389-users August 2012

389-users@lists.fedoraproject.org

36 participants
38 discussions

Complex search filter doesnt work properly
by Das, Jyoti Ranjan (STSD) 15 Aug '12

15 Aug '12

Hi, Below is one of the few complex filters which don't work properly Example: Filter: "(&(&(uid=test1)(cn=t1 est))(&(gidnumber=20))(uidnumber=2559)(&(sn=est)))" In this case, filter ignores "uidnumber=2559" after assigning the decoders to this filter. Log details are given below how it actually behaves [07/Aug/2012:09:40:12 +0200]:09:40:12 +0200] get_filter - after optimize: (&(&(uid=test1)(cn=t1 est))(&(gidNumber=20))(uidNumber=2559)(&)) [07/Aug/2012 get_filter - before optimize: (&(&(uid=test1)(cn=t1 est))(&(gidNumber=20))(uidNumber=2559)(&)) [07/Aug/2012:09:40:12 +0200] index_subsys_assign_filter_decoders - before: (&(&(uid=test1)(cn=t1 est))(&(gidNumber=20))(uidNumber=25 59)(&(sn=est))) -----> Before assigning filter decoder it looks like [07/Aug/2012:09:40:13 +0200] - slapi_filter_free type 0xA0 [07/Aug/2012:09:40:13 +0200] - slapi_filter_free type 0xA0 [07/Aug/2012:09:40:13 +0200] - slapi_filter_free type 0xA0 [07/Aug/2012:09:40:13 +0200] index_subsys_assign_filter_decoders - after: (&(uid=test1)(cn=t1 est)(gidNumber=20)(sn=est)) ---> here it missed "uidNumber=2559" Is this a bug or its expected behavior? If yes, is there any specific reason why it ignores this particular filter? Regards, Jyoti

2 1

Modify users attributes
by Fosiul Alam 14 Aug '12

14 Aug '12

Hi the theme of this script is , i need to modify uid , password, loginshell example ldapsearch -xZZ -D "cn=Directory Manager" -w 'testtest' -b "dc=fosiul,dc=lan" "(cn=Fosiul Alam)" loginshell uid userPassword # extended LDIF # # LDAPv3 # base <dc=fosiul,dc=lan> with scope subtree # filter: (cn=Fosiul Alam) # requesting: loginshell uid userPassword # # falam, users, UK, fosiul.lan dn: uid=falam,ou=users,l=UK,dc=fosiul,dc=lan loginshell: /bin/bash uid: falam userPassword:: e1NTSEF9MkpYSGI2bSs3OFk5SlcySG1kOVcxdjFVUFVHMVA3eXI0dFQvZ2c9PQ= = # search result search: 3 result: 0 Success So i need to modify it with loginshell: /bin/nologin uid: delete_falam userPassword:: asfasfasfasfasfasfasfdPQ= my first question is : what would be the ldif file format for these changes ?? Thanks for your help .

4 4

Base plugin
by Juan Asensio Sánchez 14 Aug '12

14 Aug '12

Hi I would like to make a plugin to synchronize some attributes from its value in Directory to the equivalent in Samba. The plugin should detect the changes in some attributtes, and then calculate and modify the equivalent value of the Samba ones. Is there any plugin in the standard packages, or has anyone done something similar, to take it as a base? Regards and thanks in advance.

2 1

Referral (10) (what does it mean)
by Fosiul Alam 13 Aug '12

13 Aug '12

hi All When i try to Delete a user from groups.. i get bellow ldapmodify -v -xZZ -D "cn=Directory Manager" -w 'testtest' -f get_groups.ldif modifying entry "cn=system-users,ou=groups,l=uk,dc=fosiul,dc=lan" ldap_modify: Referral (10) matched DN: dc=fosiul, dc=lan referrals: ldap://.uk.fosiul.lan:389 ldap://.us.fosiul.lan:389 ldap://.za.fosiul.lan:389 ldap://.us.fosiul.lan:389 ldap://.us.fosiul.lan:389 We have couple of ldap server ( one master , rest slave) do i have to define master server?? this is master server (ldap://.uk.fosiul.lan:389) what would be the commands ? Thanks

2 1

ldapsearch getting wrong base
by Fosiul Alam 13 Aug '12

13 Aug '12

Hi Bellow search should return some result ( and its working on my test lab) but in production server .. i believe its getting the wrong base : # # base <dc=uk,dc=fosiul,dc=lan> (default) with scope subtree it should be l=uk. bellow is the search : ldapsearch -xZZ -D "cn=Directory Manager" -w 'testtest' "uniqueMember=uid=falam,ou=users,l=uk,dc=fosiul,dc=lan" # extended LDIF # # LDAPv3 # # base <dc=uk,dc=fosiul,dc=lan> (default) with scope subtree # filter: uniqueMember=uid=falam,ou=users,l=uk,dc=fosiul,dc=lan # requesting: ALL # # search result search: 3 result: 32 No such object matchedDN: dc=fosiul,dc=lan # numResponses: 1 can any one please tel me how to fix query ?? i am stuck now .. Thanks

