March 2013 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

pam_groupdn is not working for some Centos 6.2
by Fosiul Alam 01 Apr '13

01 Apr '13

Hi pam_groupdn is not working on some of my centos 6.2 server. from google i can see , there is a issues with https://access.redhat.com/knowledge/solutions/64719 but dont understand , how to solve this Can any one please give me some light ?? Thanks

2 2

389DS Certificates
by alexandre 29 Mar '13

29 Mar '13

Hello, I want to Configure the Password Sync Service and do this command (in / etc/dirsrv/slapd-instance): "certutil -d . -L -n "CA certificate" -a > dsca.crt" But "CA certificate" doesn't exist. As I can see in web: " /etc/dirsrv/slapd-[instance name] This is where the certificates for the directory instance are stored, as well as its pin.txt file. " So I can't export server certificate on my Windows server. Thanks in advance !

4 6

CoS usage
by Jovan.VUKOTIC＠sungard.com 29 Mar '13

29 Mar '13

Hi, I have 389 DS (1.2.10.7 version) I am getting confusing ldapsearch results when I use two classic CoS entries defined under the same subtree in order to have the subtree accounts assigned with one of two different values of a shared/generated attribute - in my case pwdpolicysubentry attribute. I want to point out that a mechanism of generating shared attributes by both CoS entries work as expected and that I defined them via bash script and not over 389 Management Console or ns-newpwdpolicy.pl script(they both work with pointer CoS and I needed classic CoS). Also, all generated attributes are visible in the Console. This is also ok. In the first test, I had in both CoS's definition entries (I will mark them here as 1) and 2) ) the "operational-default" qualifier: cosattribute: pwdpolicysubentry operational-default. Hence, I expected that the below search would not return any of the entries with generated attributes... but it did -all of them. (Entries were returned without generated attributes: this is OK as pwdpolicysubentry is an operational attribute) # ldapsearch -x -ZZ -h localhost -D "cn=directory manager" -b "ou=people,dc=example,dc=com" -w secret -s sub "(pwdpolicysubentry=*)" "*" I got the same result when in both 1) and 2) a qualifier was just cosattribute: pwdpolicysubentry operational that I consider as correct. When I modified 1) and 2) CoS definition entries to be: cosattribute: pwdpolicysubentry the ldapsearch returned none of them, but only an entry that has pwdpolicysubentry of its own. Nothing changed when I put "default" qualifier explicitly. What I expected was to return all entries - those with their own pwdpolicysubentry and the others (with the generated one). (In my example, entries with generated attributes do not have their own attributes). Finally, and the most confusing case: 1) cosattribute: pwdpolicysubentry while in 2) cosattribute: pwdpolicysubentry operational returned them all as if the qualifier in 2) have impact on CoS 1) qualifier (?!) Do you know if my version(1.2.10.7) of the server has any bug related to CoS definitions or I am something wrong? If you need more information, please ask. Thank you, Jovan Vukotic

2 1

Re: [389-users] Distributed Numeric Assignment plugin fails with indexing
by Rich Megginson 29 Mar '13

