October 2010 - 389-users - Fedora mailing-lists

Re: [389-users] sub-suffix creation
by Angel Bosch Mora 15 Oct '10

15 Oct '10

----- Missatge original ----- > Hi > I a bit confused... have you successfully created the entry using the > console and am looking for a ldif example? Or did the creation failed > in the console. I can give you examples of how we create our tree and > sub suffixes if that will help, they are all in ldif format. > i've found some additional info here: http://docs.sun.com/source/816-6698-10/suffixes.html#16762 i was a little bit lost but i've finally managed to create an entry trhough console. all examples i found were using ldif and command line for entry creation, but is really easy with console. just be carefull with using the exact same name as in the suffix database creation. thanks for your time, anyway. abosch

1 0

sub-suffix creation
by Angel Bosch Mora 15 Oct '10

15 Oct '10

hi, im trying to create the entry for a sub-suffix i've created in the console but i can't find any instruction. i've followed official docs: http://www.centos.org/docs/5/html/CDS/ag/8.0/Configuring_Directory_Database… but there's no info about entries, just databases. any clue? abosch

2 1

incorrect DNs sometimes returned on searches: 1.2.6 and 1.2.6.1
by Eric Torgersen 15 Oct '10

15 Oct '10

Hello, We recently started using the 389 Directory Server and are seeing an odd problem where searches start returning the wrong DN for a small number of entries in our directory. For example, our users are in ou=People,dc=acs,dc=albany,dc=edu but for a few user entries the server starts returning the DN as "uid=(username),dc=acs,dc=albany,dc=edu," "uid=(username),ou=Group,dc=acs,dc=albany,dc=edu," or sometimes even something like "uid=(username),=albany,,dc=acs,dc=albany,dc=edu." The problem seems to be in memory, as restarting the directory server fixes the problem temporarily but then it will start happening again with a different set of entries. A db2ldif extract made while the server is in this state does not contain any of the bad DNs. I tried upgrading to 1.2.6.1-2. Since the upgrade, this has not happened for any user entries, but has happened for group entries. Has anyone else run into this problem? We are running 389 Directory Server on Oracle Linux 5.5 and using the x86_64 389 DS packages from EPEL. We have about 125,000 entries in our directory, most of which are in ou=People. We recently migrated from the Sun Directory Server 5.2. Thanks, Eric Eric Torgersen Assistant Director ITS Systems Management & Operations 518-437-3665

2 5

ldap_add: Already exists (68)
by Chun Tat David Chu 13 Oct '10

13 Oct '10

Hi All, After upgrading 389 Directory Server, I am getting a "ldap_add: Already exists (68)" error message when importing a used to be working LDIF via the ldapmodify command. Can someone help me to confirm that they are seeing the same thing? Adding the entry itself is fine but the problem occurs when I try to add members to my entry. Particularly it doesn't like the white space in between the numbers. Here's my LDIF. dn: cn=mytest,dc=example,dc=com changetype: add objectClass: groupOfNames objectClass: top cn: mytest dn: cn=mytest,dc=example,dc=com changetype: modify add: member member: 111-222-3333 member: 333 222 111 member: 111 333 444 Thanks, David

2 2

Magic required for subtree password policy?
by Gerrard Geldenhuis 13 Oct '10

13 Oct '10

Hi The admin guide says that one should use ns-newpwpolicy.pl script to set subtree password policies on the command line. Can we also set this using ldifs or is there some magic that this script perform that can't be achieved by using ldifs? Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

2 2

Auto Enrollment Proxy Source Code
by Thomas.Peter2＠swisscom.com 12 Oct '10

12 Oct '10

Hi there! I would like to have a look at the source code of the Auto Enrollment Proxy<http://directory.fedoraproject.org/wiki/Windows_Certificate_Auto_Enrollment> (AEP). I've looked here http://directory.fedoraproject.org/sources/ and here http://directory.fedoraproject.org/sources/aep/ but I can't find the source. Can anybody tell me where to find the source code for the AEP? I also tried to checkout the source from the CVS directory at CVSROOT=:pserver:anonymous@cvs.fedora.redhat.com:/cvs/dirsec, which is mentioned here: http://directory.fedoraproject.org/wiki/Auto_Enroll_Build. But this CVS server refuses my connection attempt (on port 2401) with both TortoiseCVS on Windows and with cvs from a System running Fedora 13. I can ping the server though. Should this CVS server allow checkouts with the user name "anonymous"? Do I need another user name? Thank you for your help! Greetings Thomas

