May 2011 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

Views, Filtered roles and CoS
by Colin Panisset 06 Oct '11

06 Oct '11

I have a pretty flat DIT, with all users currently under ou=people,dc=example,dc=com; these user objects also have posixAccount attributes, of which loginShell is one. What I'm trying to achieve is to be able to set a "default" loginShell to be a restricted shell (/bin/rbash) for developers, but allow that to be a non-restricted shell on systems which are development hosts. As an example, on a production host I'd like: $ ldapsearch -x "(uid=devuser)" uid loginshell to return: dn: cn=Dev User,ou=People,dc=example,dc=com loginShell: /bin/rbash uid: devuser while on a development host, I'd like the same search to return dn: cn=Dev User,ou=People,dc=example,dc=com loginShell: /bin/bash uid: devuser I thought I might be able to achieve this by creating a view called ou=Developers,dc=example,dc=com and using that as a base DN on the development boxes, then applying a CoS within the view to override the loginShell attribute, but then the CoS ends up being applied to the original entry too. Is there any way that I could: - have a CoS apply based on client system attributes, like IP address/hostname? - have a CoS which applies to a view that *doesn't* affect the original object? - perhaps make use of cosPriority through two different views, so as to have ou=Development,... and ou=Production,... (but that would be answered by the previous option anyway)? Is there some other clever way to achieve what I'd like? I'd really like to avoid maintaining 2 separate DITs for the same set of users. -- C.

3 6

LDAPCon 2011 Call for Papers
by Peter Gietz 08 Aug '11

08 Aug '11

With the usual apologies. The 3rd Edition of the International Conference on LDAP (LDAPCon 2011[1]) will be held on October, 10-11, 2011 in Heidelberg, Germany. A Call For Papers[2] has been raised and the Program Committee asks you to submit abstracts by July 8th. The International Conference on LDAP is a technical forum for IT professionals interested in LDAP and related topics like directory servers, directory management applications, directory integration, identity and access management, and meta directories. It focuses on implementation and integration of LDAP servers and LDAP-enabled client applications. The event will bring together vendors, developers, active and prospective LDAP practitioners to share their experiences about deployment strategies, service operations, interoperability, discuss LDAP usage in new projects and learn about upcoming trends and developments. The 1st LDAPCon[3] was held in September 2007 in Germany, the 2nd LDAPCon[4] was held in September 2009 in Portland, Oregon, USA (Some pictures from LDAPCon 2007 [5] and a nice summary of LDAPCon 2009 [6]) So if you're involved with LDAP in interesting projects and you want to share your experiences, please check the Call For Papers and submit a proposal. Best, Peter [1]: http://www.ldapcon.org [2]: http://www.daasi.de/ldapcon2011/index.php?site=cfp [3]: http://www.guug.de/veranstaltungen/ldapcon2007/index.html [4]: http://www.symas.com/ldapcon2009 [5]: http://www.flickr.com/photos/ludovic_p/sets/72157601937159198/detail/ [6]: http://blogs.sun.com/Ludo/entry/ldapcon_2009_summary -- _______________________________________________________________________ Peter Gietz (CEO) DAASI International GmbH phone: +49 7071 407109-0 Europaplatz 3 Fax: +49 7071 407109-9 D-72074 Tübingen mail: peter.gietz(a)daasi.de Germany Web: www.daasi.de DAASI International GmbH, Tübingen Geschäftsführer Peter Gietz, Amtsgericht Stuttgart HRB 382175 Directory Applications for Advanced Security and Information Management _______________________________________________________________________

1 2

Delete object on Consumer
by Jim Tyrrell 04 Aug '11

04 Aug '11

Hi, We have a setup with multiple masters which are replicating down to 389 Directory Server consumers via 2 hubs, but have a consistency issue. It appears a few objects were deleted and re-added to the masters but the object was not deleted from the 389 consumers. We now have 1 object on the masters and 2 objects on the consumers which causes problems for the mail servers. If we delete the object from the master we are still left with one object on the slaves. The slaves currently have a few duplicate objects like this: dn: cn=mx::10, cn=somedomain.co.uk, ou=dns, o=acmesystems.com cn: mx::10 mailtransport: nexthop:[mailserver.ourdomain.com] dnspreference: 10 dnstype: MX dn: nsuniqueid=7edfa581-1dd211b2-8014f995-55bd0000+cn=mx::10,cn=somedomain.co.uk, ou=dns,o=acmesystems.com cn: mx::10 mailtransport: nexthop:[mailserver.ourdomain.com] dnspreference: 10 dnstype: MX The object showing nsuniqueid is the valid one that exists on the master. Is there a way to remove the 2nd object from the consumer without re-initialising? I have seen this before on a single consumer so we re-initialised it, but its a much bigger problem to re-initialise all of the consumers. It would be ideal if there is a way to manually delete an object direct on a consumer? Thanks. Jim.

4 14

Re: [389-users] get base dn from ldapsearch
by Angel Bosch Mora 15 Jul '11

15 Jul '11

> Maybe I am understanding this wrong but could you not just check in > the config what the search base is set to on the client side? What is > the problem you are trying to solve? > yes, you're right. i can just take a look at ldap.conf but there's several places to look: - debian/ubuntu uses /etc/ldap/ldap.conf - RHEL/CentOS uses /etc/openldap/ldap.conf - custom compilations can use any path. ex: /usr/local/ldap/ldap.conf - windows openldap uses... i don't really know :P so what im trying to do is resolving configured base without knowing anything about the client. for example, this command gives me the server even if i dont know anything about the conf: ldapsearch -d1 -x -LLL "(uid=example)" uid 2>&1 | grep ldap_connect_to_host im just a little bit surprised that i can't find any debuglevel that gives me the BASE abosch

8 17

Announcing 389 Directory Server version 1.2.8.3
by Rich Megginson 14 Jun '11

14 Jun '11

The 389 Project team is pleased to announce the release of 389-ds-base-1.2.8.3. This release fixes a few bugs found in 1.2.8.2. Installation yum install 389-ds # or for EPEL yum install 389-ds setup-ds-admin.pl Upgrade yum upgrade 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console # or for EPEL yum upgrade 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console setup-ds-admin.pl -u How to Give Feedback The best way to provide feedback is via the Fedora Update system. Each update is broken down by package and platform. For example, if you are using Fedora 13, and you have successfully installed or upgraded all of the packages, and the console and etc. works, then go to the links below for Fedora 13 and provide feedback. * EL-5 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.3-1.el5 * Fedora 13 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.3-1.fc13 * Fedora 14 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.3-1.fc14 * Fedora 15 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.3-1.fc15 scroll down to the bottom of the page, and click on the Add a comment >> link * select one of the Works for me or Does not work radio buttons, add text, and click on the Add Comment button If you are using a build on another platform, just send us an email to 389-users(a)lists.fedoraproject.org Reporting Bugs If you find a bug, or would like to see a new feature, you can enter it here - https://bugzilla.redhat.com/enter_bug.cgi?product=389 More Information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

2 2

Reg ldif file import/export and ldap replication over ldaps
by s.varadha rajan 14 Jun '11