29 Mar '13

On 03/25/2013 10:07 AM, Soeren Malchow wrote: > Untitled Document > > Hi Rich, > > we tried the methods described in Nathans post, specifically indexing > the nummer assingned through DNA including the nsMatchingRule, when > indexing, the index processes exactly 1000 entries and 98% and stops > though there are 1017 entries in the database. > Does the index process hang? Or does it just report 98% and complete normally? You can use dbscan to find out exactly what's in the index. > The nsslapd-idlistscanlimit is at the default of 4000 (though we also > tried increasing it inbetween) > > To > > From dse.ldif > > <- snip-> > > nsslapd-idlistscanlimit: 4000 > > nsslapd-pagedidlistscanlimit: 0 > > <-snip-> > That isn't used for creating indexes. > > The other four databases have much less entries and there is no problem. > > Increasing the loglevel does not give anymore information, I think I > even found the code somewhere the is responsible for the error message > and for me it does not really help. > > The only other numbr that is “1000” is the dnaThreshold but that > should not have anything to do with it, nevertheless I tried > increasing it to 2000 to see if anything changes. > > This is the DNA onfiguration from dse.ldif > > ßsnip à > > dn: cn=organization-employeeNumbers,cn=Distributed Numeric Assignment > Plugin,c > > n=plugins,cn=config > > objectClass: top > > objectClass: extensibleObject > > dnaNextValue: 220380 > > dnaMaxValue: 249999 > > dnaSharedCfgDN: > cn=organizations-employeeNumbers,ou=Ranges,ou=Organizations,dc > > =XXX,dc=XXX > > dnaThreshold: 2000 > > dnaType: employeeNumber > > dnaScope: ou=Organizations,dc=XXX,dc=XXX > > dnaFilter: (objectclass=inetOrgPerson) > > dnaMagicRegen: magic > This is a problem, but not perhaps the only problem. If employeeNumber is INTEGER syntax, "magic" is not a valid value for an integer. Pick a number that cannot possibly be in your range. > cn: organization-employeeNumbers > > creatorsName: cn=directory manager > > modifiersName: > uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo > > t > > createTimestamp: 20120831184744Z > > modifyTimestamp: 20130322022625Z > > ßsnip à > > Unfortunately we are stuck and can’t find anymore to go on. > > I already tried deleting a lot of users (approximately 50 with the DNA > attribute) trying to index again still tells me it indexed 1000 > entries (98%) > > And still it is not possible to create users, the Apache Directory > Studio displays the following error > > ßsnip à > > Error while creating entry > > - [LDAP: error code 1 - Allocation of a new value for range > cn=organization-employeenumbers,cn=distributed numeric assignment > plugin,cn=plugins,cn=config failed! Unable to proceed.] > > java.lang.Exception: [LDAP: error code 1 - Allocation of a new value > for range cn=organization-employeenumbers,cn=distributed numeric > assignment plugin,cn=plugins,cn=config failed! Unable to proceed.] > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkResponse(DirectoryApiConnectionWrapper.java:1271) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.access$600(DirectoryApiConnectionWrapper.java:110) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper$6.run(DirectoryApiConnectionWrapper.java:926) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.runAndMonitor(DirectoryApiConnectionWrapper.java:1173) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkConnectionAndRunAndMonitor(DirectoryApiConnectionWrapper.java:1107) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.createEntry(DirectoryApiConnectionWrapper.java:948) > > at > org.apache.directory.studio.ldapbrowser.core.jobs.CreateEntryRunnable.createEntry(CreateEntryRunnable.java:224) > > at > org.apache.directory.studio.ldapbrowser.core.jobs.CreateEntryRunnable.run(CreateEntryRunnable.java:124) > > at > org.apache.directory.studio.connection.ui.RunnableContextRunner$1.run(RunnableContextRunner.java:113) > > at > org.eclipse.jface.operation.ModalContext$ModalContextThread.run(ModalContext.java:121) > > [LDAP: error code 1 - Allocation of a new value for range > cn=organization-employeenumbers,cn=distributed numeric assignment > plugin,cn=plugins,cn=config failed! Unable to proceed.] > > ßsnip à > > Any hint how to pinpoint the problem > Can you post the excerpt from the directory server access and errors log from around the time of the apache ds error showing the corresponding 389 ds errors? > Thanks > > Soeren > > *From:*Rich Megginson [mailto:rmeggins@redhat.com] > *Sent:* Montag, 25. März 2013 23:24 > *To:* Scott Crooks > *Cc:* General discussion list for the 389 Directory server project.; > Soeren Malchow > *Subject:* Re: [389-users] Distributed Numeric Assignment plugin fails > with indexing > > On 03/24/2013 10:08 PM, Scott Crooks wrote: > > Rich, > > Here's the information you requested. > > *389-ds-base-1.2.11.15-12.el6_4.x86_64* is the version, from the > EPEL 6 repositories. > > To be more specific, the *indexes* for that particular database > (ou=Organizations,dc=test,dc=net) are exactly at 1000, > > > I'm still not sure what you mean by 1000 - where does this number come > from? > > Nathan's post had some good information for getting more information > about DNA. > > > but the database has 1017 entries. There are 953 users > (inetOrgPerson's) in the tree (ou=Organizations,dc=test,dc=net) > that also have the employeeNumber attribute that are managed by DNA. > > The database for//ou=Organizations,dc=test,dc=net is actually > comprised of 4 databases. It's set-up like this: > > 1. Company 1: o=Company1,ou=Organizations,dc=test,dc=net has it's > own database > 2. Company 2: o=Company2,ou=Organizations,dc=test,dc=net has it's > own database > 3. Company 3: o=Company3,ou=Organizations,dc=test,dc=net has it's > own database > 4. All other companies fall within the > *ou=Organizations,dc=test,dc=net* database. > > The database mentioned above that has 1017 entries is just > the*ou=Organizations,dc=test,dc=net* one. > > If you want I can provide exact numbers for the others. > > Best Regards > > Scott Crooks > Systems Engineer > > scott.crooks(a)mcon.net <mailto:scott.crooks@mcon.net> > Phone: +86 10 8587 7441 > Mobile: +86 138 1089 8314 > http://www.mcon.net > > Logo > > > > MCON China Ltd. > Suite 1202, e-Tower > 12C Guanghua Road > Chaoyang District > Beijing 100020 > > > > *埃蒙坎信息系**统集****成技**术**(**北****京**)**有限公司** > *中国北京市朝阳区光华路丙12号 > 数码01大厦1202室 > 邮编：100020 > > Member of mcon group: Australia • Austria • China • Czech Republic > • Germany • India • Japan • Malaysia • Russia • South Korea • > Switzerland • USA > > On 03/22/2013 11:57 PM, Rich Megginson wrote: > > On 03/22/2013 03:24 AM, Scott Crooks wrote: > > Greetings, > > We're using 389-ds on CentOS 6.4 > > > What version of 389-ds-base? rpm -q 389-ds-base > > > with 3 master LDAP servers in different locations. All > three master servers have a problem adding new users in > our organization database using the DNA plugin. > > We receive the following (unhelpful) error message in the > log files: > > /[22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD begin > [22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD parameter > untagged: uid > [22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD > target=cn=testuser01,ou=Organizations,dc=test,dc=net > *[22/Mar/2013:09:54:37 +0800] dna-plugin - dna_pre_op: > failed to allocate a new ID!! > [22/Mar/2013:09:54:37 +0800] dna-plugin - dna_pre_op: > operation failure [1] > *[22/Mar/2013:09:54:37 +0800] roles-plugin - --> roles_post_op > [22/Mar/2013:09:54:37 +0800] roles-plugin - --> > roles_cache_change_notify > [22/Mar/2013:09:54:37 +0800] roles-plugin - <-- roles_post_op/ > > We've tried indexing the uidNumber and employeeNumber > attributes as described here: > *http://www.spinics.net/linux/fedora/389-users/msg10796.html* > > One curious fact: there are exactly 1000 users in our > database for ou=Organizations,dc=test,dc=net. When > following the instructions for the above link, the log > outputs the following > > */organizations: Indexing attribute: employeenumber > organizations: Indexed 1000 entries (97%). > organizations: Finished indexing./*/ > / > Our organization uses employeenumber rather than > uidNumber, but they're the same in the end. We find it > strange that the user creation fails at *exactly* 1000 > entries. > > > What do you mean "user creation fails at exactly 1000 > entries"? Do you mean "after adding the 1000th user entry"? > The error above is from attempting to add cn=testuser01 - was > that the 1000th user entry? > > > > Any ideas on where the configuration is wrong? We assume > it's a configuration problem. > > Best Regards > > Scott Crooks > Systems Engineer > > scott.crooks(a)mcon.net <mailto:scott.crooks@mcon.net> > Phone: +86 10 8587 7441 > Mobile: +86 138 1089 8314 > http://www.mcon.net > > Logo > > > > MCON China Ltd. > Suite 1202, e-Tower > 12C Guanghua Road > Chaoyang District > Beijing 100020 > > > > *埃蒙坎信息系**统集****成技**术**(**北****京**)**有限公司** > *中国北京市朝阳区光华路丙12号 > 数码01大厦1202室 > 邮编：100020 > > Member of mcon group: Australia • Austria • China • Czech > Republic • Germany • India • Japan • Malaysia • Russia • > South Korea • Switzerland • USA > > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org> > > https://admin.fedoraproject.org/mailman/listinfo/389-users >

