389-users February 2009

389-users@lists.fedoraproject.org

46 participants
45 discussions

[Fedora-directory-users] Referential Integrity
by Hartmann, Tim 09 Feb '09

09 Feb '09

So After my trials and tribulations with " Referrals for Update Operations" (thanks again, you guys rock!) hence known as "Tim's continuing LDAP Saga and Viking Cha-Cha" I came across "Referential Integrity" in the docs, and boy howdy does it look useful! http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Creating_Directory_Ent… I had a couple of concerns, before I enabled it that I was hoping people could chime in on! 1) I'd like to have Referential Integrity monitor the memberUid field as well, but I was unclear in the documentation if when scanning the directory if it scans ALL the directories hosted by a given server, or just searches in the directory where the user was deleted? for example, I have two root suffixes, both of which contain users and groups , and more often then we'd like user "foo" exists in both... dc=example,dc=edu dc=dept,dc=example,dc=edu if I delete user uid=foo,ou=People,dc=dept,dc=example,dc=edu would the Referential Integrity plug in know to leave any instance of "uid=foo" and "memberUid=foo" in the dc=example,dc=edu branch alone? 2) I have 2 Masters (set up to be Multi Masters) and 4 Replica's, There are a number of warnings about setting this up only on 1 of the Masters (which shouldn't be a problem), in the case that M1 is configured with the Referential Integrity plug in, and it goes down for some amount of time, and a user is deleted, will the plugin "Catch up" once M1 has been brought back online? Thanks for the input! Tim

4 11

[Fedora-directory-users] Modify Admin Port via LDIF
by Chun Tat David Chu 06 Feb '09

06 Feb '09

Hi all, I have a question. Can you modify the admin port via LDIF? If so, can you tell me where is the admin port located and what attributes I should set. Thanks in advance! - dc

2 2

Re: [Fedora-directory-users] Challenges with Fedora DS
by Premod Dev 06 Feb '09

06 Feb '09

Hi Oserome, Why cant you try as follows, • Create multiple masters (multi master replication) • Use a load balancer ( hardware or software ie like linux virtual server) for load balance between these multi master servers. • Give a common fqdn in SAMBA which should resolve to load balancer and rest will do the load balancer. Thanks, Premod ----- Original Message ----- From: "osereme.osobase" <osereme.osobase(a)gtbank.com> To: fedora-directory-devel(a)redhat.com Cc: fedora-directory-users(a)redhat.com Sent: Wednesday, February 4, 2009 11:54:37 PM GMT +05:30 Chennai, Kolkata, Mumbai, New Delhi Subject: [Fedora-directory-users] Challenges with Fedora DS Hi, I currently use Fedora-DS integrated with Samba as my domain controller in an organization with 141 offices. With only one domain controller I am able to authenticate a user population of 5000 users, however as my organization grows I have challenges daily with authentication. Every morning users trying to logon to my Windows domain keep getting errors while siging on and this frequently leads to account lockouts and frustation of users. After going through your documentation on multiple load balanced FDS server installation I still have all traffic coming to one server on the network. My challenge is setting up FDS in the data centre on multiple servers to authenticate my users while accommodating growth. Is there any suggestion you can offer me or documentation where I can go through setup of a centalized FDS cluster for a large user base? I will greatly appreciate any help you can proffer. Regards Osereme Osobase Enterprise Infrastructure Support Technology GTBank Nigeria - http://www.gtbank.com -- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users

2 2

[Fedora-directory-users] Do you use WinSync for group sync?
by Rich Megginson 06 Feb '09

06 Feb '09

We're currently investigating the group sync feature of Windows Sync, and we wanted to know how it is deployed. Do you sync groups? What types of groups? Security or Distribution? Global or Local? Do the groups have "meaning" in both AD and Fedora DS, or only in one side?