14 Jun '11

Hi, We are using Ubuntu 10.04 server OS and all the web applications are running on that.We have already implemented fedora-ds for ldap auth.now we are planning to go some up-gradation.kindly let me know the following, 1.How to migrate running fedora-ds server to another server ? 2.i have taken all the user/group+etc in ldif format.is it enough for migration or any other db (/var/lib/dirsrv/slapd-<instance>) also need to bacup ? if any procedure please share with me ? how to import/export .ldif file 3.in our setup,one server is in public network.so i am planning to do replication through "ldaps", i.e local server to public server replication through highly secure how to ? Please help me on the above topics. Regards, Varad

2 5

Windows Sync Agreement Help
by Albert Teh 31 May '11

31 May '11

Hi, We are setting up a new CENTOS-DS version 8.1.0. and CENTOS 5.5 and attempt to synchronize with the existing 2003 Windows AD server. Performing the full sync completed. There is no user created in the DS subtree. We would like to perform one way Sync: AD ----> DS. Once it works, we will set up the password Sync from the AD to DS. AD: cn=Users,cn=location,dc=ad,dc=domain,dc=com DS: ou=Peoples,dc=domain,dc=com errors log: [26/May/2011:10:20:34 -0400] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=ADsync" (wodcstage-1:389)". [26/May/2011:10:20:34 -0400] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=ADsync" (wodcstage-1:389)". Sent 0 entries. access log: 26/May/2011:10:20:37 -0400] conn=11 op=819 SRCH base="cn=ADsync, cn=replica, cn=\22dc=algonquincollege, dc=com\22, cn=mapping tree, cn=config" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="nsds5replicaLastUpdateStart nsds5replicaLastUpdateEnd nsds5replicaChangesSentSinceStartup nsds5replicaLastUpdateStatus nsds5replicaUpdateInProgress nsds5replicaLastInitStart nsds5replicaLastInitEnd nsds5replicaLastInitStatus nsds5BeginReplicaRefresh" [26/May/2011:10:20:37 -0400] conn=11 op=819 RESULT err=0 tag=101 nentries=1 etime=0 Thanks. Albert

3 8

"no mechanism available" from CLI
by Andreas-Johann Ulvestad 31 May '11

31 May '11

Short story: After setting up 389 and adding users I attempt to run ldappasswd on a test user. The error message I get is: SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: Long story: I installed Fedora 15 and then 389 via yum. All packages were downloaded without any problems and setup-ds-admin.pl had no problems either. I then launched the admin console and added two test users with POSIX accounts. After this, I launched authconfig-tui and configured it as so: User Information: Cache, use LDAP Authentication: shadow passwords, LDAP auth, local auth sufficient No TLS Server ldap://localhost Base DN: dc=k,dc=unicornis,dc=no As said earlier, ldappasswd doesn't work (I use ldappasswrd -h localhost). However, ldapsearch works (see attached output). I appreciate any feedback on how to start debugging this :-).

3 2

Thunderbird/Squirrelmail - common address book? LDAP?
by Philip Rhoades 30 May '11

30 May '11

People, I have previously been asking questions about importing a TB addressbook book here and I think I can see how I can do that now but I guess I should ask a more fundamental question: Is using an LDAP server the best way of getting a commonly accessible addressbook for both TB and SM? Even if I could use a setup like that, there is still no way TB can automatically update the LDAP DB for mails that go out to new email addresses . . It seems that LDAP is the only common addressbook possibility between TB and SQ but that solution is not completely satisfactory either . . Thanks, Phil. -- Philip Rhoades GPO Box 3411 Sydney NSW 2001 Australia E-mail: phil(a)pricom.com.au

1 0

389-Console no longer works. Blank menu items
by Jeremy Carroll 26 May '11

26 May '11

Here is the pastebin of the console log with debugging. http://pastebin.com/C8iajzXY The console no longer works on any operating system I've tried. I've tried the ldap server (CentOS 5.5), a Windows 2003 Server w/Console, a Windows 2008 Server w/console, and Fedora 15. None of them work. Here is the screenshot of the console. http://i.imgur.com/gqO4j.png The errors in the log state that it's unable to resolve a lot of the strings. I don't know how to troubleshoot this issue. Any ideas? ResourceSet:getString():Unable to resolve menu-start Jeremy Carroll Sr. Network Engineer

2 4

db import failure, when setting replication up
by Reinhard Nappert 25 May '11

25 May '11

Hi, I have seen the following: I set 2 systems up in MMR. Replication worked. For some reason, I needed to take one of the boxes out of the replication and disabled replication. Later on, I enabled it again and created the shadowing agreement to the other box. Now, I saw the following errors during the import of the db: [17/May/2011:11:46:04 -0400] NSMMReplicationPlugin - multimaster_be_state_change : replica o=base is going offline; disabling replication [17/May/2011:11:46:07 -0400] - WARNING: Import is running with nsslapd-db-privat e-import-mem on; No other process is allowed to access the database [17/May/2011:11:46:08 -0400] - import userRoot: WARNING: Skipping entry "nsuniqu eid=06869502-7fe011e0-8f589300-7e7b2163,ou=sample,o=base" which has no parent, ending at line 0 of file "(bulk import)" [17/May/2011:11:46:08 -0400] - import userRoot: WARNING: bad entry: ID 453 ..... Any idea, what is going on there? Thanks, -Reinhard

2 12

MMR replication fails
by Karoly Czovek 24 May '11

24 May '11

Hi there, i just trying to set up an MMR replication with MMR, as the following: ./mmr.pl --host1 ds-swz.moveone.info --host2 marcus.moveone.info --bindpw jou6.Hou, --host1_id 43 --host2_id 12 --repmanpw R3pl1C4t10nP4sSw0Rd --create adding to ds-swz.moveone.info port 389 -> cn=changelog5,cn=config -> already exists adding to ds-swz.moveone.info port 389 -> cn=repman,cn=config -> already exists adding to ds-swz.moveone.info port 389 -> cn=replica,cn="o=netscaperoot",cn=mapping tree,cn=config -> already exists adding to marcus.moveone.info port 389 -> cn=changelog5,cn=config -> already exists adding to marcus.moveone.info port 389 -> cn=repman,cn=config -> already exists adding to marcus.moveone.info port 389 -> cn=replica,cn="o=netscaperoot",cn=mapping tree,cn=config failed to add replica entry: No such object at ./mmr.pl line 319, <DATA> line 339. [root@ds-swz]:/home/karoly#> Any idea? -- Karoly CZOVEK Global Systems Administrator MoveOne IT Department Eastern Europe - Balkans - CIS& Central Asia - Middle East& Africa - Asia Pacific phone: +36 1 266 0181 - ext.6710 mobile: +36 70 708 9953 skype: mo_karoly.czovek email: karoly.czovek(a)moveoneinc.com web: http://www.moveoneinc.com

1 0

memberOf attribute and plugin behaviour between sub-suffixes.
by Juan Carlos Camargo 24 May '11

24 May '11

Is the memberOf attribute handling by the memberOf plugin limited to objects inside the same subsuffix? If it's not planned as such please doublecheck this behaviour within the following scenario: - suffix dc=directory,dc=org - subsuffix ou=users,dc=directory,dc=org - subsuffix ou=testing,ou=users,dc=directory,dc=org We have then three databases. They're not replicated. The membefOf plugin works only with elements (users and groups) that belong to the same subsuffix. But not between different subsuffixes. As such, if you make a user of ou=testing... member of a group of ou=users then the plugin will not populate the memberOf attribute for that user. The same here: - subsuffix ou=users,dc=example,dc=com - subsuffix ou=grupos,dc=example,dc=com Here the plugin wont work either. If you make a user inside ou=users member of a group inside ou=groups then the value of memberOf wont be populated. If you set debug to heavy trace, you'll see that the plugin runs in every situation but: 1.- when the objects belong to the same subsuffix, adding one membership triggers the memberOf plugin to "ldap replace" values, which is correct. 2.- when the objects belong to different subsuffix, adding one membership triggers the memberOf plugin to "ldap REMOVE" values, which amazes me. DS 1.2.8.2 CentOS5.