2 2

Error code '-11 - System error'
by alexandre 29 Mar '13

29 Mar '13

Hello, in the replication, I have enable Replica and put Multiple Master replica role with a Current Supplier DNs. I made a new Windows Sync Agreement, after is done I try to "initiate full re-synchronisation" I get : *The consumer initialization has unsuccessfully completed. * *The error received by the replica is: '-11 - System error'* If somebody knows how pass trough. Thanks a lot ! Alex

1 0

Fwd: Certificate between 389DS and Active Directory
by alexandre 28 Mar '13

28 Mar '13

Hello, just to explain why I'm in confusion, I saw this line on redhat procedure: "Import the CA certificate from Directory Server into Active Directory. Click *Trusted Root CA*, then *Import*, and browse for the Directory Server CA certificate." and this one on a website: "#This exports the server-cert which you will need on the windows AD pk12util -d . -o servercert.p12 -n Server-Cert" So I check, and I don't have any "servercert.p12" in my directory server (/etc/dirsrv/slapd-389/) I go to install the Password Sync in my Domain Controller, hope it works ;) Thanks of the community. 2013/3/27 alexandre <axel0felix(a)gmail.com> > Yes you're right, I was speaking for my domain controller (it have > automatically on the trusted root certification authorithy... And I made a > webenrollment request from my 38ds and install the CA cert on my 389ds... > > thanks > Le 27 mars 2013 17:51, "Rich Megginson" <rmeggins(a)redhat.com> a écrit : > > On 03/27/2013 10:32 AM, alexandre wrote: >> >> My CA is on my domain controller. >> >> >> Then it is not going to be in the list of "Trusted Root Certification >> Authorities" on the 389 machine unless you install it. >> >> Le 27 mars 2013 17:11, "Rich Megginson" <rmeggins(a)redhat.com> a écrit : >> >>> On 03/27/2013 10:07 AM, alexandre wrote: >>> >>> Ok now I know where my confusion come from. So just to check, in my >>> case the CA cert that issued the 389DS server cert is automatically in my >>> "Trusted Root Certification Authorities" because my authority is on my >>> domain controller !? >>> >>> >>> I don't know. What is the CA? >>> >>> >>> Thanks ! >>> Alex >>> >>> >>> 2013/3/27 Rich Megginson <rmeggins(a)redhat.com> >>> >>>> On 03/27/2013 09:53 AM, alexandre wrote: >>>> >>>> Yes I understand that. >>>> >>>> To resume, I have a server-cert and a CA cert in my 389DS. I have a CA >>>> cert in my active directory. >>>> >>>> So I need server cert in my AD !? >>>> >>>> >>>> No. AD only needs the CA cert of the CA that issued the 389DS server >>>> cert. >>>> >>>> >>>> >>>> I don't really understand "But you must generate cert for DS on AD >>>> CA", if I did a request by web-enrollment from my 389DS, and install it on >>>> my 389DS, it's good like that ? >>>> >>>> >>>> Yes. But PassSync doesn't use the Windows/AD Trusted Cert store, so >>>> you still have to export that CA cert and install it using certutil, as >>>> described in the documentation for setting up PassSync. >>>> >>>> >>>> >>>> Thanks a lot ! >>>> Alex >>>> >>>> >>>> 2013/3/27 Grzegorz Dwornicki <gd1100(a)gmail.com> >>>> >>>>> Yes and that button allows you to install server cert (again generated >>>>> in your case on AD CA) . CA tab allows you to install CA cert. >>>>> >>>>> Greg. >>>>> 27 mar 2013 16:33, "alexandre" <axel0felix(a)gmail.com> napisał(a): >>>>> >>>>> Sorry my capture is not on the mail, it's the point 12.2.1. >>>>>> 4.c.Go to the *CA Certs* tab, and click *Install* at the bottom of >>>>>> the window. >>>>>> On this link: >>>>>> https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/9.0… >>>>>> >>>>>> Thanks >>>>>> >>>>>> >>>>>> 2013/3/27 alexandre <axel0felix(a)gmail.com> >>>>>> >>>>>>> Thanks for the new Link ! >>>>>>> >>>>>>> @Rich Megginson "It's not the 389DS server certificate, but the >>>>>>> CA certificate for the CA that issued the 389DS server certificate, that >>>>>>> you need for PassSync" >>>>>>> >>>>>>> @Grzegorz Dwornicki "But you must generate cert