[Fedora-directory-users] Call for a replication project
by Hartmut Wöhrle
Hello everybody.
I'd like to start a discussion about extending the replication possibilities
of FDS, because from my problem with NT synchronization, I got some
ideas.... ;)
What I learned from the Winsync tool is the following:
FDS connects via LDAP to the JAVA based ApacheDS on the Windows PDC. So in
fact it is a connection between two LDAP directories. Next it connects to the
NT database via an API service-to-service connect and gets the needed data to
synchronize users to the FDS.
So why not extending this way of getting data from a non-LDAP system to the
FDS, for example a database. The technique I have in mind would go the
following way (same as Winsync):
FDS --> ApacheDS --> connector to the service
and the data back.
So the connection FDS to ApacheDS is standart ldap/ldaps. What's needed is a
plug for the connector. Then the connector could be programmed in any way:
- script to read out a perl script and change values to LDAP schemas
- call a programm with parameters (database SELECT, or cyrusadm with params)
- something like an API or socket connect
In my case I'm thinking about a connection with a SAP HR database, which
exports the data in an IDOC format (flat file). So first I had in mind to scp
this file to the FDS server, rewrite it in a LDIF format and read it in by
ldapmodify. But using the way above would look the following way:
A connector rewrites the IDOC format to LDIF and hands it over to the
ApacheDS, which sends it (like the Winsync) to the FDS.
The advantage from this method is the ldaps connection that I can use for
transmit, instead of scp or sftp.
The other advantage is, that the ApacheDS is based on JAVA, so could easier be
ported to other systems. Then the only OS-dependent part is the connector.
And this one could be programmed for every needed case.
What do you think about this - or is there any need for something like this?
CU
Hartmut
--
===========================================
Hartmut Woehrle
EMail: hartmut.woehrle(a)mail.pcom.de
18 years, 4 months
[Fedora-directory-users] Change port after setup
by Daniel Shackelford
Hello all,
I was wondering if there was a way to change the ldap port once the
server has been setup. Here is the situation: I have a version of 7.1
that is running, but the sync is pretty messed up, and only some OUs are
syncing with AD. I installed version 1.0 and it seems to run just
dandy-fine, but the portal that needs to use the directory is having
trouble using 1.0 to authenticate. So I would like to have both
running, on different ports. 7.1 is running now, and I can change the
ports through the console, but it works for the portal, so I would
rather not touch it. 1.0 is not running, but I would like to start it
up on a different port (say 388, or 390), but it is a bit messy it seems
to do it through direct edits of config files in the slapd directory.
Is there another way?
--
Daniel Shackelford
Systems Administrator
Technology Services
Spring Arbor University
517 750-6648
"For even the Son of Man did not come to be served, but to serve, and to give His life a ransom for many"
Mark 10:45
18 years, 4 months
[Fedora-directory-users] Server Side Sorting limitations/configuration
by Thierry Lanfranchi
Hello,
I've noticed a strange behavior when I do a substring search based on
only one letter, my results are not sorted.
When I search for (&(objectClass=inetOrgPerson)(sn=FA*)), I get
immediate sorted results,
but when I search for (&(objectClass=inetOrgPerson)(sn=Y*)), I get
immediate results, unsorted, despite results being less numerous than
previous requests' results.
Is that "not sorting on single letter search" feature wanted (maybe even
RFC stuff that I haven't read yet), and if so, can I enable sorting even
in that case, or is it to be considered a strange behavior and I need to
look for more informations in order to solve it ?
Just in case, my user class is not inetOrgPerson, but a class I defined
inheriting from inetOrgPerson with added attributes. Mentionning it just
in case...
Thanks in advance for your answers,
Thierry
18 years, 4 months
[Fedora-directory-users] a little bit of samba confusion
by Craig White
First, imported nearly my entire openldap structure...but couldn't
import this record
dn: sambaDomainName=AZAPPLE,dc=azapple,dc=com
objectClass: sambaDomain
sambaDomainName: AZAPPLE
sambaSID: S-1-5-21-1423820788-2381578139-3444021595
sambaAlgorithmicRidBase: 1000
Easy enough to recreate in console but didn't understand the error...
[03/Dec/2005:11:24:28 -0700] - Entry
"sambaDomainName=AZAPPLE,dc=azapple,dc=com" -- attribute "objectClass"
not allowed
when I added it to the console, it added top & organizationUnit
objectclasses...are these required?
Second, console application - when you go to the properties of a 'user',
there seems to be templates for 'user-languages-ntuser-posixuser-
account' but nothing for samba. Is there a samba template?
Craig
18 years, 4 months
[Fedora-directory-users] Fedora-ds on ubuntu
by brendan powers
Hello, i have compiled fedora-ds on ubuntu, and almost installed it.
The installer does not correctly find apache. It asks for the path
where apache is installed. I am running ubuntu 5.10 with apache 2
installed. I have created links from /usr/sbin/apache2>httpd
/etc/apache2>httpd and /usr/lib/apache2>httpd
Here is the error i get from the installer
Unable to locate Apache modules in
/modules
.
Press any key to continue.