2 2

Slow Console Interaction
by Wendt, Trevor 12 Oct '10

12 Oct '10

Hello All, I'm working with the new 389 Console for Windows v1.1.6 connecting to my remote server. When opening the console it sits at the "Initializing..." screen for exactly 10 minutes (600 seconds), then the console opens. Once open I see the "Server Group" and the admin/directory servers listed. Any action to open either server takes another 10 minutes. I made a few config tweaks in admin-serv/local.conf to clear admserv_check notices in the error logs. No other errors are showing in the logs (/var/log/dirsrv/*/*). I've lowered the cache settings from the default 600 to 30 for testing in the dse.ldif; no change. Firewalls are off everywhere. I get the same results running the console on the local DS server as I do running from my remote windows desktops (WinXP 32bit and a Win7 64bit desktop; both running Java 1.6.0_20). I am able to connect with Apache Directory Studio and other LDAP browsers without the 10 minute wait time; it seems specific to the console. Any suggestions? Thanks! ________________________________ This electronic message transmission contains information from Black Hills Corporation, its affiliate or subsidiary, which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware the disclosure, copying, distribution or use of the contents of this information is prohibited. If you received this electronic transmission in error, please reply to sender immediately; then delete this message without copying it or further reading.

2 2

Segfault
by Edward Z. Yang 11 Oct '10

11 Oct '10

We've had ns-slapd segfault on us recently twice; we don't have a core dump (since the daemon script turns off core dumps, but hopefully we'll have one next time it happens) and I was wondering if anyone had seen this before: ns-slapd[2725]: segfault at 10a3000010af ip 0000003d58c95785 sp 00007ff2abf04040 error 4 in libcrypto.so.0.9.8n[3d58c00000+15b000] ns-slapd[2727]: segfault at 10a3000010af ip 0000003d58c95785 sp 00007ff2aab02040 error 4 in libcrypto.so.0.9.8n[3d58c00000+15b000] Cheers, Edward

2 13

build/package scripts for debian and ubuntu
by Ryan Braun [ADS] 08 Oct '10

08 Oct '10

Here are the scripts I've created for building and packaging 389 for various debian and ubuntu distributions. Current targets are etch,lenny,squeeze,karmic and lucid. I haven't tested these extensively, but they all seem to build/install and return proper results when running test ldapsearch's. One slight note, on any target newer then etch, you'll likely need to sym link /usr/lib/nss/libsofttokn3.so to /usr/lib or the building of mozldap will break and the directory server will not function aswell. Not sure why that is yet. Give them a whirl and let me know how they work for you. Ryan Braun Aviation and Defence Services Division Chief Information Officer Branch, Environment Canada CIV: 204-833-2500x2625 CSN: 257-2625 FAX: 204-833-2558 E-Mail: Ryan.Braun(a)ec.gc.ca

4 14

Tuning recommendation for multi-master replicated LDAPs
by Chun Tat David Chu 07 Oct '10

07 Oct '10

Hi All, I am noticing some differenences in performance between single operated LDAP (no replication configured) and multi-master replicated LDAP. For example in a single operated LDAP, I can perform about 50-60 writes to the LDAP (create and delete entry) and for a multi-master replicated LDAP I can only perform about 10-20 writes (create and delete entry). Sometime it could even drop to single digit. The multi-master replicated LDAP is configured to "Always keep directories in sync". Do you think that is the culprit to why write operations are slower on multi-master replicated LDAPs? Does anyone have any recommendation on how to tune my LDAPs? Thanks, David

1 0

NSMMReplicationPlugin - Can't resurrect tombstone
by Chun Tat David Chu 07 Oct '10