2 3

Does Red Hat (or anyone) offer training for 389?
by Rob Threet 23 May '11

23 May '11

Does Red Hat (or anyone) offer training for 389? -- Robert Threet Systems Manager USI Computer Center http://yesistilluseperl.blogspot.com

2 1

Building 389 console
by Michael Pelletier 23 May '11

23 May '11

Hello, I have followed the instructions on http://directory.fedoraproject.org/wiki/BuildingConsole#Building_Directory_… However, when I start the 389-conole on a remote server, I can login fine, I click on "Administrative Server" and I get a message: "Failed to instantiate Server Object for Administration Server com.netscape.management.admserv.AdminServer cannot be cast to com.netscape.management.client.topology.IServerObject" Running the console in debug mode gives: ClassLoader: com/netscape/management/client/topology/TopologyResourcePage.class found in 389-admin-1.1.jar ClassLoader: com/netscape/management/client/topology/topology_en_US.properties NOT in 389-admin-1.1jar ClassLoader: com/netscape/management/client/topology/topology_en.properties NOT in 389-admin-1.1.jar ClassLoader: com/netscape/management/client/topology/topology.properties NOT in 389-admin-1.1.jar ClassLoader: com/netscape/management/admserv/admserv_en_US.properties NOT in 389-admin-1.1.jar ClassLoader: com/netscape/management/admserv/admserv_en.properties NOT in 389-admin-1.1.jar ClassLoader: com/netscape/management/admserv/admserv.properties NOT in 389-admin-1.1.jar ClassLoader: :loadClass():name:java.util.Vector ClassLoader: :loadClass():name:com.netscape.management.admserv.AdminServer$1 ClassLoader: :loadClass():loading:com.netscape.management.admserv.AdminServer$1 ClassLoader: com/netscape/management/admserv/AdminServer$1.class found in 389-admin-1.1.jar ERROR ServerNode.createServerInstance: could not create com.netscape.management.admserv.AdminServer@389-admin-1.1.jar@cn=admin-serv-ldap1,cn=389 Administration Server,cn=Server Group,cn=ldap1.mcna.net,ou=mcna.net,o=NetscapeRoot Exception: java.lang.ClassCastException: com.netscape.management.admserv.AdminServer cannot be cast to com.netscape.management.client.topology.IServerObject Please help!!! Michael

3 3

Importing Thunderbird AddressBook into LDAP
by Philip Rhoades 23 May '11

23 May '11

People, I have installed the 389 DS on F14 x86_64 OK and can see a few people that I added with the 389 Console in both Thunderbird and Squirrelmail but now I want to do a bulk import of my TB addressbook into the 389 DB. I can export the TB AB to an ldif file but it fails to import using the 389 "Import Databases" fn - I presume I have to somehow massage the LDIF file to make it compatible? Here is a complete record: dn: cn=Tina XXXXXX,mail=TXXXXXX(a)nYYYYYYY.com objectclass: top objectclass: person objectclass: organizationalPerson objectclass: inetOrgPerson objectclass: mozillaAbPersonAlpha givenName: Tina sn: Franks cn: Tina XXXXXX mozillaNickname: tinaX mail: TXXXXXXX(a)nYYYYYYY.com modifytimestamp: 48a5a25d I guess one of the objectlasses should be "People"? Thanks, Phil. -- Philip Rhoades GPO Box 3411 Sydney NSW 2001 Australia E-mail: phil(a)pricom.com.au

5 11

Building 389-ds-console-1.2.5, 389-console-1.1.6 and 389-admin-console-1.1.7 (via Git)
by Michael Pelletier 23 May '11

23 May '11

Hello all, I am building my own package. I have compilied everything except 389-ds-console-1.2.5, 389-console-1.1.6 and 389-admin-console-1.1.7 I have been running into a problem. I used git to download the sources. I went into the 389-ds-console directory and typed ant and I get: BUILD FAILED /usr/local/Source/389/TEMP/389-ds-console-1.2.5/build.xml:76: /usr/local/Source/389/TEMP/imports/console/389-console-1.2.5 not found Please help. What am I doing wrong? Michael

2 2

Windows Sync with additional schema
by Terry Soucy 20 May '11

20 May '11

Hi All, I've successfully created a Windows Sync Agreement between my test ldap infrastructure and test AD server. We use the eduPerson schema in 389, and require it to be on the AD side as well for population of proper groups of staff/students/faculty. Is it possible to sync additional schema attributes as well as the standard ntuser ones? Terry -- Terry Soucy, Systems Analyst Integrated Technology Services University of New Brunswick, Fredericton Campus http://www.unbf.ca/its Voice: 506.447.3018 Fax: 506.453.3590 E-mail: terry.soucy(a)unb.ca ** ITS is a scent-reduced workplace - www.unbf.ca/its/policies **

3 2

ssl replication
by solarflow99 19 May '11

19 May '11

I'm trying to configure replication over SSL using StartTLS, I don't see any example of how to export/import self signed certs into the slave. Here's what I did: created a CA cert and server cert on the master, everything is fine. exported the CA cert and copied it to the slave: [root@ldapslave]# certutil -A -d . -n "CA certificate" -t "CT,," -a -i cacert.asc [root@ldapslave]# certutil -d . -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CA certificate CT,, What is next? I tried everything I could think of..