for DS on AD CA. >>>>>>> Then you need to import this cert with AD CA cert on DS" >>>>>>> >>>>>>> Sorry I don't understand "CA certificate for the CA that issued >>>>>>> the 389DS server certificate", I have to export this one below to the AD? >>>>>>> (it's empty on this capture, but with CA certificate on my directory >>>>>>> server): >>>>>>> >>>>>>> >>>>>>> >>>>>>> @Grzegorz Dwornicki --> do you have a procedure to do that ? I >>>>>>> don't find in redhat documentation. (when you said AD CA, do you considerthat AD CA = Authority installed on my AD ?) >>>>>>> >>>>>>> Many thanks, for your answers. And your patience about my >>>>>>> translation problems. >>>>>>> >>>>>>> Best regards, >>>>>>> Alex >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> 2013/3/27 Grzegorz Dwornicki <gd1100(a)gmail.com> >>>>>>> >>>>>>>> I had missunderstood you im this case. No you don't need to create >>>>>>>> second CA. But you must generate cert for DS on AD CA. Then you need to >>>>>>>> import this cert with AD CA cert on DS >>>>>>>> >>>>>>>> Greg. >>>>>>>> 27 mar 2013 15:41, "alexandre" <axel0felix(a)gmail.com> napisał(a): >>>>>>>> >>>>>>>> I'm really impressed by the reactivity of this list !!! >>>>>>>>> >>>>>>>>> Sorry my understanding is not perfect because i'm french, so I >>>>>>>>> don't have any CA in my DS, I have one CA (installed on my domain >>>>>>>>> controller). >>>>>>>>> >>>>>>>>> Do I need to install a CA in my DS ? (when I write CA for me it >>>>>>>>> means a Authority). >>>>>>>>> >>>>>>>>> >>>>>>>>> Alex >>>>>>>>> >>>>>>>>> >>>>>>>>> 2013/3/27 Grzegorz Dwornicki <gd1100(a)gmail.com> >>>>>>>>> >>>>>>>>>> If you have diferent CA in AD vs DS then you need to do this >>>>>>>>>> import. >>>>>>>>>> >>>>>>>>>> AD by default don't use LDAPS or STARTSSL soo you need to install >>>>>>>>>> ms cert CA stuff. >>>>>>>>>> >>>>>>>>>> Greg. >>>>>>>>>> 27 mar 2013 15:07, "alexandre" <axel0felix(a)gmail.com> napisał(a): >>>>>>>>>> >>>>>>>>>>> Hello, >>>>>>>>>>> >>>>>>>>>>> I try to follow this procedure : >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/8.2… >>>>>>>>>>> >>>>>>>>>>> Everything works fine, except I don't understand right this >>>>>>>>>>> line: >>>>>>>>>>> >>>>>>>>>>> "Import the CA certificate from Directory Server into Active >>>>>>>>>>> Directory. Click *Trusted Root CA*, then *Import*, and browse >>>>>>>>>>> for the Directory Server CA certificate." >>>>>>>>>>> >>>>>>>>>>> For me CA certificate, it's a certificate from the Authority, >>>>>>>>>>> so in my Active Directory the certificate from the authority is already >>>>>>>>>>> know in the Trusted Root CA. >>>>>>>>>>> >>>>>>>>>>> So, do I need to import 389DS server certificate in my active >>>>>>>>>>> directory ? >>>>>>>>>>> >>>>>>>>>>> And finally, there is no indication to do that, someone can >>>>>>>>>>> help me to pass through ? >>>>>>>>>>> >>>>>>>>>>> Thanks in advance. >>>>>>>>>>> >>>>>>>>>>> Best regards, >>>>>>>>>>> Alex >>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>>> 389 users mailing list >>>>>>>>>>> 389-users(a)lists.fedoraproject.org >>>>>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> 389 users mailing list >>>>>>>>>> 389-users(a)lists.fedoraproject.org >>>>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> -- >>>>>>>>> 389 users mailing list >>>>>>>>> 389-users(a)lists.fedoraproject.org >>>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>>>>> >>>>>>>> >>>>>>>> -- >>>>>>>> 389 users mailing list >>>>>>>> 389-users(a)lists.fedoraproject.org >>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> -- >>>>>> 389 users mailing list >>>>>> 389-users(a)lists.fedoraproject.org >>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>> >>>>> >>>>> -- >>>>> 389 users mailing list >>>>> 389-users(a)lists.fedoraproject.org >>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>> >>>> >>>> >>>> >>>> -- >>>> 389 users mailing list389-users@lists.fedoraproject.orghttps://admin.fedoraproject.org/mailman/listinfo/389-users >>>> >>>> >>>> >>> >>> >>