07 Oct '10

Hi all, I am hitting some problem with my replicated directory server. I saw the following error messages from the errors log file. [17/Sep/2010:09:47:51 -0400] NSMMReplicationPlugin - conn=1 op=4 csn=4c9363a9000000020000: Can't resurrect tombstone ou=test,dc=example,dc=com to glue reason 'deletedEntryHasChildren', error=68 Can anyone tell me what could cause this problem and how to prevent it from happening again? Thanks! David

2 2

Migration Assistance Fedora-DS 1.04 to 389-ds 1.2.6
by Wendt, Trevor 06 Oct '10

06 Oct '10

Hello. I need some help with migrating a Fedora-Directory/1.0.4 B2006.312.1539 to the latest 389-ds-base-1.2.6-1.el5 from epel. Running on RHEL 5 (Linux 2.6.18-53.1.14.el5PAE #1 SMP Tue Feb 19 07:32:39 EST 2008 i686 i686 i386 GNU/Linux). The new 389-ds will be on the same server as the current fedora-ds so I have tried using migrate-ds-admin.pl script as well as doing the ldif export/import for cross platform migrations. Regardless of the method, I eventually hit the following error. ---------------------------------- [29/Sep/2010:17:39:12 -0600] attr_syntax_create - Error: the EQUALITY matching rule [caseIgnoreIA5Match] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [dc] [29/Sep/2010:17:39:12 -0600] attr_syntax_create - Error: the SUBSTR matching rule [caseIgnoreIA5SubstringsMatch] is not compatible with the syntax [1.3.6.1.4.1.1466.115.121.1.15] for the attribute [dc] [29/Sep/2010:17:39:12 -0600] dse - The entry cn=schema in file /etc/dirsrv/slapd-bhc/schema/60mozilla.ldif is invalid, error code 20 (Type or value exists) - attribute type nsAIMid: Does not match the OID "1.3.6.1.4.1.13769.2.4". Another attribute type is already using the name or OID. [29/Sep/2010:17:39:12 -0600] dse - Please edit the file to correct the reported problems and then restart the server. ---------------------------------- The Fedora install is an out of the box installation with a master/consumer configuration. I read somewhere that removing the old ldif file from my fedora-ds scheme folder may clear the error but no way to know which one may be conflicting wit the new 60mozilla.ldif file. In my old fedora-ds/<instance_name>/config/scheme folder are the following: 00core.ldif 05rfc2247.ldif 05rfc2927.ldif 10presence.ldif 10rfc2307.ldif 20subscriber.ldif 25java-object.ldif 28pilot.ldif 30ns-common.ldif 50ns-admin.ldif 50ns-calendar.ldif 50ns-certificate.ldif 50ns-compass.ldif 50ns-delegated-admin.ldif 50ns-directory.ldif 50ns-legacy.ldif 50ns-mail.ldif 50ns-mcd-browser.ldif 50ns-mcd-config.ldif 50ns-mcd-li.ldif 50ns-mcd-mail.ldif 50ns-media.ldif 50ns-mlm.ldif 50ns-msg.ldif 50ns-netshare.ldif 50ns-news.ldif 50ns-proxy.ldif 50ns-value.ldif 50ns-wcal.ldif 50ns-web.ldif 51ns-calendar.ldif 60pam-plugin.ldif 99user.ldif Any suggestions on what I need to do to get around this error? Thanks! ________________________________ This electronic message transmission contains information from Black Hills Corporation, its affiliate or subsidiary, which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, be aware the disclosure, copying, distribution or use of the contents of this information is prohibited. If you received this electronic transmission in error, please reply to sender immediately; then delete this message without copying it or further reading.

