Error Starting LDAP service
by Binole, Bill
I am seeing the following error when starting the 389 LDAP server version 1.2.9.9. The file is our dns schema which has been in use for some time. It is successfully read in version 1.2.2. I have seen a bug report around this issue but it was many years old and fixed. Since the file works on a previous version was this problem reintroduced?
The entry cn=schema in file /etc/dirsrv/slapd-fnhubice03/schema/72DNSZone-Schema.ldif is invalid, error code 21 (Invalid syntax) - object class dNSZone: Unknown allowed attribute type "ARecord"
Regards,
Bill
Confidentiality Notice: The information contained in this electronic transmission is confidential and may be legally privileged. It is intended only for the addressee(s) named above. If you are not an intended recipient, be aware that any disclosure, copying, distribution or use of the information contained in this transmission is prohibited and may be unlawful. If you have received this transmission in error, please notify us by telephone (513) 229-5500 or by email (postmaster(a)MedPlus.com). After replying, please erase it from your computer system.
11 years, 9 months
No schema?
by Gary Algier
Hello:
I just installed a fresh install of the 389 DS from EPEL and I see no schema:
-------------------------------------------------------------
# ldapsearch -x -h localhost -s sub -b cn=schema -wxxxxxxxx \
-Dcn=directory\ manager
# extended LDIF
#
# LDAPv3
# base <cn=schema> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# schema
dn: cn=schema
objectClass: top
objectClass: ldapSubentry
objectClass: subschema
cn: schema
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
-------------------------------------------------------------
If I look at /etc/dirsrv/slapd-*/schema I see lots of files all with all sorts
of contents. Is the schema unavailable by design? I also looked with
389-console and I see nothing in the schema.
Version information:
# rpm -q 389-ds
389-ds-1.2.1-1.el5
# grep ^ /etc/*release*
/etc/redhat-release:CentOS release 5.8 (Final)
--
Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758
Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033
Nielsen's First Law of Computer Manuals:
People don't read documentation voluntarily.
11 years, 9 months
replication from 1.2.8.3 to 1.2.10.4
by Robert Viduya
Is replication from a 1.2.8.3 server to a 1.2.10.4 server known to work or not work? We're having changelog issues.
Background:
We have an ldap service consisting of 3 masters, 2 hubs and 16 slaves. All were running 1.2.8.3 since last summer with no issues. This summer, we decided to bring them all up to the latest stable release, 1.2.10.4. We can't afford a lot of downtime for the service as a whole, but with the redundancy level we have, we can take down a machine or two at a time without user impact.
We started with one slave, did a clean install of 1.2.10.4 on it, set up replication agreements from our 1.2.8.3 hubs to it and watched it for a week or so. Everything looked fine, so we started rolling through the rest of the slave servers, got them all running 1.2.10.4 and so far haven't seen any problems.
A couple of days ago, I did one of our two hubs. The first time I bring up the daemon after doing the initial import of our ldap data everything seems fine. However, we start seeing errors the first time we restart:
[11/Jul/2012:10:43:58 -0400] - slapd shutting down - signaling operation threads
[11/Jul/2012:10:43:58 -0400] - slapd shutting down - waiting for 2 threads to terminate
[11/Jul/2012:10:44:01 -0400] - slapd shutting down - closing down internal subsystems and plugins
[11/Jul/2012:10:44:02 -0400] - Waiting for 4 database threads to stop
[11/Jul/2012:10:44:04 -0400] - All database threads now stopped
[11/Jul/2012:10:44:04 -0400] - slapd stopped.
[11/Jul/2012:10:45:00 -0400] - 389-Directory/1.2.10.4 B2012.101.2023 starting up
[11/Jul/2012:10:45:07 -0400] NSMMReplicationPlugin - ruv_compare_ruv: the max CSN [4ffdca7e000000330000] from RUV [changelog max RUV] is larger than the max CSN [4ffb605d000000330000] from RUV [database RUV] for element [{replica 51} 4ffb602b000300330000 4ffdca7e000000330000]
[11/Jul/2012:10:45:07 -0400] NSMMReplicationPlugin - replica_check_for_data_reload: Warning: data for replica ou=accounts,ou=gtaccounts,ou=departments,dc=gted,dc=gatech,dc=edu does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized.
[11/Jul/2012:10:45:07 -0400] NSMMReplicationPlugin - ruv_compare_ruv: the max CSN [4ffdca70000000340000] from RUV [changelog max RUV] is larger than the max CSN [4ffb7098000100340000] from RUV [database RUV] for element [{replica 52} 4ffb6ea2000000340000 4ffdca70000000340000]
[11/Jul/2012:10:45:07 -0400] NSMMReplicationPlugin - replica_check_for_data_reload: Warning: data for replica ou=people,dc=gted,dc=gatech,dc=edu does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized.
