389-users March 2010

389-users@lists.fedoraproject.org

53 participants
57 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

Strange behaviour - SAMBA is writing on a Dedicated Consumer Server
by Diretorio Livre 06 May '10

06 May '10

6 15

Announcing 389 Directory Server 1.2.6 Alpha 2
by Rich Megginson 19 Apr '10

19 Apr '10

The 389 team is pleased to announce the availability of Alpha 2 of version 1.2.6. This release contains some major new features - Subtree Rename, SELinux policy, Matching Rules - as well as many bug fixes. NOTE: Packages for Enterprise Linux are available from EPEL. We will no longer have a separate yum repo for these packages. ***We need your help! Please help us test this software.*** It is an Alpha release, so it may have a few glitches, but it has been tested for regressions and for new feature bugs. The Fedora system strongly encourages packages to be in Testing until verified and pushed to Stable. If we don't get any feedback while the packages are in Testing, the packages will remain in limbo, or get pushed to Stable. The more testing we get, the faster we can release these packages to Stable. See the Release Notes for information about how to provide testing feedback (or just send an email to 389-users(a)lists.fedoraproject.org) The packages that need testing are: * 389-ds-base-1.2.6.a2 - 389-ds-base and 389-ds-base-selinux * 389-admin-1.1.11.a2 - 389-admin and 389-admin-selinux * 389-adminutil-1.1.10 - 389-adminutil * 389-ds-1.2.0 - 389-ds * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download === New features === * Subtree Rename and Entry Move (modifyDN with newSuperior) ** https://bugzilla.redhat.com/show_bug.cgi?id=429005 ** ability to rename a node that has children ** ability to move a node, with or without children, to another parent node * Security Enhancements ** [[SELinux_Policy|SELinux Policy]] *** https://bugzilla.redhat.com/show_bug.cgi?id=442228 * Matching rules ** support for all RFC 4517 matching rules (except the FirstComponent ones) === Bugs Fixed === This release contains a couple of bug fixes. The complete list of bugs fixed is found at the link below. Note that bugs marked as MODIFIED have been fixed but are still in testing. This release contains many bug fixes. The complete list of bugs fixed is found at the link below. Note that bugs marked as MODIFIED have been fixed but are still in testing. * Tracking bug for 1.2.6 release - https://bugzilla.redhat.com/showdependencytree.cgi?id=543590&hide_resolved=0 ** [https://bugzilla.redhat.com/show_bug.cgi?id=171338 171338] Enhancement: winsync modrdn not synced ** [https://bugzilla.redhat.com/show_bug.cgi?id=434735 434735] SASL ANONYMOUS is broken in x86_64 ** [https://bugzilla.redhat.com/show_bug.cgi?id=460162 460162] FedoraDS "with-FHS" installs init.d StartupScript in wrong location on non-RHEL/Fedora OS ** [https://bugzilla.redhat.com/show_bug.cgi?id=460168 460168] FedoraDS' adminutil requires non-existent "icu.pc" on non-RH/Fedora OS ** [https://bugzilla.redhat.com/show_bug.cgi?id=460209 460209] adminserver "./configure --help" error @ --with-apr-config ** [https://bugzilla.redhat.com/show_bug.cgi?id=498103 498103] [RFE] SELinux policy for the Directory Server ** [https://bugzilla.redhat.com/show_bug.cgi?id=506206 506206] problems linking with -z defs ** [https://bugzilla.redhat.com/show_bug.cgi?id=509201 509201] rhds81 hub with 71 master - err=32 on replica base search during replication ** [https://bugzilla.redhat.com/show_bug.cgi?id=516611 516611] 389 DS segfaults on libsyntax-plugin.so ** [https://bugzilla.redhat.com/show_bug.cgi?id=518084 518084] Out of order retro change log records ** [https://bugzilla.redhat.com/show_bug.cgi?id=519459 519459] Semi-hardcoded include and lib directories in db.m4 ** [https://bugzilla.redhat.com/show_bug.cgi?id=531929 531929] rhds8.1 seg fault on null bvals in syntax plug-in ** [https://bugzilla.redhat.com/show_bug.cgi?id=536703 536703] Red Hat Direct Directory Migration 7.1 -> 8.1 problems ** [https://bugzilla.redhat.com/show_bug.cgi?id=537466 537466] nsslapd-distribution-plugin should not require plugin name to begin with "lib" ** [https://bugzilla.redhat.com/show_bug.cgi?id=539618 539618] Replication bulk import reports Invalid read/write ** [https://bugzilla.redhat.com/show_bug.cgi?id=543080 543080] Bitwise plugin fails to return the exact matched entries for Bitwise search filter ** [https://bugzilla.redhat.com/show_bug.cgi?id=544089 544089] Referential Integrity Plugin does not take into account the attribute subtypes ** [https://bugzilla.redhat.com/show_bug.cgi?id=548115 548115] memory leak in schema reload ** [https://bugzilla.redhat.com/show_bug.cgi?id=548535 548535] memory leak in attrcrypt ** [https://bugzilla.redhat.com/show_bug.cgi?id=551198 551198] LDAPI: incorrect logging to access log ** [https://bugzilla.redhat.com/show_bug.cgi?id=552419 552419] 389-admin-1.1.10-0.2.a2.el5 fails to start ** [https://bugzilla.redhat.com/show_bug.cgi?id=552421 552421] Cannot log into admin server after upgrade (fedora-ds-admin-1.1.6 -> 389-admin-1.1.9 ** [https://bugzilla.redhat.com/show_bug.cgi?id=553027 553027] Support for nsUniqueId and alias for additional retro changelog attributes ** [https://bugzilla.redhat.com/show_bug.cgi?id=554841 554841] Unitialized mutex in Retro Changelog Plugin. ** [https://bugzilla.redhat.com/show_bug.cgi?id=554887 554887] Net::LDAP password modify extop breaks; msgid in response is 0xFF ** [https://bugzilla.redhat.com/show_bug.cgi?id=555970 555970] seg fault maybe on cos or nsview changes and replication? ** [https://bugzilla.redhat.com/show_bug.cgi?id=558518 558518] several spelling errors ** [https://bugzilla.redhat.com/show_bug.cgi?id=559315 559315] Searching some attributes are now case sensitive when they were previously case-insensitive ** [https://bugzilla.redhat.com/show_bug.cgi?id=560827 560827] Admin Server: DistinguishName validation fails ** [https://bugzilla.redhat.com/show_bug.cgi?id=564876 564876] FTBFS 389-ds-base-1.2.6-0.1.a1.fc13: ImplicitDSOLinking ** [https://bugzilla.redhat.com/show_bug.cgi?id=568196 568196] Install DS8.2 on Solaris fails

