memberOf task problem
by John A. Sullivan III
Hello, all. We are in the process of upgrading from 8.0 to 8.1. We've
hit a few glitches along the way but most has gone well. However, we
wanted to implement the new memberOf functionality. We successfully
added the plugin by editing dse.ldif and enabled it from the console.
However, we've been unsuccessful in having existing group membership
assigned to the memberOf attribute.
We first tried to run fixup-memberOf.pl but the script does not exist.
There is a template.fixup-memberOf.pl but this does not seem to have
been built into a final script.
We then thought we would use the new task feature of the console. We
went to cn=memberof task,cn=tasks,cn=config and tried to create the task
object. There was no nsDirectoryServerTask objectclass. We added an
nstask but then found there was no basedn attribute we could add. We
then created an extensibleobject instead but still not basedn attribute.
Finally, we resorted to ldapmodify (we hesitated just because we are not
very familiar with the command line tools). First, we did:
dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
changetype: add
objectclass: top
objectclass: extensibleObject
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
The Internal Organization has several organizations under it (for
various clients) and then user organizational units under those
organizations. Although it generated no errors, it did not seem to
work. Perhaps I just don't know how to test it. However, the following
did not return an memberOf data:
/usr/lib64/mozldap/ldapsearch -b
"ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory
Manager" -w - -h ldap uid=myid memberOf
Doing /usr/lib64/mozldap/ldapsearch -b
"ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory
Manager" -w - -h ldap uid=myid
showed me plenty of attributes but nothing for memberOf
I also tried creating the task with a basedn of
ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz in case it did not
change objects lower in the tree. Still no success.
Finally I tried:
dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
changetype: add
objectclass: top
objectclass: nsDirectoryServerTask
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
adding new entry cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
ldap_add: Object class violation
ldap_add: additional info: unknown object class "nsDirectoryServerTask"
And received the expected unknown object class error.
What are we doing wrong? Are these documentation bugs? Are there
application bugs or do we simply not know what we are doing with tasks
and memberOf? How do we get the memberOf information into our existing
user objects? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
14 years, 4 months
Replication error
by Luke Altkom
Hello,
as a new member of this maillist, first of all I'd like to say hello to everybody :).
I have problem with replication on my three Fedora Directory Servers. All three have replication agreements (multiple master model), but in admin console I have following informations:
[on directory]
- with directory1: Incremental update has failed and requires administrator actionSystem error. Error Code: -1
- with directory2: Incremental update has failed and requires administrator actionSystem error. Error Code: -1
[on directory1]
- with directory: Incremental update succeeded
- with directory2: Incremental update succeeded
[on directory2]
- with directory: Incremental update succeeded
- with directory1: Incremental update succeeded
The problem is, that most of changes are made on server called "directory", but they didn't propagate to others two servers. I have googled for "Incremental update has failed and requires administrator actionSystem error", but results didn't gave me literally nothing. And because I'm not an experienced FDS user, I ask You for some clue(s) on what's going on and how to solve my problem.
Of course I can post more detailed info, but I don't know (yet) which information can have any value for You.
Best regards,
Luke.
14 years, 9 months
bulk initialization with MMR
by Gary Windham
We have a setup where we are running 2 servers behind a load balancer
(for HA purposes), where each of these servers is bulk-initialized
daily (via ldif2db.pl) with a large set of data fed to us via batch
extracts from various administrative systems. Up till now, there has
been no need to configure replication between these 2 servers, as all
of the data is read-only. However, we now have a requirement to
update some of the directory data in a "real-time" fashion (e.g., when
particular events fire in our PeopleSoft system we want to update the
directory)--hence, the need for MMR. The batch extracts will still be
our "checkpoints", so we will want to load them in once-per-day, as we
do now.
So, the question is: what would be the "recommended" approach for a
scenario like this? How do we (can we?) make MMR coexist peacefully
with frequent bulk initializations?
TIA,
--Gary
--
Gary Windham
Senior Enterprise Systems Architect
The University of Arizona, UITS
+1 520 626 5981
14 years, 9 months
Schema replication
by Dumbo Q
I recently setup a new server as a dedicated consumer. My ldap queries return the results as expected, and my writes give me a referral response. I looked in the idm-console, and all my aci's seem to have copied over as well. As a test (not caring if i break anything), I made it writable (and no this was not an attempt to make it multimaster). When i tried to change my givenName i am getting the following error.
modifying entry "uid=dumbo,ou=people,dc=example,dc=com"
ldapmodify: Object class violation (65)
additional info: unknown object class "radiusprofile"
This makes me believe that my schema did not move over correctly from the other server. Everything I read says that either replication will do this for me, or that I can copy over any custom schema files manually and restart the server.
I diffed the schema directories between the two servers. The 99user.ldif was slightly different (just a hostname difference), and my 60radius.ldif was not present on my new server. I shut down the directory, and then copied over the radius file, and restarted. However it is still not working.
What didn't replication take care of that? What am I doing wrong?
14 years, 10 months
Re: [389-users] Finger slow and optimizing performance
by Barramundi K
Not sure what is the "finger" you meant.
32 bit OS definitely have limitation of using only 3 - 3.5GB, if you
allocate more cache size than this (or around 70-80% of that figure), it
will be in swap causing awful performance.