3 7

[Fedora-directory-users] Question about Red Hat Directory Source Code
by Chun Tat David Chu 05 Feb '09

05 Feb '09

Hi All, I know that Fedora Directory and Red Hat Directory is essentially same except that Fedora Directory is usually newer than Red Hat Directory. My question is I know I can get the source code of Fedora Directory but what about Red Hat Directory? I thought Red Hat Directory is also open source, is it possible to look at Red Hat Directory source? Thanks in advance! - David

4 8

[Fedora-directory-users] [OT?] tls_checkpeer yes problems
by John A. Sullivan III 05 Feb '09

05 Feb '09

Hello, all. This may be a bit off-topic as it is primarily an ldap client issue but I am having a bear of a time getting my test centos clients to access fds. The problem is tls_checkpeer. I do want it set to yes but this breaks access. It is as if the directory server's cert cannot be validated against the CA cert. Here are the pertinent settings from my centos client ldap.conf (as you can see, I've tried many combinations): uri ldap://ldap.mycompany.com/ #host ldap.mycompany.com #ssl on ssl start_tls #tls_cacertdir /etc/pki/tls/certs tls_cacertfile /etc/pki/tls/certs/SSICA.pem pam_password md5 tls_checkpeer yes tls_ciphers TLSv1 An strace shows that the SSICA.pem file is opened. Apparently, this is a problem in Ubuntu because of a change to gnutls. However, I can confirm the combination of uri ldap://, ssl start_tls, and tls_certfile rather than tls_certdir work on Ubuntu. My problem is redhat style systems. Our test bed is CentOS 5.2. Does anyone have this working on newer redhat based systems? If so, with what configuration? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

2 2

[Fedora-directory-users] Challenges with Fedora DS
by osereme.osobase 04 Feb '09

04 Feb '09

Hi, I currently use Fedora-DS integrated with Samba as my domain controller in an organization with 141 offices. With only one domain controller I am able to authenticate a user population of 5000 users, however as my organization grows I have challenges daily with authentication. Every morning users trying to logon to my Windows domain keep getting errors while siging on and this frequently leads to account lockouts and frustation of users. After going through your documentation on multiple load balanced FDS server installation I still have all traffic coming to one server on the network. My challenge is setting up FDS in the data centre on multiple servers to authenticate my users while accommodating growth. Is there any suggestion you can offer me or documentation where I can go through setup of a centalized FDS cluster for a large user base? I will greatly appreciate any help you can proffer. Regards Osereme Osobase Enterprise Infrastructure Support Technology GTBank Nigeria - http://www.gtbank.com

1 0

Re: [Fedora-directory-users] dirsrv-admin does not start and hangs without error messages
by Eric 04 Feb '09

04 Feb '09

2 3

[Fedora-directory-users] mail aliases in directory
by Jan-Frode Myklebust 04 Feb '09

04 Feb '09

I'm in the process of migrating to keeping all users and mail aliases in a directory server. For people-objects we use the object classes 'top', 'person' and 'mailRecipient', but I'm a bit confused as to how to store pure email aliases that are not connected to specific accounts. I think we'll want to store these in a separate ou (ou=aliases), but what's the correct set of object classes to use ? 'mailRecipient' gives me all the attributes, but isn't structural. I found the ldapSubEntry structural class that seems fitting (gives me structure, and nothing else), but from reading the deployment guide that seems to not be what we want.. (doesn't show up in normal searches). # dn: mail=test(a)example.com,ou=aliases,o=example.com,o=ISP,o=mydomain,c=NO # changetype: add # objectClass: ldapSubEntry # objectClass: top # objectClass: mailRecipient # mail: test(a)example.com # mailForwardingAddress: test(a)sometherdomain.net Any hints to what class should be used here instead of ldapSubEntry? -jf

2 2

RE: [Fedora-directory-users] Updating Consumer replica fails referralto the master from the console.
by Howard Chu 04 Feb '09

04 Feb '09

> Date: Mon, 2 Feb 2009 13:26:18 -0800 > From: "Chavez, James R."<james.chavez(a)sanmina-sci.com> > Hi Rich, > Thank you for your previous response..The answer was actually embedded > within your statement I believe. > > "This is a problem in general with some older clients that do not know > how to properly follow LDAPv3 referrals" > > I used the mozldap ldapmodify tool and it worked to update entries that > I point at the consumer. I would have never guessed the openldap tool > would not follow LDAPv3 referrals. Maybe a switch I missed or something. > Thanks again for your suggestion. The automatic referral chasing code in OpenLDAP's command line tools was deprecated years ago. It's a security vulnerability: most of the time it will hand your username and plaintext password to any arbitrary server without any warning. Referrals are a gross flaw in the design of LDAP and should not be used. Distributed servers should use chaining to hide this detail from clients. Clients are not in any position to know whether or to what degree to trust the referred server, or what authentication domain or credentials are relevant on the referred server. Only the server admin knows these details; putting these decisions at the client is wrong. -- -- Howard Chu CTO, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

4 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2009