[11/Jul/2012:10:45:08 -0400] - slapd started. Listening on All Interfaces port 389 for LDAP requests
[11/Jul/2012:10:45:08 -0400] - Listening on All Interfaces port 636 for LDAPS requests
The _second_ restart is even worse, we get more error messages (see below) and then the daemon dies after it says it's listening on it's ports:
[11/Jul/2012:10:45:32 -0400] - slapd shutting down - signaling operation threads
[11/Jul/2012:10:45:32 -0400] - slapd shutting down - waiting for 29 threads to terminate
[11/Jul/2012:10:45:34 -0400] - slapd shutting down - closing down internal subsystems and plugins
[11/Jul/2012:10:45:35 -0400] - Waiting for 4 database threads to stop
[11/Jul/2012:10:45:36 -0400] - All database threads now stopped
[11/Jul/2012:10:45:36 -0400] - slapd stopped.
[11/Jul/2012:10:46:11 -0400] - 389-Directory/1.2.10.4 B2012.101.2023 starting up
[11/Jul/2012:10:46:11 -0400] NSMMReplicationPlugin - ruv_compare_ruv: RUV [changelog max RUV] does not contain element [{replica 68 ldap://gtedm3.iam.gatech.edu:389} 4be339e6000000440000 4ffdc9a1000000440000] which is present in RUV [database RUV]
[11/Jul/2012:10:46:11 -0400] NSMMReplicationPlugin - ruv_compare_ruv: RUV [changelog max RUV] does not contain element [{replica 71 ldap://gtedm4.iam.gatech.edu:389} 4be6031e000000470000 4ffdc9a8000000470000] which is present in RUV [database RUV]
[11/Jul/2012:10:46:11 -0400] NSMMReplicationPlugin - ruv_compare_ruv: the max CSN [4ffb62a2000100330000] from RUV [changelog max RUV] is larger than the max CSN [4ffb605d000000330000] from RUV [database RUV] for element [{replica 51} 4ffb605d000000330000 4ffb62a2000100330000]
[11/Jul/2012:10:46:11 -0400] NSMMReplicationPlugin - replica_check_for_data_reload: Warning: data for replica ou=accounts,ou=gtaccounts,ou=departments,dc=gted,dc=gatech,dc=edu does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized.
[11/Jul/2012:10:46:11 -0400] NSMMReplicationPlugin - ruv_compare_ruv: RUV [changelog max RUV] does not contain element [{replica 69 ldap://gtedm3.iam.gatech.edu:389} 4be339e4000000450000 4ffdc9a2000000450000] which is present in RUV [database RUV]
[11/Jul/2012:10:46:11 -0400] NSMMReplicationPlugin - ruv_compare_ruv: RUV [changelog max RUV] does not contain element [{replica 72 ldap://gtedm4.iam.gatech.edu:389} 4be6031d000000480000 4ffdc9a9000300480000] which is present in RUV [database RUV]
[11/Jul/2012:10:46:11 -0400] NSMMReplicationPlugin - ruv_compare_ruv: the max CSN [4ffb78bc000000340000] from RUV [changelog max RUV] is larger than the max CSN [4ffb7098000100340000] from RUV [database RUV] for element [{replica 52} 4ffb7098000100340000 4ffb78bc000000340000]
[11/Jul/2012:10:46:11 -0400] NSMMReplicationPlugin - replica_check_for_data_reload: Warning: data for replica ou=people,dc=gted,dc=gatech,dc=edu does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized.
[11/Jul/2012:10:46:11 -0400] - slapd started. Listening on All Interfaces port 389 for LDAP requests
[11/Jul/2012:10:46:11 -0400] - Listening on All Interfaces port 636 for LDAPS requests
At this point, the only way I've found to get it back is to clean out the changelog and db directories and re-import the ldap data from scratch. Essentially we can't restart without having to re-import. I've done this a couple of times already and it's entirely reproducible.
I've checked and ensured that there's no obsolete masters that need to be CLEANRUVed. I've also noticed that the errors _seem_ to be only affecting our second and third suffix. We have three suffixes defined, but I haven't seen any error messages for the first one.
Has anyone seen anything like this? We're not sure if this is a general 1.2.10.4 issue or if it only occurs if when replicating from 1.2.8.3 to 1.2.10.4. If it's the former, we cannot proceed with getting the rest of the servers up to 1.2.10.4. If it's the latter, then we need to expedite getting everything up to 1.2.10.4.