4 13

Question about expired/expiring passwords
by harry.devine＠faa.gov 10 Aug '12

10 Aug '12

In our environment, we have users that authenticate to our LDAP server in a few ways: 1) they log into the server directly using SSH via PuTTY; 2) they log in to our server using FileZilla or WS_FTP using SFTP; 3) they authenticate their account via the LDAP on a Windows server using pGina In method 1, they are prompted to change their password if it is expired, or are given the warning about the password will expire in X days. How do I have the user get a similar warning/message when connecting via methods 2 and 3? We have a lot of users who get themselves flustered because they think they have the right password, but because they're never warned or given a message, they think its wrong, put in a few more passwords, and eventually lock their account out. Any ideas? Harry Harry Devine Common ARTS Software Development AJM-245 (609)485-4218 Harry.Devine(a)faa.gov

3 3

Delete users from different groups
by Fosiul Alam 08 Aug '12

08 Aug '12

Hi I need some idea how to do this . I know how to delete a user from a group. but problem is I am trying to write a script which will delete user from different group.. also there is a problem Some users in added as uniquemeber and some users has been added a mumberUid" but dont understand .. how to processed is there any thought ?? or advise ?? Thanks

3 2

Best practice of taking a backup of current LDAP and restore that into a new server
by Fosiul Alam 08 Aug '12

08 Aug '12

Hi I have a running Fedora 389 Server I want to create a test server but i want to have the same data from My production server So i am thinking if i take a backup of production server then create a a new 389 instances then restore from that backup in to new 389 instance will it work ?? Thanks for your help. Fosiul

4 12

MMR issue
by Reinhard Nappert 07 Aug '12

07 Aug '12

Hi, I have the following 389 DS version deployed: 389-Directory/1.2.8.2 B2011.130.190 I have a 3 box multi-master replication setup in a ring: \ / \ / \ / \ / \ / ... C ----- A ----- B ----- C ----- A ... / \ / \ / \ / \ / \ The replication agreements for "A" and "C" and for "B" and "C" work fine, but I have an issue for the agreements for the "A" and "B" connection. I see the following in the errors file: Server A: [19/Jul/2012:07:28:50 -0300] NSMMReplicationPlugin - conn=7835 op=160267 repl="o=base": Begin incremental protocol [19/Jul/2012:07:28:50 -0300] - csngen_adjust_time: gen state before 5007e1610000:1342693727:0:2 [19/Jul/2012:07:28:50 -0300] - _csngen_adjust_local_time: gen state before 5007e1610000:1342693727:0:2 [19/Jul/2012:07:28:50 -0300] - _csngen_adjust_local_time: gen state after 5007e1640000:1342693730:0:2 [19/Jul/2012:07:28:50 -0300] NSMMReplicationPlugin - conn=7835 op=160267 repl="o=BASE": Replica in use locking_purl=conn=7831 id=3 [19/Jul/2012:07:28:50 -0300] NSMMReplicationPlugin - conn=7835 op=160267 replica="o=BASE": Unable to acquire replica: error: replica busy locked by conn=7831 id=3 for incremental update [19/Jul/2012:07:28:50 -0300] NSMMReplicationPlugin - conn=7835 op=160267 repl="o=umc": StartNSDS90ReplicationRequest: response=1 rc=0 This kind of error is logged in an interval of about 1 second, where the local_time differs 5007e1610000:1342693727:0:2 Server B: [19/Jul/2012:13:28:48 -0300] NSMMReplicationPlugin - agmt="cn=A-to-B" (A:389): Unable to receive the response for a startReplication extended operation to consumer (Timed out). Will retry later. [19/Jul/2012:13:34:17 -0300] NSMMReplicationPlugin - agmt="cn=A-to-B" (A:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later. [19/Jul/2012:13:44:25 -0300] slapi_ldap_bind - Error: timeout after [0.0] seconds reading bind response for [cn=replication,cn=config] mech [SIMPLE] [19/Jul/2012:13:44:25 -0300] NSMMReplicationPlugin - agmt="cn=A-to-B" (A:389): Replication bind with SIMPLE auth failed: LDAP error 85 (Timed out) ((null)) [19/Jul/2012:13:44:25 -0300] NSMMReplicationPlugin - agmt="cn=A-to-B" (A:389): Replication bind with SIMPLE auth resumed Sometimes, I also see the following error [20/Jul/2012:11:28:39 -0300] slapi_ldap_bind - Error: could not send bind request for id [cn= replication,cn=config] mech [SIMPLE]: error 91 (Can't connect to the LDAP server) -5961 (TCP connection reset by peer.) 115 (Operation now in progress) [20/Jul/2012:11:28:39 -0300] NSMMReplicationPlugin - agmt="cn=A-to-B" (A:389): Replication bind with SIMPLE auth failed: LDAP error 91 (Can't connect to the LDAP server) ((null)) [20/Jul/2012:11:30:30 -0300] NSMMReplicationPlugin - agmt="cn=A-to-B" (A:389): Replication bind with SIMPLE auth resumed I don't see any indication that Server B was down at that time. I did see the Bug 571677 (https://bugzilla.redhat.com/show_bug.cgi?id=571677) but there was no deletion of a replicaconflict object. Did anybody encounter this kind of issue? The next question would be: How to recover the MMR environment. Thanks, -Reinhard

2 3

how to generate the userpassword
by Fosiul Alam 06 Aug '12

06 Aug '12

Hi I am generating the ldif by script. but i cant understand how will i generate the userpassword. userPassword: {crypt}x how this crypt or hash working Please give me some lights on this. Regards

4 8

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2012