Does anyone know what the installer is looking for? Has anyone
compiled this in ubuntu before.
Once i get this working i plan to create packages for ubuntu 5.10 and
debian sarge.
Thanks for your time.
18 years, 4 months
[Fedora-directory-users] Creating Replication Agreements at the Command Line (again)
by Del
I am trying to set up a two-master replica using this script:
http://directory.fedora.redhat.com/wiki/Howto:MultiMasterReplication
It creates the necessary replication objects, and then continually
reports the following error message in the log files:
[01/Dec/2005:18:55:04 +1100] NSMMReplicationPlugin - agmt="cn="Replication to fc3-dbw-2.babel.office"" (fc3-dbw-2:389): Replication bind to cn=repman,cn=config on consumer failed: 32 ()
(on both servers).
I assumed that this was a password problem so I tried changing the
password to cn=repman,cn=config on the server and in the
replication agreement, and now I get the error message:
[01/Dec/2005:18:41:14 +1100] NSMMReplicationPlugin - agmt="cn="Replication to fc3-dbw-1.babel.office"" (fc3-dbw-1:389): Replica has a different generation ID than the local data.
I tried manually forcing the replica to happen via the console and
I still get the above error message.
Any ideas? I've tried rebuilding the DS from scratch a few times
and I still get the same thing.
--
Del
18 years, 4 months
[Fedora-directory-users] command line client usage and simple bind
by Craig White
If this is too newbie - please ignore (I'm used to openldap and I'm
struggling)
commands like ldapsearch only seem to work if my cwd is
/opt/fedora-ds/shared/bin
# cd ~
[root@lin-workstation ~]# ldapsearch
ldapsearch: error while loading shared libraries: libldap50.so: cannot
open shared object file: No such file or directory
anyway, I can cd /opt/fedora-ds/shared/bin but it's a PITA
the bigger problem, I wanted to simple bind and cannot do that...
# ldapsearch -v -b "ou=people,dc=azapple,dc=com" "(objectclass=*)"
gives me everyone in the container (I am obviously going to have to set
up ACL's)
# ldapsearch -v -b "ou=people,dc=azapple,dc=com" \
-D "cn=Directory Manager,dc=azapple,dc=com" -w - \
"(objectclass=*)"
and
# ldapsearch -v -b "ou=people,dc=azapple,dc=com" \
-D "cn=admin,dc=azapple,dc=com" -w - \
"(objectclass=*)"
both fail with
ldapsearch: started Sat Dec 3 13:32:13 2005
ldap_init( localhost, 389 )
ldap_simple_bind: No such object
ldap_simple_bind: matched: dc=azapple,dc=com
I know it must be something obvious that I am missing but I have tried
and tried with no success - is simple bind not permitted by default?
Craig
18 years, 4 months
[Fedora-directory-users] jre1.5 and other "bugs"
by Jon Jahren
Hi
I've been trying to get the directory server v1.0 working all day.
First my problem was that jre1.5 wasn't working right, it would just
hang with the splash screen telling me to log in, and no window to enter
username and password. I'd like to help troubleshoot it, but I do not
know what logs to look at and whatnot. This is on a system running a SMP
kernel, however, it didn't work in a regular kernel either.
That's my first question, where are the logs, or what debugging tools
could I use for this job?
Then there's this:
I replaced jre1.5 with j2re1.4 and it started "normally", which means
that I at least got to the login screen, but it gave me an error that
claimed the server hadn't started. And I had indeed ran ./setup/setup
and chosen what I thought to be correct values.
However, I had used the hostname that I regularly use, Embla, as a
hostname, and I had gotten this message when the script finished:
"Fatal Slapd The required field AdminDomain is not present in the
install info file.
ERROR: missing data from answer cache"
I reran the script, and this time I didn't use Embla for a hostname.
That got me a bit further, because I was given these messages, that I
didn't get before:
"[slapd-localhost]: [03/Dec/2005:15:05:21 +0100] - slapd started.
Listening on All Interfaces port 389 for LDAP requests
NMC_Status: 0
NMC_Description: Success! The server has been started.
Can't open /opt/fedora-ds/bin/slapd/admin/scripts/template-migrateTo4:
No such file or directory
Start Slapd Starting Slapd server reconfiguration.
Info Slapd No old nsperl references found"
After I got that message, I was still getting no server running, after
running start-admin.
So I stopped it, using stop-admin and then stopped slapd with
stop-slapd, I started slapd and then start-admin, and now it works! I
can log in and everything.
Now to my question: Are these bugs that should be reported, or are they
merely user errors? And how can I set it to use my hostname Embla?
Thanks in advance
Jon
18 years, 4 months
[Fedora-directory-users] samba & openldap
by Craig White
Newbie alert !!!
Are there any docs regarding...
1 - samba integration with Fedora-DS or even NsDS?
2 - documents that discuss converting openldap ldif with specific
attributes/objectclasses for openldap to fedora-ds? Utilities?
as those in the know would already know, an import of my slapcat from
openldap met with a rousing thud and it didn't take me long to figure
out why.
Craig
18 years, 4 months