11 years, 9 months
Questions on 389 configuration
by Alberto Suárez
Hi,
I have finished configuring 389 on Centos 6.2. and it seems to work ok
now. Not a conceptually difficult exercise, but a very complex exercise
in practice, due to the many details that have to be born in mind which
either are not well documented (IMHO) or scatterd in several docs, plus
the tricky changes introduced by Centos 6.2.
My intention is to prepare a doc in spanish explaining how to set the
thing up from the beginning and make it available to anyone who needs it.
However I still have some doubts after having gone through the
installation an configuration of the product:
1. Autobind and LDAPI. From my understanding, Centos 6.2 wants you to
use SSL, but on the other hand there is LDAPI which is meant to be
faster and more secure. In my case, the client and LDAP will be sitting
on the same machine, so I do not see the point in using SSL as opposed
to ldapi. How do you configure 389 to use ldapi and not SSL? I enabled
LDAPI and configured Autobind following the instructions given in RHDS
9.0 documentation, but I do not se how it is (if it is) used.
2. Is there some doc that explains the various directives found in
/etc/pam_ldap.conf and /etc/nslcd.conf files? I have configured some in
order to get it to work, but I do not understand well its purpose. The
man page does not cover every directive and it is not quite explanatory,
anyway.
Thank you.
Alberto
11 years, 9 months
CoS plugin and country related fields
by Vlad
Hello,
I'm trying to configure classic CoS plug-in to fill automatically
"Country" ("c") and "Friendly Country" ("co") based on "countrycode"
attribute. While classic CoS works perfectly fine with some ather
attributes, I can't get it working with the country related fields I
mentioned above. I'd appreciate any help!
Thanks in advance,
Vladimir.
11 years, 9 months
New install fails on dependencies
by Mitchell, Kevin
Running this:
yum install [--enablerepo=repo] 389-ds
Errors with this:
--> Finished Dependency Resolution
Error: Package: R-devel-2.15.0-1.el6.x86_64 (epel)
Requires: texinfo-tex
Doing a -skip-broken causes no dependencies to be install. Only the 389 packages get install.
Kevin Mitchell | Wind River | IT Systems
Tel: 510 749 2418 | Fax: 510 749 2010 | www.windriver.com<http://www.windriver.com/>
11 years, 9 months
Question regarding Combining ObjectClasses to add attributes
by Anderson, Cary＠CIO
I have recently started working with the Director Server, and I have read the documents for both 389 and RHDS, but I am having some difficulties regarding ObjectClass types, and combining them in order to extend the available attributes for an object. The documents indicate that you can only have one Structural ObjectClass and multiple Aux. ObjectClasses, and I'm a bit hazy on the rules for Abstract ObjectClasses.
If I take the example of needing to add the "host" attribute to a user object. A RHN knowledgebase article indicates to add the "hostobject" ObjectClass rather than the "Account" ObjectClass. My assumption was that "hostobject" was an Aux. ObjectClass, and that "Account" was Structural, but when I look at the two ObjectClasses via the administrative GUI, they both have "Top" listed as the parent ObjectClass. So I'm not certain why one is appropriate and the other is not.
Moving forward I want to be able to combine ObjectClasses to extend available objects without introducing data integrity issues in my ldap directory. I am looking for some clarification of rules regarding structural objectclasses, and if there is an easy way via the admin gui to tell the difference between structural, auxillary, and abstract objectclasses. Also will the directory do some sort of intregrity checking if you attempt to combine improper objectclasses either via commandline or the admin gui?
Thanks
Cary Anderson
916.464.5108
Linux Support | Engineering Dept.
11 years, 9 months
Re: [389-users] 389-users Digest, Vol 86, Issue 9
by Filippe Costa Spolti
Today's Topics:
1. setting ACI to countryCode attribute (Elisseev V.)
2. Re: setting ACI to countryCode attribute (Rich Megginson)
3. Re: setting ACI to countryCode attribute (Rob Crittenden)
4. Re: setting ACI to countryCode attribute (Elisseev V.)
5. Re: Question regarding Combining ObjectClasses to add
attributes (Anderson, Cary@CIO)
6. Re: Question regarding Combining ObjectClasses to add
attributes (Rich Megginson)
7. Password policy questions (Greg Kuchyt)
8. Re: Password policy questions (Rich Megginson)
9. Re: Question regarding Combining ObjectClasses to add
attributes (Morris, Patrick)
10. Fedora 17 64 bits doesn't shutdown. (Spolti)
Good morning guys,
Yesterday i upgrade my fedora 16 to fedora 17, since then i need turn my pc
off by pressing the shutdown button only.