2 1

PasswordExpWarned moves PasswordExpirationTime
by Legatus 31 Mar '10

31 Mar '10

When a use hits the PasswordWarnTime and flips the PasswordExpWarned, the date of PasswordExpirationTime advances to 10 days from now. The warn time for the subtree is 7. Can any explain what is doing this, so I can turn it off. -- JD Runyan

1 0

Re: [389-users] Documentation for pam pass
by Prashanth Sundaram 30 Mar '10

30 Mar '10

Hi, Here¹s how my PAM PTA looks like. But id on;t think it is of much use. dn: cn=PAM Pass Through Auth,cn=plugins,cn=config nsslapd-pluginEnabled: on pamSecure: FALSE pamExcludeSuffix: o=NetscapeRoot pamExcludeSuffix: cn=config I don¹t think the PTA will work against some other attribute which has same value as uid¹. You may have to hack the filters under the hood to be able to achieve that. My first guess: If you use PAM-PTA, you still need some PAM module to specify the stack to be used for PTA. So you need ldapserver01¹ file enabled and there you define the translation of uid attribute to new attribute. I don¹t know if this is do-able. Can you post some logs, which will tell where the block is. How are you specifying the master ldap server(server to authenticate)? -Prashanth ---------------------------- Hey thanks man. I have PAM PTA with krb working fine as well.. However..I am trying to pass through to another LDAP server, how can i go about doing that? The base of the tree on the other LDAP server is different i want to use it to authenticate the accounts. The other tree has the equivalent of the uid attribute in a different attribute. I think my service file (ldapserver) is off. Anyone have PAM PTA to another LDAP server working? An example perhaps? I am getting operations errors trying to use PAM PTA. I know the passwords are correct so I am doing something incorrectly. pam_passthru-plugin - => pam_passthru_bindpreop pam_passthru-plugin - pam msg [0] = 1 Password: pam_passthru-plugin - Error from PAM during pam_authenticate (6: Permission denied) pam_passthru-plugin - Unknown PAM error [Permission denied] for user id [test_user], bind DN [uid=test_user,dc=example,dc=com] pam_passthru-plugin - <= handled (error 1 - Operations error) Thanks again