3 5

err=14 when binding with kerberos/sasl, normal behavior?
by Ryan Braun [ADS] 06 Oct '10

06 Oct '10

I've only just started playing with kerberos and sasl. So I'm not 100% sure if this is normal behavior. My ldapsearch's work, but on the server, I need 3 bind attempts before actually binding successfully. The first 2 throw err=14 SASL bind in progress, then the third always works. From the server [06/Oct/2010:16:55:47 +0000] conn=16 fd=64 slot=64 connection from 192.xx.xxx.xxx to 192.xx.xxx.xxx [06/Oct/2010:16:55:47 +0000] conn=16 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Oct/2010:16:55:47 +0000] conn=16 op=0 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress [06/Oct/2010:16:55:47 +0000] conn=16 op=1 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Oct/2010:16:55:47 +0000] conn=16 op=1 RESULT err=14 tag=97 nentries=0 etime=0, SASL bind in progress [06/Oct/2010:16:55:47 +0000] conn=16 op=2 BIND dn="" method=sasl version=3 mech=GSSAPI [06/Oct/2010:16:55:47 +0000] conn=16 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=ryan,ou=people,dc=xxx,dc=xx,dc=xx,dc=xx" [06/Oct/2010:16:55:47 +0000] conn=16 op=3 SRCH base="dc=xxx,dc=xx,dc=xx,dc=xx" scope=2 filter="(objectClass=*)" attrs=ALL [06/Oct/2010:16:55:47 +0000] conn=16 op=3 RESULT err=0 tag=101 nentries=10 etime=0 notes=U [06/Oct/2010:16:55:47 +0000] conn=16 op=4 UNBIND [06/Oct/2010:16:55:47 +0000] conn=16 op=4 fd=64 closed - U1 and the client ryan@krbclient:~$ ldapsearch -Y GSSAPI -h kerberos -b "dc=xxx,dc=xx,dc=xx,dc=xx" "objectclass=*" SASL/GSSAPI authentication started SASL username: ryan(a)XXX.XX.XX.XX SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=xxx,dc=xx,dc=xx,dc=xx> with scope subtree # filter: objectclass=* # requesting: ALL # # xxx.xx.xx.xx dn: dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: domain dc: isb # Directory Administrators, xxx.xx.xx.xx dn: cn=Directory Administrators,dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: groupofuniquenames cn: Directory Administrators uniqueMember: cn=Directory Manager # Groups, xxx.xx.xx.xx dn: ou=Groups,dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: organizationalunit ou: Groups # People, xxx.xx.xx.xx dn: ou=People,dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: organizationalunit ou: People # Special Users, xxx.xx.xx.xx dn: ou=Special Users,dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: organizationalUnit ou: Special Users description: Special Administrative Accounts # Accounting Managers, Groups, xxx.xx.xx.xx dn: cn=Accounting Managers,ou=Groups,dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: groupOfUniqueNames cn: Accounting Managers ou: groups description: People who can manage accounting entries uniqueMember: cn=Directory Manager # HR Managers, Groups, xxx.xx.xx.xx dn: cn=HR Managers,ou=Groups,dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: groupOfUniqueNames cn: HR Managers ou: groups description: People who can manage HR entries uniqueMember: cn=Directory Manager # QA Managers, Groups, xxx.xx.xx.xx dn: cn=QA Managers,ou=Groups,dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: groupOfUniqueNames cn: QA Managers ou: groups description: People who can manage QA entries uniqueMember: cn=Directory Manager # PD Managers, Groups, xxx.xx.xx.xx dn: cn=PD Managers,ou=Groups,dc=xxx,dc=xx,dc=xx,dc=xx objectClass: top objectClass: groupOfUniqueNames cn: PD Managers ou: groups description: People who can manage engineer entries uniqueMember: cn=Directory Manager # ryan, People, xxx.xx.xx.xx dn: uid=ryan,ou=People,dc=xxx,dc=xx,dc=xx,dc=xx uid: ryan givenName: ryan objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson sn: braun cn: ryan # search result search: 4 result: 0 Success # numResponses: 11 # numEntries: 10 Ryan Braun Aviation and Defence Services Division Chief Information Officer Branch, Environment Canada CIV: 204-833-2500x2625 CSN: 257-2625 FAX: 204-833-2558 E-Mail: Ryan.Braun(a)ec.gc.ca

2 1

sun iplanet migration
by Drexel Atkinson 05 Oct '10

05 Oct '10

Has anyone posted a migration plan/steps to move from the sun iplanet 5.2 to fedora 389? I could use some guidance on the steps, limitations, issues. thanks, -drex