Anyone had this problem to?
Regards!.
2012/7/10 <389-users-request(a)lists.fedoraproject.org>
> Send 389-users mailing list submissions to
> 389-users(a)lists.fedoraproject.org
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://admin.fedoraproject.org/mailman/listinfo/389-users
> or, via email, send a message with subject or body 'help' to
> 389-users-request(a)lists.fedoraproject.org
>
> You can reach the person managing the list at
> 389-users-owner(a)lists.fedoraproject.org
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of 389-users digest..."
>
>
> Today's Topics:
>
> 1. setting ACI to countryCode attribute (Elisseev V.)
> 2. Re: setting ACI to countryCode attribute (Rich Megginson)
> 3. Re: setting ACI to countryCode attribute (Rob Crittenden)
> 4. Re: setting ACI to countryCode attribute (Elisseev V.)
> 5. Re: Question regarding Combining ObjectClasses to add
> attributes (Anderson, Cary@CIO)
> 6. Re: Question regarding Combining ObjectClasses to add
> attributes (Rich Megginson)
> 7. Password policy questions (Greg Kuchyt)
> 8. Re: Password policy questions (Rich Megginson)
> 9. Re: Question regarding Combining ObjectClasses to add
> attributes (Morris, Patrick)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Tue, 10 Jul 2012 16:28:37 +0200
> From: "Elisseev V." <vovan(a)vovan.nl>
> To: 389-users(a)lists.fedoraproject.org
> Subject: [389-users] setting ACI to countryCode attribute
> Message-ID: <1341930517.3558.58.camel@laptop>
> Content-Type: text/plain; charset="UTF-8"
>
> Hello,
>
> I'm trying to define ACI for "countryCode" attribute and getting an
> error "Attribute is not defined in the schema". However, i can create an
> entry with this attribute. Could somebody clarify what the problem is.
>
> Thank you in advance,
> Vlad.
>
>
>
> ------------------------------
>
> Message: 2
> Date: Tue, 10 Jul 2012 08:37:48 -0600
> From: Rich Megginson <rmeggins(a)redhat.com>
> To: "General discussion list for the 389 Directory server project."
> <389-users(a)lists.fedoraproject.org>
> Subject: Re: [389-users] setting ACI to countryCode attribute
> Message-ID: <4FFC3E3C.8090106(a)redhat.com>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> On 07/10/2012 08:28 AM, Elisseev V. wrote:
> > Hello,
> >
> > I'm trying to define ACI for "countryCode" attribute and getting an
> > error "Attribute is not defined in the schema". However, i can create an
> > entry with this attribute. Could somebody clarify what the problem is.
> There is no countryCode attribute defined in the 389 schema. Are you
> perhaps creating an entry with objectclass: extensibleObject?
> >
> > Thank you in advance,
> > Vlad.
> >
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
> ------------------------------
>
> Message: 3
> Date: Tue, 10 Jul 2012 10:38:46 -0400
> From: Rob Crittenden <rcritten(a)redhat.com>
> To: "General discussion list for the 389 Directory server project."
> <389-users(a)lists.fedoraproject.org>
> Subject: Re: [389-users] setting ACI to countryCode attribute
> Message-ID: <4FFC3E76.6050205(a)redhat.com>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> Elisseev V. wrote:
> > Hello,
> >
> > I'm trying to define ACI for "countryCode" attribute and getting an
> > error "Attribute is not defined in the schema". However, i can create an
> > entry with this attribute. Could somebody clarify what the problem is.
>
> It would help to see the aci you are trying to add.
>
> rob
>
>
>
>
> ------------------------------
>
> Message: 4
> Date: Tue, 10 Jul 2012 16:48:43 +0200
> From: "Elisseev V." <vovan(a)vovan.nl>
> To: Rich Megginson <rmeggins(a)redhat.com>
> Cc: "General discussion list for the 389 Directory server project."
> <389-users(a)lists.fedoraproject.org>
> Subject: Re: [389-users] setting ACI to countryCode attribute
> Message-ID: <1341931723.3558.60.camel@laptop>
> Content-Type: text/plain; charset="UTF-8"
>
> That's true... one of the values in the objectclass is extensibleObject.
>
> On Tue, 2012-07-10 at 08:37 -0600, Rich Megginson wrote:
> > On 07/10/2012 08:28 AM, Elisseev V. wrote:
> > > Hello,
> > >
> > > I'm trying to define ACI for "countryCode" attribute and getting an
> > > error "Attribute is not defined in the schema". However, i can create
> an
> > > entry with this attribute. Could somebody clarify what the problem is.