2 5

NIS 389 Directory Server
by Neuhold Christian (TSA) 19 May '11

19 May '11

Hello, for user authentication we use NIS on a Solaris System. Solaris 7/8/9 and Redhat 4/5 access this domain. Now I want to migrate to fedora directoryserver. What I have done: * Installed Redhat 5 x86_64 * Installed 389 from EPEL * Imported NIS Data into 389 with LdapImport from Babel * Authentication over LDAP and LDAP SSL works. (POSIX Accounts) * Installed slapi-nis 0.24 * Configured slapi-nis with nis-getting-started.txt Working: * Providing NIS MAPS [root@xxxx ~]# ypwhich -m users sux7292v.xxx.com passwd.byuid xxx.xx.com passwd.byname xxx.xx.com group.byname xxx.xx.com group.bygid xxx.xx.com [root@xxx ~]# *Get passwd and groups [root@xxx slapd-xxx]# ypcat passwd | grep tst tst:*:1346:21:Test:/user/tst:/bin/csh My problem: Authentification is not working, login is not possible. My des.ldif (only nis entries): dn: cn=NIS Server,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject cn: NIS Server nsslapd-pluginPath: nisserver-plugin.so nsslapd-pluginInitfunc: nis_plugin_init nsslapd-pluginType: postoperation nsslapd-pluginEnabled: on nsslapd-pluginDescription: NIS Server Plugin nsslapd-pluginVendor: redhat.com nsslapd-pluginVersion: 0.24 nsslapd-pluginId: nis-plugin nis-tcp-wrappers-name: ypserv nsslapd-pluginarg0: 541 modifiersName: cn=directory manager modifyTimestamp: 20110517110053Z numSubordinates: 5n dn: nis-domain=xxx+nis-map=group.bygid,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject objectClass: top nis-domain: xxx nis-map: group.bygid nis-base: ou=Groups, dc=xxx, dc=com dn: nis-domain=xxx+nis-map=group.byname,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject objectClass: top nis-domain: xxx nis-map: group.byname nis-base: ou=Groups, dc=xxx, dc=com dn: nis-domain=xxx+nis-map=passwd.byname,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject objectClass: top nis-domain: xxx nis-map: passwd.byname nis-base: ou=People, dc=xxx, dc=com dn: nis-domain=xxx+nis-map=passwd.byuid,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject objectClass: top nis-domain: xxx nis-map: passwd.byuid nis-base: ou=People, dc=xxx, dc=com ypcat passwd old system: [root@xxx slapd-xxx]# ypcat passwd | grep tst tst:*:1346:21:Test:/user/tst:/bin/csh ypcat passwd new system: [root@xxx ~]# ypcat passwd | grep tst tst:xOf6bdfgZsCsA:1346:21:Test:/user/tst:/bin/csh Is it possible to provide the password hash with slapi-nis/389-directory server? Thanks, br cnu80 -~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~ This message may contain confidential and/or privileged information intended only for the addressee. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Any views expressed in this message are those of the individual sender and may not necessarily reflect the opinions of austriamicrosystems AG. -~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~ Diese E-Mail enthaelt moeglicherweise vertrauliche und/oder rechtlich geschuetzte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender und loeschen Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. Etwaige in dieser E-mail geaeusserte Ansichten und Meinungen stammen vom Versender dieser Nachricht und muessen nicht notwendigerweise mit den Meinungen und Ansichten von austriamicrosystems AG uebereinstimmen. ~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~

2 5

windows sync question
by solarflow99 18 May '11

18 May '11

I have a question about windows sync, in the docs it says the replica role should be single or multi master, but with single master you can't set update settings for the bind DN. Will this still work? Is there a way to sync 1 way, from windows AD -> dirsrv only? Thanks,

2 1

replication with ssl
by solarflow99 18 May '11

18 May '11

I just wonder why i'm getting: RESULT err=2 when I try to use replication over simple SSL. The replication agreement works when I use ldap with no encryption, but when I select SSL encryption with ldap it just gives that error. I'm not looking to use certificates, just simple bind DN/password.

2 3

read_state: failed to get generator's state
by Jim Tyrrell 18 May '11

18 May '11

Hi, I have a setup with 3 389 Directory servers in a master-master setup which has been working fine until now. One of the servers died this morning due to a memory issue and now will not restart: [18/May/2011:12:34:32 +0100] memory allocator - malloc of 1538 bytes failed; OS error 12 (Cannot allocate memory) The server has probably allocated all available virtual memory. To solve this problem, make more virtual memory available to your server, or reduce one or more of the following server configuration settings: nsslapd-cachesize (Database Settings - Maximum entries in cache) nsslapd-cachememsize (Database Settings - Memory available for cache) nsslapd-dbcachesize (LDBM Plug-in Settings - Maximum cache size) nsslapd-import-cachesize (LDBM Plug-in Settings - Import cache size). Can't recover; calling exit(1). I'm not unable to restart the server, the error log reports the following: [18/May/2011:12:58:38 +0100] - 389-Directory/1.2.2 B2009.237.206 starting up [18/May/2011:12:58:38 +0100] uuid - read_state: failed to get generator's state [18/May/2011:12:58:38 +0100] uuid - uuid_init: failed to get generator's state [18/May/2011:12:58:38 +0100] uniqueid generator - uniqueIDGenInit: generator initialization failed [18/May/2011:12:58:38 +0100] - Fatal Error---Failed to initialize uniqueid generator; error = 13. Exiting now. 389-Directory/1.2.2 B2009.237.206 Any ideas what the issue is and how to fix? Where is it trying to get the generators state from? Thanks. Jim.

3 2

help
by Neuhold Christian (TSA) 18 May '11

18 May '11

help -~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~ This message may contain confidential and/or privileged information intended only for the addressee. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Any views expressed in this message are those of the individual sender and may not necessarily reflect the opinions of austriamicrosystems AG. -~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~-~^~ Diese E-Mail enthaelt moeglicherweise vertrauliche und/oder rechtlich geschuetzte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender und loeschen Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail ist nicht gestattet. Etwaige in dieser E-mail geaeusserte Ansichten und Meinungen stammen vom Versender dieser Nachricht und muessen nicht notwendigerweise mit den Meinungen und Ansichten von austriamicrosystems AG uebereinstimmen. ~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~.~-~

1 0

Re: [389-users] 389 directory capacity query
by Steven Li 18 May '11

18 May '11

Resent -----Original Message----- From: Steven Li Sent: 5/18/2011 [星期三] 13:50 To: Steven Li; 389-users(a)lists.fedoraproject.org; 389-devel(a)lists.fedoraproject.org Cc: Ivan Wang Subject: RE: 389 directory capacity query Resent -----Original Message----- From: Steven Li Sent: 5/18/2011 [星期三] 13:35 To: 389-users(a)lists.fedoraproject.org; 389-devel(a)lists.fedoraproject.org Cc: Ivan Wang Subject: 389 directory capacity query Hi All Now I'm begin to apply the 389 Directory server v2.6 into our env. But I want to have a check, do we have a test about the capacity of directory server ? such as what the maximun entries can be supported, what's the best deployment for large user store. As I need it to support max 200 millions users. do you think is it possible to store so many entries in the server, and if it's possible, how should I retrieve it ? Thanks.

