memberOf task problem
by John A. Sullivan III
Hello, all. We are in the process of upgrading from 8.0 to 8.1. We've
hit a few glitches along the way but most has gone well. However, we
wanted to implement the new memberOf functionality. We successfully
added the plugin by editing dse.ldif and enabled it from the console.
However, we've been unsuccessful in having existing group membership
assigned to the memberOf attribute.
We first tried to run fixup-memberOf.pl but the script does not exist.
There is a template.fixup-memberOf.pl but this does not seem to have
been built into a final script.
We then thought we would use the new task feature of the console. We
went to cn=memberof task,cn=tasks,cn=config and tried to create the task
object. There was no nsDirectoryServerTask objectclass. We added an
nstask but then found there was no basedn attribute we could add. We
then created an extensibleobject instead but still not basedn attribute.
Finally, we resorted to ldapmodify (we hesitated just because we are not
very familiar with the command line tools). First, we did:
dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
changetype: add
objectclass: top
objectclass: extensibleObject
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
The Internal Organization has several organizations under it (for
various clients) and then user organizational units under those
organizations. Although it generated no errors, it did not seem to
work. Perhaps I just don't know how to test it. However, the following
did not return an memberOf data:
/usr/lib64/mozldap/ldapsearch -b
"ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory
Manager" -w - -h ldap uid=myid memberOf
Doing /usr/lib64/mozldap/ldapsearch -b
"ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory
Manager" -w - -h ldap uid=myid
showed me plenty of attributes but nothing for memberOf
I also tried creating the task with a basedn of
ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz in case it did not
change objects lower in the tree. Still no success.
Finally I tried:
dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
changetype: add
objectclass: top
objectclass: nsDirectoryServerTask
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
adding new entry cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
ldap_add: Object class violation
ldap_add: additional info: unknown object class "nsDirectoryServerTask"
And received the expected unknown object class error.
What are we doing wrong? Are these documentation bugs? Are there
application bugs or do we simply not know what we are doing with tasks
and memberOf? How do we get the memberOf information into our existing
user objects? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
13 years, 5 months
OpenLDAP as a slave of Fedora Directory Server?
by Anne (juniper) Cross
I've been through the FDS/389 website, and the best I've come up with is
this: http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration
Unfortunately, that gives me the sync in the wrong direction. We have
pre-existing OpenLDAP servers that belong to a different group. We're
supposed to be their ultimate source of data - once we get set up - but
they won't change their servers from OpenLDAP because, as they say, they
know how they work and why should they do more work.
I don't need data synced back from OpenLDAP, but syncrepl doesn't appear
to do the right thing when pointed at an FDS directory server, so what's
the secret, undocumented method? Even a hint would help. Google just
keeps turning up pages where people have named their box "Fedora" and
it's all openldap to openldap.
--
,___,
{o,o} Anne "Juniper" Cross
(___) Senior Linux Systems Engineer and Extropic Crusader
-"-"-- Information Technology, ITA Software
/^^^
13 years, 9 months
Supported Extension
by Techie
Greetings all,
Is it possible to add the supportedExtension: 1.3.6.1.4.1.4203.1.11.1
to the 389 Directory server?
Thank you
13 years, 9 months
Samba integration with FDS and Heartbeat for HA Samba
by David Christensen
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
I successfully setup heartbeat and glusterfs (instead of DRBD) to
provide an HA Samba configuration. I tested that fail over worked fine
all the existing computers were able to get to their shares and re
authenticate users.
However I discovered that I was not able to join computers to the domain
after the configuration was setup. The netbios name was changed to
accommodate the new heartbeat VIP and the new VIP is the only address I
have samba bound to.
When I go to add the computer to the domain, type to the domain in and
hit enter, I am presented with a login dialog box. When I enter the
admin and password and hit enter, after a few seconds I get the warning
that a controller for the domain could not be foumd.
I suspect that there is some caching going on and (maybe) winbind is
using the old info for the PDC and not the new?
Are there any caches I could clear that may fix this? Am I on the right
track or is there somethign else I should be looking at?