2 1

GSSAPI authentication to Directory Server
by Matt Carey 05 Oct '10

05 Oct '10

I'm trying to follow the Kerberos howto guide at http://directory.fedoraproject.org/wiki/Howto:Kerberos but am having an issue authenticating to the Directory Server with GSSAPI/Kerberos tickets: $ /usr/lib/mozldap/ldapsearch -h station1.example.com -p 389 -o mech=GSSAPI -o authid="mcarey(a)STATION1.EXAMPLE.COM" -o authzid="mcarey(a)STATION1.EXAMPLE.COM" -b "dc=example,dc=com" "(cn=*)" Bind Error: Invalid credentials Bind Error: additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context Attempt with OpenLDAP client: $ /usr/bin/ldapsearch -Y GSSAPI -X u:mcarey -b "" -s base -LLL -H ldap://station1.example.com -b "dc=example,dc=com" "(cn=*)" SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-13): authentication failure: GSSAPI Failure: gss_accept_sec_context Resulting in the following entries in the access log on the DS: # tail -5 access [04/Oct/2010:10:44:14 -0400] conn=18 fd=68 slot=68 connection from 10.100.0.45 to 10.100.0.45 [04/Oct/2010:10:44:14 -0400] conn=18 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI [04/Oct/2010:10:44:14 -0400] conn=18 op=0 RESULT err=49 tag=97 nentries=0 etime=0 [04/Oct/2010:10:44:14 -0400] conn=18 op=1 UNBIND [04/Oct/2010:10:44:14 -0400] conn=18 op=1 fd=68 closed - U1 >From what I can tell the Kerberos infrastructure and OS components are setup accordingly: GSSAPI is a viable SASL mechanism: $ /usr/lib/mozldap/ldapsearch -b "" -h station1 -p 389 -s base "(objectClass=*)" supportedSASLMechanisms version: 1 dn: supportedSASLMechanisms: EXTERNAL supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: LOGIN supportedSASLMechanisms: CRAM-MD5 supportedSASLMechanisms: ANONYMOUS supportedSASLMechanisms: PLAIN Directory Server keytab and contents: # grep "nsslapd-localuser" dse.ldif nsslapd-localuser: nobody # ls -la ds.keytab -rw------- 1 nobody nobody 172 Oct 3 13:21 ds.keytab # ktutil ktutil: rkt ./ds.keytab ktutil: l slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 3 ldap/station1.example.com(a)STATION1.EXAMPLE.COM 2 3 ldap/station1.example.com(a)STATION1.EXAMPLE.COM # grep KRB /etc/sysconfig/dirsrv KRB5_KTNAME=/etc/dirsrv/ds.keytab ; export KRB5_KTNAME SASL maps in Directory Server: dn: cn=Kerberos uid mapping,cn=mapping,cn=sasl,cn=config objectClass: top objectClass: nsSaslMapping cn: Kerberos uid mapping nsSaslMapRegexString: $.*$(a)$.*$\.$.*$ nsSaslMapBaseDNTemplate: dc=\2,dc=\3 nsSaslMapFilterTemplate: (uid=\1) dn: cn=Station1 Kerberos Mapping,cn=mapping,cn=sasl,cn=config objectClass: top objectClass: nsSaslMapping cn: Station1 Kerberos Mapping nsSaslMapRegexString: (.*)(a)STATATION1.EXAMPLE.COM nsSaslMapFilterTemplate: (objectclass=inetOrgPerson) nsSaslMapBaseDNTemplate: uid=\1,ou=People,dc=example,dc=com dn: cn=station1 map,cn=mapping,cn=sasl,cn=config objectClass: top objectClass: nsSaslMapping cn: example map cn: station1 map nsSaslMapRegexString: $.*$ nsSaslMapBaseDNTemplate: ou=People,dc=example,dc=com nsSaslMapFilterTemplate: (cn=\1) Getting a ticket from the KDC: [mcarey@station1 ~]$ kdestroy [mcarey@station1 ~]$ kinit Password for mcarey(a)STATION1.EXAMPLE.COM: [mcarey@station1 ~]$ klist Ticket cache: FILE:/tmp/krb5cc_5000_hYlO20 Default principal: mcarey(a)STATION1.EXAMPLE.COM Valid starting Expires Service principal 10/04/10 10:57:20 10/04/10 17:37:20 krbtgt/STATION1.EXAMPLE.COM(a)STATION1.EXAMPLE.COM Kerberos 4 ticket cache: /tmp/tkt5000 klist: You have no tickets cached Any help or pointers people have would be greatly appreciated.