3 4

Unintended cert mapping happening
by John A. Sullivan III 29 Mar '10

29 Mar '10

Hello, all. We are experiencing a weird problem and have not been able to fix it. We have just renamed the top level of our tree from dc=old,dc=biz to dc=new,dc=com. All went very well (well, very well until we also changed the certificates and keys to be from the new Certificate Authority - but we have that sorted now, too) except one remaining error. Our Zimbra (6.0.5) mail server authenticates users against our CentOS 8.1 Directory Server. It is working but, every time a user tries to authenticate, we generate an error: slapi_search_internal ("CN=zimbra.new.com, OU=MailServers, DC=new, DC=com", subtree, objectclass=*) err 32 and in the access log we see: conn=174 SSL 128-bit RC4; client CN=zimbra.new.com,OU=MailServers,DC=new,DC=com; issuer CN=newca.new.com,OU=PKI,DC=new,DC=com conn=173 SSL failed to map client certificate to LDAP DN (No such object) We then see the directory search user (we do not allow anonymous access) correctly bind and authenticate. It is as if the directory server is accidentally trying to do cert mapping and authenticate the mail server whenever it tries to establish an ldaps connection. As far as I understand, one needs to tell Directory Server to do this by adding a usercertificate attribute to the user we want to authenticate via X.509 cert. I've searched the entire database dump and nothing has that attribute. certmap.conf has been unchanged and is all commented out except for: certmap default default What is causing this and how do I fix it? Our migration procedure was to stop dirsrv, dump the userRoot and NetscapeRoot databases, make all the substitutions via sed in dse.ldif (and .bak and .startOK), make all the substitutions via sed in the database dumps, and then import the revised ldif files. Thanks - John

2 2

Tombstones not deleting
by Jim Tyrrell 29 Mar '10

29 Mar '10

I have noticed on my Fedora consumers there appear to be quite a few tombstones going back months even thought the Purge delay is set to a week: ldapsearch -x -b "cn=mapping tree,cn=config" -D "cn=Directory Manager" -W cn=replica nsds5ReplicaPurgeDelay # replica, o=blah.com, mapping tree, config dn: cn=replica,cn="o=blah.com",cn=mapping tree, cn=config nsds5ReplicaPurgeDelay: 604800 --- example tombstone --- # ad82a101-1dd111b2-80a3f995-55bd0000, bob(a)zzz.com, Blah, blah.com dn: nsuniqueid=ad82a101-1dd111b2-80a3f995-55bd0000, uid=bob(a)zzz.com,ou=Blah, o=blah.com objectClass: blahPerson objectClass: nsTombstone uid: bob(a)zzz.com nsParentUniqueId: ccd21704-1dd111b2-80a6a51e-7dae0000 modifyTimestamp: 20090713210513Z There seems to be hundreds of these dating back 6 months to when the server was built. Why are these old entries not being purged? Thanks. Jim.

2 5

How to rename DIT?
by John A. Sullivan III 29 Mar '10

29 Mar '10

Hello, all. We've recently undergone a corporate name and domain change, let's say from oldname.biz to newname.com. Consequently, we need to rename the top level of our LDAP structure. We installed CentOS Directory Server 8.1 into dc=oldname,dc=biz and now need that entire structure to have dc=newname,dc=com at the top. Everything else stays the same. I realize I'll need to edit all my ACIs and repoint all my LDAP clients, but is there an easy way to rename the tree? I'd hate to try to move all the elements (especially since I believe we can only move leaves) and worse yet have to recreate the entire tree :-(((( I assume it is not as simple as going to the top level object in the directory, going to advanced properties and changing the entrydn. Thanks - John

2 5

Netscape 6.2 & 389 Directory server replication
by Nick Brown 26 Mar '10

26 Mar '10

Hi, I have been given a bunch of old Netscape 6.2 servers that need replacing with 389 Directory server, is it possible to have a Netscape 6.2 master and a 389 Directory server replicating between each other? The current setup consists of 2 Netscape Multimasters and 7 slaves, I think the easiest solution would be to build 2 389 Masters with 389 slaves and have at least one of each Masters replicating between each other. Then to move the applications to the new platform the clients just need to change the IP they are talking to, then we always have the option of moving back if there are any problems. Does this sound like a sensible way to do it? The Netscape boxes are actually critical production boxes so we can afford very little downtime if any, and if we have the 2 setups replicating to each other the rollback plan is easy - otherwise we will need to somehow log all changes and manually apply those either way to keep everything in sync when we cutover and rollback. I'm rather new to LDAP so its a steep learning curve! Thanks in advance for any pointers. Nick.

5 4

Re: [389-users] Documentation for pam pass
by Prashanth Sundaram 26 Mar '10

26 Mar '10

HI, I think you might just need PTA plugin, unless you want to use a different PAM stack for the authentication. Here¹s some documentation for PTA. http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Using_the_Pass_through_ Authentication_Plug_in.html Sun¹s documentation gives a good detail. http://docs.sun.com/source/817-7613/passthru.html PAM-PTA: http://directory.fedoraproject.org/wiki/Howto:PAM_Pass_Through I have implemented PAM PTA for authentication against Windows AD using kerberos stack. -Prashanth

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2010