1 0

unable to read schema
by Stephen Lorenz 16 May '11

16 May '11

Hi, We are trying to set up our 389 DS instance and everything seems to work except that LDAP browsers cannot seem to access the schema. For example, in the LDAPSort LDAP Admin Tool we receive the error message: "Unable to read schema!!" Unable to read schema, please login/bind with an account which has access to schema - You can also rebind with any entry using the right-click menu and selecting rebind. However, we are not trying to access the directory anonymously; we receive this error even when binding as Directory Manager. We also cannot browser the schema using a standard ldapsearch command. Any ideas of how to enable schema reading? Thanks, Stephen

2 1

upgrading to multimaster
by Karoly Czovek 12 May '11

12 May '11

Hi, what is the simpliest way to upgrade a master-slave replica with 4 slaves to a 4way multi-master replica, with no, or with the less service downtime? -- Karoly CZOVEK Global Systems Administrator MoveOne IT Department Eastern Europe - Balkans - CIS& Central Asia - Middle East& Africa - Asia Pacific phone: +36 1 266 0181 - ext.6710 mobile: +36 70 708 9953 skype: mo_karoly.czovek email: karoly.czovek(a)moveoneinc.com web: http://www.moveoneinc.com

1 0

Upgrade to 1.2.8.2
by Reinhard Nappert 11 May '11

11 May '11

Hi, is there somewhere a flag not to switch the entry format? I don't have an issue with a fresh install (just add nsslapd-subtree-rename-switch: off to template-dse.ldif). But I run into issues, when I upgrade existing Fedora DS 1.1.2 to 389 DS 1.2.8.2. I run setup-ds.pl -u ..... Thanks, -Reinhard

2 2

MMR issue, when deleting the replica setup.
by Reinhard Nappert 10 May '11

10 May '11

Hi, I noticed an issue with 389 DS 1.2.7.5, which I have not seen before. Here is what I do: 1. I create a two multi-master setup. 2. I don't perform any changes on the directory. 3. I delete the replica setup on both systems -- everything is fine. 4. I create a two multi-master setup. 5. Perform changes on both systems 6. Modifications get replicated. 7 I delete the replica setup. No I get the following error logs: [09/May/2011:15:43:18 -0400] - import userRoot: Import complete. Processed 446 entries in 4 seconds. (111.50 entries/sec) [09/May/2011:15:43:18 -0400] NSMMReplicationPlugin - multimaster_be_state_change: replica o=base is coming online; enabling replication ... [09/May/2011:15:45:21 -0400] NSMMReplicationPlugin - agmt_delete: begin [09/May/2011:15:45:22 -0400] NSMMReplicationPlugin - replica_config_delete: Warning: The changelog for replica o=BASE is no longer valid since the replica config is being deleted. Removing the changelog. [09/May/2011:15:45:22 -0400] NSMMReplicationPlugin - changelog program - _cl5Add Thread: invalid changelog state - 2 <== This is good! [09/May/2011:15:45:27 -0400] - libdb: <path to>/changelogdb/7773fd02-7a7411e0-ac71f4b1-0fb2d026_4dc840d3000000020000.db4: unable to flush: No such file or directory [09/May/2011:15:45:27 -0400] - libdb: txn_checkpoint: failed to flush the buffer cache No such file or directory [09/May/2011:15:45:27 -0400] - Serious Error---Failed to checkpoint database, err=2 (No such file or directory) Of course, the changelog directory was gone. It looks to me that the server keeps this still somehow in memory. I enabled the audit-logging: This is what I see there: time: 20110509154521 dn: cn=changelog5,cn=config changetype: delete modifiersname: <credentials> time: 20110509154522 dn: cn=agreement1,cn=replica,cn=o\3dbase,cn=mapping tree,cn=config changetype: delete modifiersname: <credentials> time: 20110509154522 dn: cn=replica,cn=o\3dbase,cn=mapping tree,cn=config changetype: delete modifiersname: <credentials> time: 20110509154522 dn: cn=o\3dbase,cn=mapping tree,cn=config changetype: modify replace: nsslapd-state nsslapd-state: backend - replace: nsslapd-referral - replace: modifiersname modifiersname: <credentials>- replace: modifytimestamp - replace: nsslapd-referral - replace: modifiersname modifiersname: <credentials> - replace: modifytimestamp modifytimestamp: 20110509194522Z - time: 20110509154605 dn: cn=uniqueid generator,cn=config changetype: modify replace: nsState nsState:: AM+94nR64AH0sQ+y0CZxbAEAAAAAAAAA - replace: modifiersname modifiersname: cn=server,cn=plugins,cn=config - replace: modifytimestamp modifytimestamp: 20110509194605Z - Has somebody has seen this before. Thanks, -Reinhard

2 3

creating certs
by solarflow99 10 May '11

10 May '11

Hi, i'm trying to setup replication, and was wondering how we can create self signed certs? The docs only say to send it to a CA, but not how to do it yourself. I don't see where the private key is for me to do it from the command line. Thanks,

2 2

db2bak creates ldif file not database backup
by David Baird 10 May '11

10 May '11

Hi All, I wonder if anyone else has seen this? On our recently implemented 389 server (1.2.8.1) /usr/lib64/dirsrv/slapd-xxx/db2bak produces an ldif as output rather than a backup of the databases. I've switched to using db2bak.pl, but is this something that anyone has encountered before? [root@server ~]/var/lib64/dirsrv/slapd-xxx/db2bak Back up directory: /var/lib/dirsrv/slapd-xxx/bak/xxx-2011_05_10_09_46_43 [10/May/2011:09:46:43 +1200] 389-Directory/1.2.8.1 - debug level: backend (524288) [root@server ~]# ls -al /var/lib/dirsrv/slapd-xxx/bak total 152 drwxrwx--- 2 ldap ldap 4096 May 10 09:46 . drwxrwx--- 6 ldap ldap 4096 Apr 21 08:30 .. -rw------- 1 ldap ldap 67292 May 10 09:46 xxx-2011_05_10_094641.ldif Additionally, if you provide a backup directory to the db2bak command (db2bak /var/lib/dirsrv/slapd-xxx/bak/daily) it produces no output. [root@server ~]# /usr/lib64/dirsrv/slapd-xxx/db2bak /var/lib/dirsrv/slapd-xxx/bak/daily Back up directory: /var/lib/dirsrv/slapd-xxx/bak/daily [10/May/2011:10:06:52 +1200] 389-Directory/1.2.8.1 - debug level: backend (524288) [root@server ~]# ls /var/lib/dirsrv/slapd-xxx/bak xxx-2011_05_10_094641.ldif Should I file a bug report? David. ------------------------------------------------------------------------------ David Baird BSc. Programmer/Analyst Faculty of Computing & Mathematical Sciences email: dbaird(a)scms.waikato.ac.nz University of Waikato Phone: +64 7 838 4549 Private Bag 3105 Fax: +64 7 838 4155 Hamilton, New Zealand ------------------------------------------------------------------------------