2 3

Multi-Master Replication
by Reinhard Nappert 04 Oct '10

04 Oct '10

Rich, you mentioned in one of your answers regarding the limit of Masters in a replicated environment , quote "There really isn't a limit. The limit was only for the old Red Hat Directory Server, and only so far as customer support goes. The only real hard limit is 65534 masters." I was wondering when this limit was gone. More specifically, does Fedora Directory Server 1.1.2 already work without that limitation. Thanks, -Reinhard

2 2

Chaining woes again...
by Gerrard Geldenhuis 04 Oct '10

04 Oct '10

Hi I have setup chaining but it is not working at all and I am not sure how to debug it further. I am using: 389-admin-1.1.11-0.6.rc2.el5 389-admin-console-1.1.5-1.el5 389-admin-console-doc-1.1.5-1.el5 389-adminutil-1.1.8-4.el5 389-console-1.1.4-1.el5 389-ds-1.2.1-1.el5 389-ds-base-1.2.6-0.11.rc7.el5 389-ds-console-1.2.3-1.el5 389-ds-console-doc-1.2.3-1.el5 389-dsgw-1.1.5-1.el5 The setup is 4 servers, two multimasters and two consumers. Client can only speak to the consumers and thus referrals won't work. I have used the following ldif to setup chaining: dn: cn=chainingBackend,cn=chaining database,cn=plugins,cn=config changetype: add objectClass: top objectClass: extensibleObject objectClass: nsBackendInstance cn: chainingBackend nsslapd-suffix: dc=mycompany nsmultiplexorbinddn: cn=replication manager,cn=config nsusestarttls: on nsfarmserverurl: ldaps://masterfqdn1:636 masterfqdn2:636/ nsmultiplexorcredentials: {SSHA}blah nsbindconnectionslimit: 5 nsconcurrentoperationslimit: 5 nsconnectionlife: 130 nsbindtimeout: 3 nsbindretrylimit: 3 nsmaxresponsedelay: 3 nsmaxtestresponsedelay: 5 dn: cn=dc\3dmycompany,cn=mapping tree,cn=config changetype: modify add: nsslapd-backend nsslapd-backend: chainingBackend - replace: nsslapd-state nsslapd-state: backend - replace: nsslapd-distribution-plugin nsslapd-distribution-plugin: /usr/lib64/dirsrv/plugins/libreplication-plugin.so - replace: nsslapd-distribution-funct nsslapd-distribution-funct: repl_chain_on_update dn: cn=config,cn=chaining database,cn=plugins,cn=config changetype: modify add: nsTransmittedControls nsTransmittedControls: 2.16.840.1.113730.3.4.12 The ACI has been created to allow the Replication Manager user proxy access. When I run the following on the client: dn: uid=john,ou=people,dc=mycompany changetype: modify add: mobile mobile: 1234 The entry gets added but only locally, it thus seems to be completely ignoring the chaining I have setup. I see the following in the consumer log after creation: [29/Sep/2010:13:00:11 +0000] start_tls - Received extended operation request with OID 1.3.6.1.4.1.1466.20037 [29/Sep/2010:13:00:11 +0000] start_tls - Start TLS extended operation request confirmed. [29/Sep/2010:13:00:11 +0000] start_tls - Start TLS request accepted.Server willing to negotiate SSL. [29/Sep/2010:13:00:11 +0000] start_tls - Starting SSL Handshake. [29/Sep/2010:13:00:11 +0000] NS7bitAttr - MODIFY begin [29/Sep/2010:13:00:11 +0000] NSMMReplicationPlugin - Purged state information from entry uid=rytis,ou=People,dc=betfair up to CSN 4c99ec08000000010000 [29/Sep/2010:13:00:12 +0000] roles-plugin - --> roles_post_op [29/Sep/2010:13:00:12 +0000] roles-plugin - --> roles_cache_change_notify [29/Sep/2010:13:00:12 +0000] roles-plugin - <-- roles_cache_change_notify: not a role entry [29/Sep/2010:13:00:12 +0000] roles-plugin - <-- roles_post_op There is some other replay failure errors which I am not sure is related. Having done the the test twice I did not see the replay errors again in the master log. I am going to simplify my test environment as I currently have 4 servers which all are verbal about replication and I multimaster netscapedb which adds to the complications. I have enabled Replication and Plug-ins for the error log, is there any other recommended logs that I should enable that can assist me in debugging chaining issues. Best Regards ________________________________________________________________________ In order to protect our email recipients, Betfair Group use SkyScan from MessageLabs to scan all Incoming and Outgoing mail for viruses. ________________________________________________________________________