> > There is no countryCode attribute defined in the 389 schema. Are you
> > perhaps creating an entry with objectclass: extensibleObject?
> > >
> > > Thank you in advance,
> > > Vlad.
> > >
> > > --
> > > 389 users mailing list
> > > 389-users(a)lists.fedoraproject.org
> > > https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
>
>
>
> ------------------------------
>
> Message: 5
> Date: Tue, 10 Jul 2012 08:01:01 -0700
> From: "Anderson, Cary@CIO" <Cary.Anderson(a)State.ca.gov>
> To: 'Rich Megginson' <rmeggins(a)redhat.com>, 'General discussion list
> for the 389 Directory server project.'
> <389-users(a)lists.fedoraproject.org>
> Subject: Re: [389-users] Question regarding Combining ObjectClasses to
> add attributes
> Message-ID:
> <
> 8E433F62879B78449F9FF77C24ED7535985D40221C(a)MDTSSWECCR14.rf01.itservices.ca.gov
> >
>
> Content-Type: text/plain; charset="utf-8"
>
> Thanks for the quick response.
>
>
>
> The RHN knowledgebase article I found was titled: "How to use "host"
> attribute to limit ldap users can be accessed by specified host?" kb# 65838
>
> https://access.redhat.com/knowledge/solutions/65838
>
>
>
> From: Rich Megginson [mailto:rmeggins@redhat.com]
> Sent: Monday, July 09, 2012 9:14 AM
> To: General discussion list for the 389 Directory server project.
> Cc: Anderson, Cary@CIO
> Subject: Re: [389-users] Question regarding Combining ObjectClasses to add
> attributes
>
> On 07/09/2012 09:44 AM, Anderson, Cary@CIO wrote:
>
> I have recently started working with the Director Server, and I have read
> the documents for both 389 and RHDS, but I am having some difficulties
> regarding ObjectClass types, and combining them in order to extend the
> available attributes for an object. The documents indicate that you can
> only have one Structural ObjectClass and multiple Aux. ObjectClasses, and
> I'm a bit hazy on the rules for Abstract ObjectClasses.
>
> If I take the example of needing to add the "host" attribute to a user
> object. A RHN knowledgebase article indicates to add the "hostobject"
> ObjectClass rather than the "Account" ObjectClass.
>
> Can you provide a link to this kbase article?
>
>
>
> My assumption was that "hostobject" was an Aux. ObjectClass, and that
> "Account" was Structural, but when I look at the two ObjectClasses via the
> administrative GUI, they both have "Top" listed as the parent ObjectClass.
> So I'm not certain why one is appropriate and the other is not.
> It would appear the console does not tell you if the objectclass is
> structural, auxiliary, or abstract. You cannot tell by just the
> inheritance - by default, all objectclasses have "top" as the superior
> unless otherwise specified.
>
> This is the official LDAPv3 description -
> http://www.ietf.org/rfc/rfc4512.txt
>
> An entry may have only one STRUCTURAL objectclass, and multiple AUXILIARY
> objectclasses. Chances are you will want to use AUXILIARY objectclasses
> for your extra attributes (like posixAccount) and just use one of the
> pre-defined objectclasses (like inetOrgPerson) as your STRUCTURAL
> objectclass.
>
>
>
> Moving forward I want to be able to combine ObjectClasses to extend
> available objects without introducing data integrity issues in my ldap
> directory. I am looking for some clarification of rules regarding
> structural objectclasses,
> See rfc4512
>
>
> and if there is an easy way via the admin gui to tell the difference
> between structural, auxillary, and abstract objectclasses.
> No. You'll have to search cn=schema to check:
> ldapsearch -xLLL -s base -b "cn=schema" "objectclass=*" objectclasses |
> perl -p0e 's/\n //g' | grep AUXILIARY
>
> Note that ldapsearch wraps the output, so you'll have to use perl (or sed)
> to unwrap - see http://richmegginson.livejournal.com/18726.html
>
>
> Also will the directory do some sort of intregrity checking if you attempt
> to combine improper objectclasses either via commandline or the admin gui?
> Yes, although by default 389 will allow an entry to have multiple
> structural objectclasses, but that will change in a future release, so
> don't rely on that behavior.
>
>
>
>
> Thanks
>
>
> Cary Anderson
> 916.464.5108
> Linux Support | Engineering Dept.
>
>
>
>
>
> --
>
> 389 users mailing list
>
> 389-users(a)lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org
> >
>
> https://admin.fedoraproject.org/mailman/listinfo/389-users
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://lists.fedoraproject.org/pipermail/389-users/attachments/20120710/7...