2 1

389 upgrade error
by Sandra Blain Escalona 07 May '11

07 May '11

I've upgrading the new version 389 and when I run the script setup-ds-admin.pl -u I get this error: [root@pluton yum.repos.d]# setup-ds-admin.pl -u ============================================================================== The update option will allow you to re-register your servers with the configuration directory server and update the information about your servers that the console and admin server uses. You will need your configuration directory server admin ID and password to continue. Continue? [yes]: ============================================================================== Please specify the information about your configuration directory server. The following information is required: - host (fully qualified), port (non-secure or secure), suffix, protocol (ldap or ldaps) - this information should be provided in the form of an LDAP url e.g. for non-secure ldap://host.example.com:389/o=NetscapeRoot or for secure ldaps://host.example.com:636/o=NetscapeRoot - admin ID and password - admin domain - a CA certificate file may be required if you choose to use ldaps and security has not yet been configured - the file must be in PEM/ASCII format - specify the absolute path and filename Configuration directory server URL [ldap://pluton.virtual.etecsa.cu:389/o=NetscapeRoot]: Configuration directory server admin ID [uid=admin389, ou=Administrators, ou=TopologyManagement, o=NetscapeRoot]: Configuration directory server admin password: Configuration directory server admin domain [virtual.etecsa.cu]: The server 'ldap://pluton.virtual.etecsa.cu:389/o=NetscapeRoot' is not reachable. Error: unknown error Please try again, in case you mis-typed something. and it repeat again. I tried to start dirsrv service but its fails, but dirsrv-admin service is running somebody can help me??? thanks Sandra --- This message was processed by Kaspersky Mail Gateway 5.6.28/RELEASE running at host imx2.etecsa.cu Visit our web-site: <http://www.kaspersky.com>, <http://www.viruslist.com>

3 4

Problem syncing DS with AD W2k3
by Carsten Grzemba 06 May '11

06 May '11

Hi, I have a problem with syncing users with AD W2k3. The Setup works fine with W2k8. If I start a replica initialization send_dirsync_search got no results from W2k3 AD. No errors seen in the log. [06/May/2011:10:59:20 +0200] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=MDVH" (srv-dc-vlan:636)". [06/May/2011:10:59:20 +0200] - => windows_private_null_dirsync_control [06/May/2011:10:59:20 +0200] - <= windows_private_null_dirsync_control [06/May/2011:10:59:20 +0200] - => windows_private_get_windows_subtree [06/May/2011:10:59:20 +0200] - <= windows_private_get_windows_subtree [06/May/2011:10:59:20 +0200] - => windows_private_get_directory_replarea [06/May/2011:10:59:20 +0200] - <= windows_private_get_directory_replarea [06/May/2011:10:59:20 +0200] - => windows_private_get_api_cookie [06/May/2011:10:59:20 +0200] - <= windows_private_get_api_cookie [06/May/2011:10:59:20 +0200] - => windows_dirsync_inc_run [06/May/2011:10:59:20 +0200] - => send_dirsync_search [06/May/2011:10:59:20 +0200] - => windows_conn_connected [06/May/2011:10:59:20 +0200] - <= windows_conn_connected [06/May/2011:10:59:20 +0200] - => windows_private_get_windows_subtree [06/May/2011:10:59:20 +0200] - <= windows_private_get_windows_subtree [06/May/2011:10:59:20 +0200] - => windows_private_dirsync_control [06/May/2011:10:59:20 +0200] - <= windows_private_dirsync_control [06/May/2011:10:59:20 +0200] - Calling dirsync search request plugin [06/May/2011:10:59:20 +0200] - => windows_private_get_api_cookie [06/May/2011:10:59:20 +0200] - <= windows_private_get_api_cookie [06/May/2011:10:59:20 +0200] - Sending dirsync search request [06/May/2011:10:59:20 +0200] - <= send_dirsync_search [06/May/2011:10:59:20 +0200] - => windows_conn_get_search_result [06/May/2011:10:59:20 +0200] - => windows_conn_connected [06/May/2011:10:59:20 +0200] - <= windows_conn_connected [06/May/2011:10:59:20 +0200] - => windows_private_dirsync_has_more [06/May/2011:10:59:20 +0200] - <= windows_private_dirsync_has_more [06/May/2011:10:59:20 +0200] - <= windows_conn_get_search_result [06/May/2011:10:59:21 +0200] - => windows_private_dirsync_has_more [06/May/2011:10:59:21 +0200] - <= windows_private_dirsync_has_more [06/May/2011:10:59:21 +0200] - <= windows_dirsync_inc_run [06/May/2011:10:59:21 +0200] - => windows_private_save_dirsync_cookie [06/May/2011:10:59:21 +0200] - => slapi_control_present (looking for 1.3.6.1.4.1.42.2.27.8.5.1)[06/May/2011:10:59:21 +0200] - <= slapi_control_present 0 (NO CONTROLS) [06/May/2011:10:59:21 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.12) [06/May/2011:10:59:21 +0200] - <= slapi_control_present 0 (NO CONTROLS) [06/May/2011:10:59:21 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.18) [06/May/2011:10:59:21 +0200] - <= slapi_control_present 0 (NO CONTROLS) [06/May/2011:10:59:21 +0200] - modify_update_last_modified_attr [06/May/2011:10:59:21 +0200] - Calling plugin 'Distributed Numeric Assignment internal preop plugin' #0 type 421 [06/May/2011:10:59:21 +0200] dna-plugin - --> dna_pre_op [06/May/2011:10:59:21 +0200] dna-plugin - --> dna_get_dn [06/May/2011:10:59:21 +0200] dna-plugin - <-- dna_get_dn [06/May/2011:10:59:21 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.12) [06/May/2011:10:59:21 +0200] - <= slapi_control_present 0 (NO CONTROLS) [06/May/2011:10:59:21 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.18) [06/May/2011:10:59:21 +0200] - <= slapi_control_present 0 (NO CONTROLS) [06/May/2011:10:59:21 +0200] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=2 [06/May/2011:10:59:21 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [06/May/2011:10:59:21 +0200] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=1 [06/May/2011:10:59:21 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [06/May/2011:10:59:21 +0200] - => compute_limits: sizelimit=-1, timelimit=-1 [06/May/2011:10:59:21 +0200] - Calling plugin 'ACL preoperation' #1 type 403 [06/May/2011:10:59:21 +0200] - Calling plugin 'deref' #3 type 403 [06/May/2011:10:59:21 +0200] deref-plugin - --> deref_pre_search [06/May/2011:10:59:21 +0200] deref-plugin - <-- deref_pre_op [06/May/2011:10:59:21 +0200] - Calling plugin 'Legacy replication preoperation plugin' #6 type 403 [06/May/2011:10:59:21 +0200] - Calling plugin 'Multimaster replication preoperation plugin' #8 type 403 [06/May/2011:10:59:21 +0200] - => send_ldap_search_entry (cn=MDVH,cn=replica,cn=dc\3Dmdvh\2Cdc\3Ddom,cn=mapping tree,cn=config) [06/May/2011:10:59:21 +0200] - Calling plugin 'deref' #3 type 410 [06/May/2011:10:59:21 +0200] - Calling plugin 'Legacy replication preoperation plugin' #6 type 410 [06/May/2011:10:59:21 +0200] - <= send_ldap_search_entry [06/May/2011:10:59:21 +0200] - => send_ldap_result 0:: [06/May/2011:10:59:21 +0200] - <= send_ldap_result [06/May/2011:10:59:21 +0200] - => entry_apply_mods [06/May/2011:10:59:21 +0200] - <= entry_apply_mods 0 [06/May/2011:10:59:21 +0200] dna-plugin - --> dna_is_config [06/May/2011:10:59:21 +0200] dna-plugin - <-- dna_is_config [06/May/2011:10:59:21 +0200] dna-plugin - <-- dna_pre_op [06/May/2011:10:59:21 +0200] - Calling plugin 'Legacy replication internal preoperation plugin' #1 type 421 [06/May/2011:10:59:21 +0200] - Calling plugin 'Multimaster replication internal preoperation plugin' #2 type 421 [06/May/2011:10:59:21 +0200] - => entry_apply_mods [06/May/2011:10:59:21 +0200] - <= entry_apply_mods 0 [06/May/2011:10:59:21 +0200] - => send_ldap_result 0:: [06/May/2011:10:59:21 +0200] - <= send_ldap_result [06/May/2011:10:59:21 +0200] - ps_service_persistent_searches: entry "cn=MDVH,cn=replica,cn=dc\3Dmdvh\2Cdc\3Ddom,cn=mapping tree,cn=config" not enqueued on any persistent search lists [06/May/2011:10:59:21 +0200] - Calling plugin 'Retrocl internal postoperation plugin' #0 type 521 [06/May/2011:10:59:21 +0200] - not applying change if not logging [06/May/2011:10:59:21 +0200] - Calling plugin 'Class of Service internalpostoperation plugin' #1 type 521 [06/May/2011:10:59:21 +0200] - --> cos_post_op [06/May/2011:10:59:21 +0200] - --> cos_cache_change_notify [06/May/2011:10:59:21 +0200] - --> cos_cache_template_index_bsearch [06/May/2011:10:59:21 +0200] - --> cos_cache_getref [06/May/2011:10:59:21 +0200] - <-- cos_cache_getref [06/May/2011:10:59:21 +0200] - <-- cos_cache_template_index_bsearch [06/May/2011:10:59:21 +0200] - <-- cos_cache_change_notify [06/May/2011:10:59:21 +0200] - <-- cos_post_op [06/May/2011:10:59:21 +0200] - Calling plugin 'Legacy replication internal postoperation plugin' #2 type 521 [06/May/2011:10:59:21 +0200] - Calling plugin 'Linked Attributes internal postop plugin' #3 type 521 [06/May/2011:10:59:21 +0200] linkedattrs-plugin - --> linked_attrs_mod_post_op [06/May/2011:10:59:21 +0200] - Calling plugin 'Managed Entries internal postop plugin' #4 type 521 [06/May/2011:10:59:21 +0200] managed-entries-plugin - --> mep_mod_post_op [06/May/2011:10:59:21 +0200] managed-entries-plugin - --> mep_oktodo [06/May/2011:10:59:21 +0200] managed-entries-plugin - <-- mep_oktodo [06/May/2011:10:59:21 +0200] managed-entries-plugin - --> mep_get_dn [06/May/2011:10:59:21 +0200] managed-entries-plugin - <-- mep_get_dn [06/May/2011:10:59:21 +0200] managed-entries-plugin - --> mep_dn_is_config [06/May/2011:10:59:21 +0200] managed-entries-plugin - <-- mep_dn_is_config [06/May/2011:10:59:21 +0200] managed-entries-plugin - --> mep_isrepl [06/May/2011:10:59:21 +0200] managed-entries-plugin - <-- mep_isrepl [06/May/2011:10:59:21 +0200] managed-entries-plugin - <-- mep_mod_post_op [06/May/2011:10:59:21 +0200] - Calling plugin 'Multimaster replication internal postoperation plugin' #5 type 521 [06/May/2011:10:59:21 +0200] - Calling plugin 'Roles internalpostoperation plugin' #6 type 521 [06/May/2011:10:59:21 +0200] - <= windows_private_save_dirsync_cookie [06/May/2011:10:59:21 +0200] - => windows_release_replica [06/May/2011:10:59:21 +0200] - => windows_conn_start_linger [06/May/2011:10:59:21 +0200] NSMMReplicationPlugin - agmt="cn=MDVH" (srv-dc-vlan:636): Beginning linger on the connection [06/May/2011:10:59:21 +0200] - => windows_conn_connected [06/May/2011:10:59:21 +0200] - <= windows_conn_connected [06/May/2011:10:59:21 +0200] - <= windows_conn_start_linger [06/May/2011:10:59:21 +0200] - <= windows_release_replica [06/May/2011:10:59:21 +0200] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=MDVH" (srv-dc-vlan09:636)". Sent 0 entries. [06/May/2011:10:59:21 +0200] - total update setting consumer RUV: [06/May/2011:10:59:21 +0200] NSMMReplicationPlugin - consumer: {replicageneration} 4da43ace0000004c0000 [06/May/2011:10:59:21 +0200] NSMMReplicationPlugin - consumer: {replica 76 ldap://ux-ldap01.mdvh.dom:389} 4da45acc0000004c0000 4da45ad90000004c0000 00000000 ... Its a binary, build by myself: bash-3.00# /opt/389ds/sbin/ns-slapd -v 389 Project 389-Directory/1.2.9.a1 B2011.125.756 Any hints? Thanks Carsten