3 6

nsView problem
by Procunier, Greg 01 Oct '10

01 Oct '10

Hello, I have tried creating test directory similar to the example given from Red Hat in this image: http://www.redhat.com/docs/manuals/dir-server/8.2/admin/html/images/virv iew3.png The goal was to have a nsViewFilter reach into the global user bucket (ou=People,dc=mgt,dc=ont,dc=srv) and populate a lower level branch with relevant user information (ou=People,ou=A,ou=Projects,dc=mgt,dc=ont,dc=srv). This does not work at all; the nsViewFilter only works if that filter is on the same level as the objects it needs to search which is contradictory to the image Red hat has pushed out. I was under the impression that container structures (such as organization units or organizations) with nsViewFilter attributes recurs the root of the directory to create their abstractions. If that were the case then the Red Hat image would be correct. As it is right now it does not seem to be the case. I am using Red Hat Directory server 8.2 (redhat-ds-8.2.0-2) on RHEL5. I am hoping I am doing something terribly wrong and some one can point it out for me. --- SNIP (test.ldif) --- dn: dc=mgt,dc=ont,dc=srv objectClass: top objectClass: domain dc: mgt dn: ou=People,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit ou: People dn: uid=doe_john,ou=People,dc=mgt,dc=ont,dc=srv objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: shadowAccount objectClass: organizationalPerson objectClass: person gidNumber: 65534 givenName: John sn: Doe displayName: John Doe uid: doe_john homeDirectory: /home/domain_users/doe_john gecos: Test User 1 loginShell: /bin/bash shadowFlag: 0 shadowMin: 0 shadowMax: 99999 shadowWarning: 0 shadowInactive: 99999 shadowLastChange: 12011 shadowExpire: 99999 cn: John Doe uidNumber: 48465 dn: uid=doe_jane,ou=People,dc=mgt,dc=ont,dc=srv objectClass: posixAccount objectClass: top objectClass: inetOrgPerson objectClass: shadowAccount objectClass: organizationalPerson objectClass: person gidNumber: 65534 givenName: Jane sn: Doe displayName: doe_jane uid: doe_jane homeDirectory: /home/domain_users/doe_jane gecos: Test User 2 loginShell: /bin/bash shadowFlag: 0 shadowMin: 0 shadowMax: 99999 shadowWarning: 0 shadowInactive: 99999 shadowLastChange: 12011 shadowExpire: 99999 cn: doe_jane uidNumber: 31388 dn: ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit ou: Projects dn: ou=A,ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit ou: A dn: ou=B,ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit ou: B dn: ou=People,ou=A,ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit objectClass: nsView ou: People nsViewFilter: (uidNumber=48465) dn: ou=People,ou=B,ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit objectClass: nsView ou: People nsViewFilter: (uidNumber=31388) -- SNIP (ldapsearch output) -- [root@directory]# ldapsearch -b ou=Projects,dc=mgt,dc=ont,dc=srv -x objectclass=\* # extended LDIF # # LDAPv3 # base <ou=Projects,dc=mgt,dc=ont,dc=srv> with scope subtree # filter: objectclass=* # requesting: ALL # # Projects, mgt.ont.srv dn: ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit ou: Projects # A, Projects, mgt.ont.srv dn: ou=A,ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit ou: A # B, Projects, mgt.ont.srv dn: ou=B,ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit ou: B # People, A, Projects, mgt.ont.srv dn: ou=People,ou=A,ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit objectClass: nsView ou: People nsViewFilter: (uidNumber=48465) # People, B, Projects, mgt.ont.srv dn: ou=People,ou=B,ou=Projects,dc=mgt,dc=ont,dc=srv objectClass: top objectClass: organizationalUnit objectClass: nsView ou: People nsViewFilter: (uidNumber=31388) # search result search: 2 result: 0 Success # numResponses: 6 # numEntries: 5 -- SNIP --