When I compare the ldap access logs with and without heartbeat, there is
a difference in the query. As I previously mentioned, without
heartbeat, adding is successful, with heartbeat it is not. I found that
the search base is different:
With heartbeat - SRCH base="cn=groups,cn=accounts,dc=example,dc=com"
scope=2 filter="(&(objectClass=sambaGroupMapping)(gidNumber=99))"
attrs="gidNumber sambaSID sambaGroupType sambaSIDList description
displayName cn objectClass"
W/heartbeat - SRCH
base="sambaDomainName=exampleHQ,sambaDomainName=exampleHQ,dc=example,dc=com"
scope=2
filter="(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=exampleHQ))"
attrs=ALL
When I compared the logs when executing pdbedit -Lv with both setups,
the queries are the same.
Why would samba do a different query to the same instance of ldap when
configured with heartbeat and without heartbeat?
The address that samba is binding to/from for access to ldap is not the
VIP provided by heartbeat.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkpzTW4ACgkQ5B+8XEnAvqub1ACdGFBhVRaePH0fuTD0mORGIMgB
V48AnR0znBY9KD3nhYYdPtR2dQXUWxBO
=jrTm
-----END PGP SIGNATURE-----
13 years, 10 months
Re: [389-users] Chaining and LDAP_UNWILLING_TO_PERFORM problem
by Roberto Polli
On Wednesday 29 July 2009 18:35:56 you wrote:
> Roberto Polli wrote:
> > On Wednesday 29 July 2009 18:09:17 Rich Megginson wrote:
> >> Does this give any useful information?
> >> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Configuring_Directo
> >>ry_
> >> Databases-Creating_and_Maintaining_Database_Links.html#Creating_and_Main
> >>tain ing_Database_Links-Database_Links_and_Access_Control_Evaluation
> >
> > I read it more than once..made some slides too
> > http://docs.google.com/present/view?id=dd4mpk7p_10366hxdsmn
> >
> > nonethless I may have made some mistake.
> >
> > what I didn't understood is why - when updating userPassword - the remote
> > server states that
> >
> >> NSACLPlugin - proxied authorization dn is ()
> >
> > instead of
> >
> >> NSACLPlugin - proxied authorization dn is (uid=u1,ou=serv
> >> ice administrators,dc=babel,dc=it)
> >
> > hope this could clarify a bit my problem..
>
> Are you using the ldappasswd command to update the password?
ldapmodify:
dn: uid=pippo,dc=example,dc=com
changetype: modify
replace: userPassword
userPassword: pippo1242102d32d322d8321p8enxnc093212190cx321
> You may have to allow that component to chain.
> http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Configuring_Directo
>ry_Databases-Creating_and_Maintaining_Database_Links.html#Configuring_the_Ch
>aining_Policy-Chaining_Component_Operations
Even if I don't use SASL, anyway I enabled chaining of PasswordPolicy
controls, but nothing changes.
..
but..is it right that in aclplugin.c the function
acl_get_proxyauth_dn( pb, &proxy_dn, &errtext )
returns proxy_dn = "" ?
Peace,
R.
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
13 years, 10 months
Multimaster upgrade issues
by DANIEL CRISTIAN CRUZ
Hi all,
Does someone had problems upgrading a cluster with 2 multi-master servers
and several consumers?
We are planning a upgrade, first one master, than the other. Consumers will
be upgraded eventually.
Is the aproach correct?
Regards,
Daniel Cruz
13 years, 10 months
Db-link setup question
by Reinhard Nappert
Hi,
I have two LDAP Servers setup (Server A and Server B). Both of them have the identical suffix (o=suffix). Again, both of them have a people organizational unit (ou=people,o=suffix). Server B has a big subtree (ou=region B,ou=people,o=suffix).
My intension is to create a db link on Server A, which links to the ou=region B,ou=people,o=suffix subtree on Server B.
I did create the database link and a new suffix l=location B,ou=people,o=suffix on Server A with the following entries:
dn: cn=serverBlink,cn=chaining database,cn=plugins,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsBackendInstance
nsslapd-suffix: ou=region B,ou=people,o=suffix
nsfarmserverurl: ldap://serverB:389/
nsmultiplexorbinddn: cn=proxy admin,cn=config
nsmultiplexorcredentials: secret
cn: serverBlink
dn: cn="l=location B,ou=people,o=suffix",cn=mapping tree,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsMappingTree
nsslapd-state: backend
nsslapd-backend: serverBlink
nsslapd-parent-suffix: "ou=people,o=suffix "
cn: "l=location B,ou=people,o=suffix"
I am only interested in reading the server B information, when accessing from server A. The "proxy admin" user was created as well.