> >
>
> ------------------------------
>
> Message: 6
> Date: Tue, 10 Jul 2012 09:45:40 -0600
> From: Rich Megginson <rmeggins(a)redhat.com>
> To: "Anderson, Cary@CIO" <Cary.Anderson(a)State.ca.gov>
> Cc: "'General discussion list for the 389 Directory server project.'"
> <389-users(a)lists.fedoraproject.org>
> Subject: Re: [389-users] Question regarding Combining ObjectClasses to
> add attributes
> Message-ID: <4FFC4E24.8060800(a)redhat.com>
> Content-Type: text/plain; charset="utf-8"; Format="flowed"
>
> On 07/10/2012 09:01 AM, Anderson, Cary@CIO wrote:
> >
> > Thanks for the quick response.
> >
> > The RHN knowledgebase article I found was titled: "How to use "host"
> > attribute to limit ldap users can be accessed by specified host?" kb#
> > 65838
> >
> > https://access.redhat.com/knowledge/solutions/65838
> >
>
> It doesn't say anything about an "Account" objectclass.
>
> See also http://port389.org/wiki/Howto:Posix
>
> > *From:*Rich Megginson [mailto:rmeggins@redhat.com]
> > *Sent:* Monday, July 09, 2012 9:14 AM
> > *To:* General discussion list for the 389 Directory server project.
> > *Cc:* Anderson, Cary@CIO
> > *Subject:* Re: [389-users] Question regarding Combining ObjectClasses
> > to add attributes
> >
> > On 07/09/2012 09:44 AM, Anderson, Cary@CIO wrote:
> >
> > I have recently started working with the Director Server, and I have
> > read the documents for both 389 and RHDS, but I am having some
> > difficulties regarding ObjectClass types, and combining them in order
> > to extend the available attributes for an object. The documents
> > indicate that you can only have one Structural ObjectClass and
> > multiple Aux. ObjectClasses, and I'm a bit hazy on the rules for
> > Abstract ObjectClasses.
> >
> > If I take the example of needing to add the "host" attribute to a user
> > object. A RHN knowledgebase article indicates to add the "hostobject"
> > ObjectClass rather than the "Account" ObjectClass.
> >
> >
> > Can you provide a link to this kbase article?
> >
> >
> > My assumption was that "hostobject" was an Aux. ObjectClass, and that
> > "Account" was Structural, but when I look at the two ObjectClasses via
> > the administrative GUI, they both have "Top" listed as the parent
> > ObjectClass. So I'm not certain why one is appropriate and the other
> > is not.
> >
> > It would appear the console does not tell you if the objectclass is
> > structural, auxiliary, or abstract. You cannot tell by just the
> > inheritance - by default, all objectclasses have "top" as the superior
> > unless otherwise specified.
> >
> > This is the official LDAPv3 description -
> > http://www.ietf.org/rfc/rfc4512.txt
> >
> > An entry may have only one STRUCTURAL objectclass, and multiple
> > AUXILIARY objectclasses. Chances are you will want to use AUXILIARY
> > objectclasses for your extra attributes (like posixAccount) and just
> > use one of the pre-defined objectclasses (like inetOrgPerson) as your
> > STRUCTURAL objectclass.
> >
> >
> > Moving forward I want to be able to combine ObjectClasses to extend
> > available objects without introducing data integrity issues in my ldap
> > directory. I am looking for some clarification of rules regarding
> > structural objectclasses,
> >
> > See rfc4512
> >
> > and if there is an easy way via the admin gui to tell the difference
> > between structural, auxillary, and abstract objectclasses.
> >
> > No. You'll have to search cn=schema to check:
> > ldapsearch -xLLL -s base -b "cn=schema" "objectclass=*" objectclasses
> > | perl -p0e 's/\n //g' | grep AUXILIARY
> >
> > Note that ldapsearch wraps the output, so you'll have to use perl (or
> > sed) to unwrap - see http://richmegginson.livejournal.com/18726.html
> >
> > Also will the directory do some sort of intregrity checking if you
> > attempt to combine improper objectclasses either via commandline or
> > the admin gui?
> >
> > Yes, although by default 389 will allow an entry to have multiple
> > structural objectclasses, but that will change in a future release, so
> > don't rely on that behavior.
> >
> > Thanks
> >
> > * Cary Anderson*
> >
> > **916.464.5108
> >
> > *Linux Support**|****Engineering Dept**.*
> >
> >
> >
> >
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org <mailto:
> 389-users(a)lists.fedoraproject.org>
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://lists.fedoraproject.org/pipermail/389-users/attachments/20120710/3...