2 3

Please Help Test 389 Directory Server 1.2.6.1
by Rich Megginson 01 Oct '10

01 Oct '10

389-ds-base-1.2.6.1-2 is now in Testing. This release fixes the crashing problems seen with Windows Sync, and fixes some other crashing problems usually seen with deletion operations. Please help us test. The sooner we can get this release tested, the sooner we can push it to Stable and make it generally available. Installation yum install 389-ds --enablerepo=updates-testing # or for EPEL yum install 389-ds --enablerepo=epel-testing setup-ds-admin.pl Upgrade yum upgrade --enablerepo=updates-testing 389-ds-base # or for EPEL yum upgrade --enablerepo=epel-testing 389-ds-base setup-ds-admin.pl -u How to Give Feedback The best way to provide feedback is via the Fedora Update system. Each update is broken down by package and platform. For example, if you are using Fedora 12, and you have successfully installed or upgraded all of the packages, and the console and etc. works, then go to the links below for Fedora 12 and provide feedback. * 389-ds-base-1.2.6.1-2 ** EL-5 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.6.1-2.el5 ** Fedora 12 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.6.1-2.fc12 ** Fedora 13 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.6.1-2.fc13 ** Fedora 14 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.6.1-2.fc14 scroll down to the bottom of the page, and click on the Add a comment >> link * select one of the Works for me or Does not work radio buttons, add text, and click on the Add Comment button If you are using a build on another platform, just send us an email to 389-users(a)lists.fedoraproject.org Reporting Bugs If you find a bug, or would like to see a new feature, you can enter it here - https://bugzilla.redhat.com/enter_bug.cgi?product=389 More Information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

1 0

Help disabling SSL
by Sean Carolan 01 Oct '10

01 Oct '10

Due to some issues with an expired SSL cert I had to disable SSL on our 389 directory server. It's working fine for authentication without SSL, but I have lost all ability to manage the server via the management console. It appears that the management console still wants to connect to the directory server on port 636, but I see no way to change what port it uses. Also, both Administration server and Directory server are showing Server status: Stopped, even though I know both are running. Anyone have some pointers on how to disable all SSL on the management console?

3 3

389 for Ubuntu: launchpad & co
by Roberto Polli 01 Oct '10

01 Oct '10

Hi all, I saw that 389 for Ubuntu is quite old, like 1.2.0... I'd like to revive the launchpad repository but seems there's nobody there... Is there somebody of the ubuntu-packager *here* ? Peace, R. -- Roberto Polli Babel S.r.l. - http://www.babel.it Tel. +39.06.91801075 - fax +39.06.91612446 Tel. cel +39.340.6522736 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) "Il seguente messaggio contiene informazioni riservate. Qualora questo messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto della legge in materia di protezione dei dati personali."

2 2

synchronization state between replicas
by Barry Sitompul 01 Oct '10

01 Oct '10

Hi All, Does 389-DS provide a tool to check the synchronization state between replicas to check whether or not the replicas have converged? I recall there was a tool called 'insync' that came with Sun Directory Servers quite some time ago. Just wondering if 389-DS has something similar. If not, what's the best way to check that? Thanks! Bazza

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2010