When I do a search with the base l=location B,ou=people,o=suffix, accessing server A, I always get the following error "Proxy dn should not be rootdn".
What did I miss for the setup?
Thanks,
-Reinhard
13 years, 10 months
using tasks question
by Techie
Hello,
I am looking to automate some things with cn=tasks?. I have read the
Task invocation info but no nsdirectoryservertask objectclass exists
even in the source from what I see.Where can I get the schema file
with this O class?
Thank you
13 years, 10 months
cache settings
by Nick Gresham
Hi All
I'm looking for some clarification (best practices) on setting cache
sizes for Fedora DS. What is the difference between the maximum cache
size under LDBM Plug-in settings tab and the cache size under
individual backends' Database Settings tab?
http://directory.fedoraproject.org/wiki/Performance_Tuning gives some
reference to disk cache and memory cache differences but I've been
unable to find further references.
Thanks
Nick
13 years, 10 months
Chaining and LDAP_UNWILLING_TO_PERFORM problem
by Giovanni Mancuso
Hi,
i try to configure 2 Directory Server with db link.
I have first DS that point to second DS that have DB in filesystem.
I create a proxy user in second DS:
# tproxy, config
dn: uid=tproxy,cn=config
uid: tproxy
givenName: test
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
sn: proxy
cn: test proxy
userPassword:: *********************************************
and i create in first DS the "Dababase link" that use this user to bind
in second DS.
In second DS i add the following aci:
(targetattr = "*") (target = "ldap:///dc=example,dc=com") (version
3.0;acl "AciChepermettetutto";allow (all)(userdn =
"ldap:///uid=tproxy,cn=config");)
(targetattr = "*") (target = "ldap:///dc=example,dc=com") (version
3.0;acl "proxy acl";allow (proxy)(userdn = "ldap:///uid=tproxy,cn=config");)
Bu if i try to execute the ldapserach in first directory server i have
the following error:
dapsearch -h localhost -x -p 20389 -D "cn=Directory Manager" -w
********* -b "dc=example,dc=com" "(objectclass=*)"
# extended LDIF
#
# LDAPv3
# base <dc=example,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 2
result: 53 Server is unwilling to perform
text: Proxy dn should not be rootdn
# numResponses: 1
If i enable verbose logging in my error log i have:
[15/Jul/2009:18:44:47 +0200] - activity on 65r
[15/Jul/2009:18:44:47 +0200] - => slapi_reslimit_get_integer_limit()
conn=0xb1557d68, handle=3
[15/Jul/2009:18:44:47 +0200] - <= slapi_reslimit_get_integer_limit()
returning NO VALUE
[15/Jul/2009:18:44:47 +0200] - read activity on
65
[15/Jul/2009:18:44:47 +0200] -
add_pb
[15/Jul/2009:18:44:47 +0200] - => slapi_reslimit_get_integer_limit()
conn=0xb1557c08, handle=3
[15/Jul/2009:18:44:47 +0200] - <= slapi_reslimit_get_integer_limit()
returning NO VALUE
[15/Jul/2009:18:44:47 +0200] -
get_pb
[15/Jul/2009:18:44:47 +0200] - conn 1 activity level =
2
[15/Jul/2009:18:44:47 +0200] - conn 1 turbo rank = 2 out of 3
conns
[15/Jul/2009:18:44:47 +0200] -
do_search
[15/Jul/2009:18:44:47 +0200] - =>
get_filter_internal
[15/Jul/2009:18:44:47 +0200] -
PRESENT
[15/Jul/2009:18:44:47 +0200] - <= get_filter_internal
0
[15/Jul/2009:18:44:47 +0200] get_filter - before optimize:
(objectClass=*)
[15/Jul/2009:18:44:47 +0200] get_filter - after optimize:
(objectClass=*)
[15/Jul/2009:18:44:47 +0200] - SRCH base="dc=example,dc=com" scope=2