> >
>
> ------------------------------
>
> Message: 7
> Date: 10 Jul 2012 10:59:05 -0400
> From: "Greg Kuchyt" <kuchytgj(a)potsdam.edu>
> To: 389-users(a)lists.fedoraproject.org
> Subject: [389-users] Password policy questions
> Message-ID: <4FFC4339.3080303(a)potsdam.edu>
> Content-Type: text/plain; charset=ISO-8859-1; format=flowed
>
> First off, I'm sorry if I missed a document somewhere that covers this,
> but after some searching I failed to find such a source that explicitly
> spells this out. In order to verify my findings in testing, I had a
> couple questions about the userPassword attribute and its relationship
> to the password policy.
>
> Is it accurate that the 389DS password policy only comes into effect
> when the LDAPv3 password modify operation is used (i.e. via ldappasswd)?
> I noticed that setting a default password hashing algorithm does not
> affect my ability to use any type of hash or clear text in the
> userPassword attribute or bind.
>
> We have historically managed the userPassword field like it is any other
> field and are looking to switch the hash type we use to store passwords.
> I was wondering what exactly switching the default password algorithm
> "does". From my testing it appears that it does not affect the existing
> data or manual changes to it. This leads me to believe it only comes
> into play during the password modify extended operation.
>
> Thanks for any help, and again my apologies if this is covered somewhere
> and I failed to find it.
>
>
> ------------------------------
>
> Message: 8
> Date: Tue, 10 Jul 2012 11:33:06 -0600
> From: Rich Megginson <rmeggins(a)redhat.com>
> To: "General discussion list for the 389 Directory server project."
> <389-users(a)lists.fedoraproject.org>
> Subject: Re: [389-users] Password policy questions
> Message-ID: <4FFC6752.6060509(a)redhat.com>
> Content-Type: text/plain; charset=UTF-8; format=flowed
>
> On 07/10/2012 08:59 AM, Greg Kuchyt wrote:
> > First off, I'm sorry if I missed a document somewhere that covers
> > this, but after some searching I failed to find such a source that
> > explicitly spells this out. In order to verify my findings in testing,
> > I had a couple questions about the userPassword attribute and its
> > relationship to the password policy.
> >
> > Is it accurate that the 389DS password policy only comes into effect
> > when the LDAPv3 password modify operation is used (i.e. via ldappasswd)?
>
> or an ldap MODIFY operation of the userPassword attribute.
>
> > I noticed that setting a default password hashing algorithm does not
> > affect my ability to use any type of hash or clear text in the
> > userPassword attribute or bind.
> >
> > We have historically managed the userPassword field like it is any
> > other field and are looking to switch the hash type we use to store
> > passwords. I was wondering what exactly switching the default password
> > algorithm "does". From my testing it appears that it does not affect
> > the existing data or manual changes to it. This leads me to believe it
> > only comes into play during the password modify extended operation.
>
> or an ldap MODIFY operation of the userPassword attribute.
> >
> > Thanks for any help, and again my apologies if this is covered
> > somewhere and I failed to find it.
> There is some info here -
>
> http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/9.0/html/Admin...
>
> What you really want to do is only send cleartext passwords to the
> directory server, use only LDAP MODIFY or the password extop to change
> it, and use only the LDAP BIND operation to authenticate to the
> directory server. This will allow the directory server to internally
> hash it for storage and comparison.
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
> ------------------------------
>
> Message: 9
> Date: Wed, 11 Jul 2012 00:22:13 +0000
> From: "Morris, Patrick" <patrick.morris(a)hp.com>
> To: "389-users(a)lists.fedoraproject.org"
> <389-users(a)lists.fedoraproject.org>, "
> Cary.Anderson(a)State.ca.gov"
> <Cary.Anderson(a)State.ca.gov>
> Subject: Re: [389-users] Question regarding Combining ObjectClasses to
> add attributes
> Message-ID:
> <
> B70713EB4E55C84C963B37DE9E63011B50DD3F0F(a)G4W3223.americas.hpqcorp.net>
>
> Content-Type: text/plain; charset="utf-8"
>
> The second link you provided (at port 389.org) specifically mentions
> using the “account” objectclass. I don’t have access to RHN to read the
> first link, though.
>
>
>
> From: 389-users-bounces(a)lists.fedoraproject.org [mailto:
> 389-users-bounces(a)lists.fedoraproject.org] On Behalf Of Rich Megginson
> Sent: Tuesday, July 10, 2012 8:46 AM
> To: Anderson, Cary@CIO
> Cc: 'General discussion list for the 389 Directory server project.'
