k rsa
Thanks for your help .
Really appreciate ..
11 years, 10 months
How to export CA certificate into client from server
by Fosiul alam
Hi
I am not getting reply by email, so i cant click on reply...
how will i get reply by email ??
@<arpittolani(a)gmail.com>
i think i have done something wrong to create certs
I have used bellow script to create all the certificate :
https://github.com/richm/scripts/blob/master/setupssl2.sh
now when i do this ,i get bellow error ..
ldapsearch -x -ZZ -D "cn=Directory manager" -w password -h ldap-2 -b
"dc=fosiul,dc=lan"
ldap_start_tls: Connect error (-11)
additional info: TLS: hostname does not match CN in peer certificate
11 years, 10 months
How to export CA certificate into client from server
by Fosiul alam
Hi
Dont know how to reply on same thread.
but thank for quick reply.
its case sensitive. so I created the cert file
and i put that one into client , and i configured as documentated
/etc/openldap/ldap.conf
URI ldap://ldap-2.fosiul.lan/
BASE dc=fosiul,dc=lan
TLS_CACERTDIR /etc/openldap/cacerts/
TLS_REQCERT allow
#TLS_CACERT /etc/openldap/cacerts/cacert.asc
and in /etc/ldap.conf
base dc=fosiul,dc=lan
uri ldap://ldap-2.fosiul.lan/
ssl start_tls
tls_cacertdir /etc/openldap/cacerts/
#TLS_CACERT /etc/openldap/cacerts/cacert.asc
pam_password md5
and i can see it created another file in /etc/openldap/cacerts/ directory
like ths
5be5959f.0 ds-ca.crt
and when i do like this
id usrname
it does not find the user and i dont see any error in /var/log/message
so its like its connecting to ldap. .but it does not get any information
do i have to say Cn="Directory Manager" some where in ldap.conf file ??
thanks for your help.
Fosiul
but in clients , log file
11 years, 10 months
How to export CA certificate into client from server
by Fosiul alam
Hi
Thanks for reply.
but there is a problem ..
is there is the example
certutil -d . -L
Certificate Nickname Trust
Attributes
SSL,S/MIME,JAR/XPI
CA certificate CTu,u,u
server-cert u,u,u
Server-Cert u,u,u
[root@ldap-2 slapd-ldap-2]# certutil -d . -L -n "CA Certificate" -a >
/root/ds-ca.crt
certutil: Could not find cert: CA Certificate
: File not found.
so it does not find the file ..
whats shall i do ??
Thanks
11 years, 10 months