Regards
BL
14 years, 10 months
Single Master, Multiple Slave with NO Configuration Server Question
by Vince Tingey
Hi everyone, I posted this last week but nobody replied. I thought I
would send it out there one more time as I'd really like to know what
you experts think. The documentation about what benefits using a
configuration server gives you is lacking.
Just wondering if there are any problems I should be aware of if I want
to setup a single master multiple slave scenario WITHOUT using the
master as a configuration server and just replicating our directory
database (not o=Netscape Root). I'm ok having to connect to the slave
admin servers individually instead of them all showing up in the console
when I connect to the master admin server. Are there any other drawbacks?
What are the benefits of using a configuration server in this scenario?
Thank you,
--
Vince | Michael Smith Laboratories
IT Systems Coordinator | University of British Columbia
14 years, 10 months
samba error...
by Michael Jonsson
Hi,
I need help, I have try to setup the DS with samba.
when I follow the samba guide, I get som error.
#########################
[root@serv389 samba]# smbpasswd -a Administrator
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
add_new_domain_info: failed to add domain dn=
sambaDomainName=KUNDDOMAIN,dc=kunddomain,dc=se with: Insufficient access
Insufficient 'add' privilege to add the entry
'sambaDomainName=KUNDDOMAIN,dc=kunddomain,dc=se'.
smbldap_search_domain_info: Adding domain info for KUNDDOMAIN failed
with NT_STATUS_UNSUCCESSFUL
New SMB password:
Retype new SMB password:
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Failed to initialize account for user Administrator:
NT_STATUS_ACCESS_DENIED
Failed to modify password entry for user Administrator
#################################
[root@serv389 samba]# pdbedit -U $( net getlocalsid | sed 's/SID for
domain KUNDDOMAIN is: //' )-500 -u Administrator -r
[2009/06/28 15:28:53, 0] lib/smbldap.c:smb_ldap_start_tls(600)
Failed to issue the StartTLS instruction: Protocol error
[2009/06/28 15:28:54, 0] lib/smbldap.c:smb_ldap_start_tls(600)
Failed to issue the StartTLS instruction: Protocol error
[2009/06/28 15:28:55, 0] lib/smbldap.c:smb_ldap_start_tls(600)
Failed to issue the StartTLS instruction: Protocol error
[2009/06/28 15:28:56, 0] lib/
smbldap_util.c:smbldap_search_domain_info(310)
smbldap_search_domain_info: Adding domain info for KUNDDOMAIN
failed with NT_STATUS_UNSUCCESSFUL
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
add_new_domain_info: failed to add domain dn=
sambaDomainName=KUNDDOMAIN,dc=kunddomain,dc=se with: Insufficient access
Insufficient 'add' privilege to add the entry
'sambaDomainName=KUNDDOMAIN,dc=kunddomain,dc=se'.
smbldap_search_domain_info: Adding domain info for KUNDDOMAIN failed
with NT_STATUS_UNSUCCESSFUL
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
add_new_domain_info: failed to add domain dn=
sambaDomainName=KUNDDOMAIN,dc=kunddomain,dc=se with: Insufficient access
Insufficient 'add' privilege to add the entry
'sambaDomainName=KUNDDOMAIN,dc=kunddomain,dc=se'.
smbldap_search_domain_info: Adding domain info for KUNDDOMAIN failed
with NT_STATUS_UNSUCCESSFUL
Failed to issue the StartTLS instruction: Protocol error
Connection to LDAP server failed for the 1 try!
Username not found!
[root@serv389 samba]#
regards
micke
14 years, 10 months
Finger slow and optimizing performance
by Hartmann, Tim
Hi!
I was spending some time today trying to make sure that I was getting
the most bang for my buck today an my replica's and I notices two items
of interest that I was wondering if anyone else had input on!
Firstly, after creating a number of indexs, my performance seems to be
really good, the exception that I noticed was "finger" I noticed that
finger takes a couple of seconds to return the data on RHDS whereas on
OpenLDAP, it pops right now in real time! My first though was that I was
doing an un-indexed search, but I can't for the life of me figure out
what I might not be indexing that I should be!
The second thing I noticed was that on my servers, which are RHEL5,
running 32bit OS's with the PAE Kernels, RHDS doesn't ever actually
address more then 3 gig of ram! I was looking through the
documentations, and it looks like by raising the "Maximum Cache Size"
I'll be able to allow RHDS to use more of the available memory.. did I
get that right?
Anyway, as always thanks in advance for all the help! This list has been
a tremendous resource for an application that keeps on showing it's
value in huge ways!
Best,
Tim
14 years, 10 months
Promote a consumer to become a multimaster supplier
by Dumbo Q
I have setup my 1st directory server and have it running the way i would like it to. The next step for me was to create a second server so that I have two masters. Since I have not done this before, I thought it would make sense to make the second server a consumer only first, and then change it to become multi-master. This was partiallly just to teach myself how to setup a consumer.
Following redhats docs I set up the consumer, and it worked instantly with no trouble. However I'm having a lot of trouble figuring out how to make this multimaster. I am not making too much sense out of multimaster documentation that i've found in the redhat deploy, install, and admin manuals. Does anyone have some better documentation about how to do this?
14 years, 10 months