deref=0 sizelimit=0 timelimit=0 attrsonly=0 filter="(objectClass=*)"
attrs=ALL
[15/Jul/2009:18:44:47 +0200] - =>
get_ldapmessage_controls
[15/Jul/2009:18:44:47 +0200] - => slapi_control_present (looking for
2.16.840.1.113730.3.4.2)
[15/Jul/2009:18:44:47 +0200] - <= slapi_control_present 0 (NOT FOUND)
[15/Jul/2009:18:44:47 +0200] - => slapi_control_present (looking for
1.3.6.1.4.1.42.2.27.8.5.1)
[15/Jul/2009:18:44:47 +0200] - <= slapi_control_present 0 (NOT FOUND)
[15/Jul/2009:18:44:48 +0200] - <= get_ldapmessage_controls 2 controls
[15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for
2.16.840.1.113730.3.4.3)
[15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 0 (NOT FOUND)
[15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for
2.16.840.1.113730.3.4.20)
[15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 0 (NOT FOUND)
[15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for
2.16.840.1.113730.3.4.14)
[15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 0 (NOT FOUND)
[15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for
1.3.6.1.4.1.42.2.27.9.5.2)
[15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 0 (NOT FOUND)
[15/Jul/2009:18:44:48 +0200] - mapping tree selected backend : example
[15/Jul/2009:18:44:48 +0200] - => slapi_reslimit_get_integer_limit()
conn=0xb1557cb8, handle=2
[15/Jul/2009:18:44:48 +0200] - <= slapi_reslimit_get_integer_limit()
returning NO VALUE
[15/Jul/2009:18:44:48 +0200] - => slapi_reslimit_get_integer_limit()
conn=0xb1557cb8, handle=1
[15/Jul/2009:18:44:48 +0200] - <= slapi_reslimit_get_integer_limit()
returning NO VALUE
[15/Jul/2009:18:44:48 +0200] - => compute_limits: sizelimit=2000,
timelimit=3600
[15/Jul/2009:18:44:48 +0200] - Calling plugin 'ACL preoperation' #1 type 403
[15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for
2.16.840.1.113730.3.4.12)
[15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 1 (FOUND)
[15/Jul/2009:18:44:48 +0200] - => send_ldap_result 53::Proxy dn should
not be rootdn
[15/Jul/2009:18:44:48 +0200] - flush_ber() wrote 43 bytes to socket 65
[15/Jul/2009:18:44:48 +0200] - <= send_ldap_result
[15/Jul/2009:18:44:48 +0200] - mapping tree release backend : example
[15/Jul/2009:18:44:48 +0200] - slapi_filter_free type 0x87
[15/Jul/2009:18:44:49 +0200] - => slapi_reslimit_get_integer_limit()
conn=0xb1557d68, handle=3
[15/Jul/2009:18:44:49 +0200] - <= slapi_reslimit_get_integer_limit()
returning NO VALUE
[15/Jul/2009:18:44:49 +0200] - => slapi_reslimit_get_integer_limit()
conn=0xb1557cb8, handle=3
[15/Jul/2009:18:44:49 +0200] - <= slapi_reslimit_get_integer_limit()
returning NO VALUE
[15/Jul/2009:18:44:49 +0200] - => slapi_reslimit_get_integer_limit()
conn=0xb1557c08, handle=3
[15/Jul/2009:18:44:49 +0200] - <= slapi_reslimit_get_integer_limit()
returning NO VALUE
[15/Jul/2009:18:44:49 +0200] - listener got signaled
[15/Jul/2009:18:44:53 +0200] - Event id a19b958 called at 1247676293
(scheduled for 1247676293)
[15/Jul/2009:18:44:55 +0200] - ldbm backend flushing
[15/Jul/2009:18:44:55 +0200] - ldbm backend done flushing
[15/Jul/2009:18:44:55 +0200] - ldbm backend flushing
[15/Jul/2009:18:44:55 +0200] - ldbm backend done flushing
The problem seems the "ACL preoperation" plugin. Indeed if i disable
this plugin, it WORKS.
But i cannot disable this plugin.
Any ideas to solve the problem??
Thanks and sorry in advance for my bad English
//
13 years, 10 months