2 1

389 install error
by 馬小布 06 May '11

06 May '11

Hi , all : Today when I install the newest 389 directory server on the other machine which installed centos 5.3 i386 . Then it displayed the following error message: root@test ~: setup-ds-admin.pl .... .... Administration port [9830]: ============================================================================== The interactive phase is complete. The script will now set up your servers. Enter No or go Back if you want to change something. Are you ready to set up your servers? [yes]: Creating directory server . . . Your new DS instance 'slave' was successfully created. Creating the configuration directory server . . . dn: o=NetscapeRoot objectclass: top objectclass: organization o: NetscapeRoot aci: (targetattr="*")(version 3.0; acl "Enable Configuration Administrator Gro up modification"; allow (all) groupdn="ldap:///cn=Configuration Administrator s,ou=Groups,ou=TopologyManagement,o=NetscapeRoot";) aci: (targetattr="*")(targetfilter=(o=NetscapeRoot))(version 3.0; acl "Default anonymous access"; allow (read, search) userdn="ldap:///anyone";) aci: (targetattr="*")(version 3.0; acl "Enable Group Expansion"; allow (read, search, compare) groupdnattr="uniquemember";) Error adding entry 'o=NetscapeRoot'. Error: Can't contact LDAP server Failed to create the configuration directory server Exiting . . . Log file is '/tmp/setupkF9lno.log' Could someone can help me ? Thanks ...