> Subject: Re: [389-users] Question regarding Combining ObjectClasses to add
> attributes
>
>
>
> On 07/10/2012 09:01 AM, Anderson, Cary@CIO wrote:
>
> Thanks for the quick response.
>
>
>
> The RHN knowledgebase article I found was titled: "How to use "host"
> attribute to limit ldap users can be accessed by specified host?" kb# 65838
>
> https://access.redhat.com/knowledge/solutions/65838
>
>
> It doesn't say anything about an "Account" objectclass.
>
> See also http://port389.org/wiki/Howto:Posix
>
>
>
>
>
>
>
>
>
>
> From: Rich Megginson [mailto:rmeggins@redhat.com]
> Sent: Monday, July 09, 2012 9:14 AM
> To: General discussion list for the 389 Directory server project.
> Cc: Anderson, Cary@CIO
> Subject: Re: [389-users] Question regarding Combining ObjectClasses to add
> attributes
>
>
>
> On 07/09/2012 09:44 AM, Anderson, Cary@CIO wrote:
>
> I have recently started working with the Director Server, and I have read
> the documents for both 389 and RHDS, but I am having some difficulties
> regarding ObjectClass types, and combining them in order to extend the
> available attributes for an object. The documents indicate that you can
> only have one Structural ObjectClass and multiple Aux. ObjectClasses, and
> I'm a bit hazy on the rules for Abstract ObjectClasses.
>
> If I take the example of needing to add the "host" attribute to a user
> object. A RHN knowledgebase article indicates to add the "hostobject"
> ObjectClass rather than the "Account" ObjectClass.
>
>
> Can you provide a link to this kbase article?
>
>
>
>
>
> My assumption was that "hostobject" was an Aux. ObjectClass, and that
> "Account" was Structural, but when I look at the two ObjectClasses via the
> administrative GUI, they both have "Top" listed as the parent ObjectClass.
> So I'm not certain why one is appropriate and the other is not.
>
> It would appear the console does not tell you if the objectclass is
> structural, auxiliary, or abstract. You cannot tell by just the
> inheritance - by default, all objectclasses have "top" as the superior
> unless otherwise specified.
>
> This is the official LDAPv3 description -
> http://www.ietf.org/rfc/rfc4512.txt
>
> An entry may have only one STRUCTURAL objectclass, and multiple AUXILIARY
> objectclasses. Chances are you will want to use AUXILIARY objectclasses
> for your extra attributes (like posixAccount) and just use one of the
> pre-defined objectclasses (like inetOrgPerson) as your STRUCTURAL
> objectclass.
>
>
>
>
>
> Moving forward I want to be able to combine ObjectClasses to extend
> available objects without introducing data integrity issues in my ldap
> directory. I am looking for some clarification of rules regarding
> structural objectclasses,
>
> See rfc4512
>
>
>
>
> and if there is an easy way via the admin gui to tell the difference
> between structural, auxillary, and abstract objectclasses.
>
> No. You'll have to search cn=schema to check:
> ldapsearch -xLLL -s base -b "cn=schema" "objectclass=*" objectclasses |
> perl -p0e 's/\n //g' | grep AUXILIARY
>
> Note that ldapsearch wraps the output, so you'll have to use perl (or sed)
> to unwrap - see http://richmegginson.livejournal.com/18726.html
>
>
>
>
> Also will the directory do some sort of intregrity checking if you attempt
> to combine improper objectclasses either via commandline or the admin gui?
>
> Yes, although by default 389 will allow an entry to have multiple
> structural objectclasses, but that will change in a future release, so
> don't rely on that behavior.
>
>
>
>
>
>
> Thanks
>
>
>
>
>
> Cary Anderson
>
> 916.464.5108
>
> Linux Support | Engineering Dept.
>
>
>
>
>
>
>
>
>
> --
> 389 users mailing list
> 389-users(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> http://lists.fedoraproject.org/pipermail/389-users/attachments/20120711/0...
> >
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: smime.p7s
> Type: application/x-pkcs7-signature
> Size: 6231 bytes
> Desc: not available
> URL: <
> http://lists.fedoraproject.org/pipermail/389-users/attachments/20120711/0...
> >
>
> ------------------------------
>
> --
> 389 users mailing list
> 389-users(a)lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/389-users
>
> End of 389-users Digest, Vol 86, Issue 9
> ****************************************
>
--
Atenciosamente,
______________________________________
Filippe Costa Spolti
Bacharel em Sistemas de Informação
Linux User n°515639 - http://counter.li.org/
filippespolti(a)gmail.com
(34)9679-2388
11 years, 9 months