3 3

entry-id conflict
by Angel Bosch Mora 06 May '11

06 May '11

hi, i'm setting up another node on my multimaster environment. on the new node i can see differencese on entry-id attribute. is this normal? i guess this is an internal attribute but i'm not sure if must be shared an unique across members of replication. regars, abosch

2 1

Bug in console?
by Diego Woitasen 05 May '11

05 May '11

Hi, I have 389 DS working with Window Sync against Windows 2003. It works fine, including the password replication. Anyway I found that (obviusly) the password replication from 389 to AD works only if the client changes the password using "Password Modify (RFC 3062) extended operation". This works with the Python module or the ldappasswd utility. The problem is the Admin Console. When you changes the user's password from the console, I see a MOD operation in the log file, and obviusly the password is not replicated to AD. Shall I file a bug report or Am I missing something? Regards, Diego -- Diego Woitasen

2 3

Referral errors ....
by Reinhard Nappert 05 May '11

05 May '11

Hi, I have the following setup: I have a 2 multimaster replication setup, where both masters also have a number of shadowing agreements to other consumers. The data gets replicated to all boxes and there are no issues. When I try to perform an update on the slaves, it works on all, but one. Meaning, the server sends back err=10, with the referral to one of the masters and the client automatically follows the referrals. Unfortunately, it does not works with one box: When there is an attempt to write to the db, the server returns an error-code 1, with the following message: javax.naming.NamingException: [LDAP: error code 1 - Mapping tree node for o=base is set to return a referral, but no referral is configured for it]; This can also be seen in the access file: [26/Apr/2011:05:35:45 -0300] conn=3418 op=13256 ADD dn="ou=test,o=base" [26/Apr/2011:05:35:45 -0300] conn=3418 op=13256 RESULT err=1 tag=105 nentries=0 etime=0 When I have a look at the configuration, it looks exactly like the others: dn: cn="o=Base",cn=mapping tree,cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree cn: "o=Base" nsslapd-state: referral on update nsslapd-backend: userRoot modifiersName: cn=server,cn=plugins,cn=config modifyTimestamp: 20100721202730Z nsslapd-referral: ldap://master-ld01:389/o=Base nsslapd-referral<ldap://master-ld01:389/o=Basensslapd-referral>: ldap://master-ld02:389/o=Base numSubordinates<ldap://master-ld02:389/o=BasenumSubordinates>: 1 dn: cn=replica,cn="o=Base",cn=mapping tree,cn=config nsDS5ReplicaBindDN: cn=replication,cn=config nsDS5ReplicaRoot: o=Base nsDS5Flags: 0 nsDS5ReplicaType: 2 nsds5ReplicaPurgeDelay: 43200 objectClass: top objectClass: nsDS5Replica cn: replica modifiersName: cn=Multimaster Replication Plugin,cn=plugins,cn=config modifyTimestamp: 20110421052744Z nsDS5ReplicaId: 65535 nsState:: //8AAAAAAADLv69NAAAAAAAAAAAAAAAALSoAAAAAAAAIAAAAAAAAAA== nsDS5ReplicaName: 59480b7e-94fb11df-9df8eeea-774385c0 nsDS5ReplicaReferral: ldap://master-ld01:389/o=Base nsDS5ReplicaReferral<ldap://master-ld01:389/o=BasensDS5ReplicaReferral>: ldap://master-ld02:389/o=Base I was wondering if someone has seen this kind of issue. Everything looks fine to me and I can not explain this behavior. Right now, I can not reproduce this issue. I only see it in this one setup. Thanks, -Reinhard

2 10

389 Crash problem
by 馬小布 05 May '11

05 May '11

Hi , all : I am a newbie to here , today I tried to install the 389 newest version by "yum install 389" command from epel repo on CentOS 5.5 64 bit machine. When I configured it and then open the 389 console , tried to click the "Server Group" in the main console , then the terminal had the following error message: ----------------------------------------------------------------------------------------------------------------------------------------------------------- java.lang.NoSuchMethodException: com.netscape.management.client.util.LDAPUtil.isValidDN(java.lang.String) at java.lang.Class.getMethod(Class.java:1622) at com.netscape.admin.dirserv.DSUtil.<clinit>(Unknown Source) at com.netscape.admin.dirserv.DSAdmin.initialize(Unknown Source) at com.netscape.management.client.topology.ServerNode.createServerInstance(Unknown Source) at com.netscape.management.client.topology.ServerNode.reload(Unknown Source) at com.netscape.management.client.topology.ServerNode.initialize(Unknown Source) at com.netscape.management.client.topology.ServerNode.<init>(Unknown Source) at com.netscape.management.client.topology.AdminGroupNode.reload(Unknown Source) at com.netscape.management.client.topology.ServerLocNode.getChildCount(Unknown Source) at com.netscape.management.client.ResourcePage.treeWillExpand(Unknown Source) at javax.swing.JTree.fireTreeWillExpand(JTree.java:2729) at javax.swing.JTree.setExpandedState(JTree.java:3427) at javax.swing.JTree.expandPath(JTree.java:2171) at javax.swing.plaf.basic.BasicTreeUI.toggleExpandState(BasicTreeUI.java:2241) at javax.swing.plaf.basic.BasicTreeUI.handleExpandControlClick(BasicTreeUI.java:2228) at javax.swing.plaf.basic.BasicTreeUI.checkForClickInExpandControl(BasicTreeUI.java:2186) at javax.swing.plaf.basic.BasicTreeUI$Handler.handleSelection(BasicTreeUI.java:3540) at javax.swing.plaf.basic.BasicTreeUI$Handler.mousePressed(BasicTreeUI.java:3488) at java.awt.AWTEventMulticaster.mousePressed(AWTEventMulticaster.java:279) at java.awt.Component.processMouseEvent(Component.java:6098) at javax.swing.JComponent.processMouseEvent(JComponent.java:3267) at java.awt.Component.processEvent(Component.java:5866) at java.awt.Container.processEvent(Container.java:2105) at java.awt.Component.dispatchEventImpl(Component.java:4462) at java.awt.Container.dispatchEventImpl(Container.java:2163) at java.awt.Component.dispatchEvent(Component.java:4288) at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4461) at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4122) at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4055) at java.awt.Container.dispatchEventImpl(Container.java:2149) at java.awt.Window.dispatchEventImpl(Window.java:2478) at java.awt.Component.dispatchEvent(Component.java:4288) at java.awt.EventQueue.dispatchEvent(EventQueue.java:604) at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:275) at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:200) at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:190) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:185) at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:177) at java.awt.EventDispatchThread.run(EventDispatchThread.java:138) ------------------------------------------------------------------------------------------------------------ But the 389 ds could work well . Is it the 389 ds crash or bug ? Could someone can explain it ? Thanks in advance...

3 2

proper way of backup
by Karoly Czovek 04 May '11

04 May '11

'Morning, what is the proper way of backing up 389DS server data, from commndline, what can be restoren even a server reinstall? -- Karoly CZOVEK Global Systems Administrator MoveOne IT Department Eastern Europe - Balkans - CIS& Central Asia - Middle East& Africa - Asia Pacific phone: +36 1 266 0181 - ext.6710 mobile: +36 70 708 9953 skype: mo_karoly.czovek email: karoly.czovek(a)moveoneinc.com web: http://www.moveoneinc.com

4 3

The other end of forcing a password reset...
by David Barr 04 May '11

04 May '11

Good Morning! I get the trick of setting a password policy to force a password change on the next login, and I've implemented. What I think I'm missing is the piece that goes into the login process somewhere and actually checks the need for a reset and forces the execution of [ldap]passwd as the first thing the user does after login. Is that part documented somewhere? Google buries me under the LDAP server end of the process. Thanks! David -- David - Offbeat http://dafydd.livejournal.com dafydd - Online http://pgp.mit.edu/ Battalion 4 - Black Rock City Emergency Services Department Integrity*Commitment*Communication*Support ----5----1----5----2----5----3----5----4----5----5----5----6----5----7-- "Do your job and demand your compensation - but in that order. -- Cary Grant

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users May 2011