1 0

MemberOf Plugin Question
by Chandan Kumar 27 Mar '13

27 Mar '13

Hello, So far I have been managed to do some setup of 389 server, thanks to prompt community. Now, I am having some trouble in getting the MemberOf plugin work for 389-ds-base-1.2.11.15-11. When I add a user into a group, the memberOf attribute is not being added to the user entry. While googling a bit I came across an older post of this group http://www.redhat.com/archives/fedora-directory-users/2009-December/msg0016… based on that, I checked dse.ldif and the Plugin configuration also looks good. dn: cn=MemberOf Plugin,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject cn: MemberOf Plugin nsslapd-pluginPath: libmemberof-plugin nsslapd-pluginInitfunc: memberof_postop_init nsslapd-pluginType: postoperation nsslapd-pluginEnabled: on nsslapd-plugin-depends-on-type: database memberofgroupattr: uniqueMember memberofattr: memberOf nsslapd-pluginId: memberof nsslapd-pluginVersion: 1.2.11.15 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: memberof plugin modifiersName: cn=directory manager modifyTimestamp: 20130322162350Z The way I am adding users : dn: uid=chandank,ou=People,dc=ma,dc=net objectclass: person objectclass: inetorgperson objectclass: posixAccount cn: Chandan sn: k givenName: chandank uid:chandank uidNumber:5006 gidNumber:5006 objectclass: mepOriginEntry mepManagedEntry: cn=chandank homeDirectory: /home/chandank loginShell: /bin/bash The way I am adding them into a group: dn: cn=sys,ou=Groups,dc=ma,dc=net changetype: modify add: uniqueMember uniqueMember: uid=chandank,ou=People,dc=ma,dc=net And after I have added the user I am expecting an MemberOf attribute entry in the user entry itself. I am not sure whether it is the right way to do so. For the records: Having MemberOf attribute in the user entry would allow me use ldap Access filters in sssd.conf file eg. "ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com" and hence will be able to restrict users from login on different systems. Thanks Chandan -- -- http://about.me/chandank

2 4

Certificate between 389DS and Active Directory
by alexandre 27 Mar '13

27 Mar '13

Hello, I try to follow this procedure : https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/8.2… Everything works fine, except I don't understand right this line: "Import the CA certificate from Directory Server into Active Directory. Click *Trusted Root CA*, then *Import*, and browse for the Directory Server CA certificate." For me CA certificate, it's a certificate from the Authority, so in my Active Directory the certificate from the authority is already know in the Trusted Root CA. So, do I need to import 389DS server certificate in my active directory ? And finally, there is no indication to do that, someone can help me to pass through ? Thanks in advance. Best regards, Alex

3 10

389DS architecture
by alexandre 27 Mar '13

27 Mar '13

Hello everybody, I try to put 389DS in my compagny but we have already 4 Windows Domain Controller and we want have 2 389DS server. I know, I need a multi-master replication, but I ear about 4 multi-master replication limitation. This one inclued Windows Domain controller ? My architecture is possible ? Sorry for my English, I'm from France. Thanks in advance. Best regards, Alex

2 2

Re: [389-users] SSH public keys and 389?
by s.oreilly 26 Mar '13

26 Mar '13

On redhat/centos like systems you can install the openssh-ldap package so no patching involved. Regards Sean O'Reilly On Mon 25/03/13 1:20 PM , Vesa Alho listat(a)alho.fi sent: > I think 389 side is "easy", but how about openssh-server and/or > clients? Wondering do I need to patch openssh-server to get it working or is > there an easier way. > > PS. thanks for responding! > > -Vesa > > > On 03/25/2013 03:09 PM, s.oreilly wrote: > > I have just done this. I will see if I can find > the docs.> > > You need to add an objectclass (ldappublickey) > and an attribute (sshpublickey) to> the schema. > > > > Regards > > > > > > Sean O'Reilly > > > > On Mon 25/03/13 1:02 PM , Vesa Alho listat(a)alho.fi > sent:>> Hi, > >> > >> What would it take to store SSH public keys > in 389?>> > >> I found this old thread in archives, but > mentioned link doesn't work:>> http://www.mail-archive.com/389-users@lists.fedoraproject.org/msg02389.html>> Other googling revealed guides which seem to > require patched version of>> openssh-server and openldap > guides.>> > >> I guess freeipa would support this, but any > chance with only 389?>> > >> -Mr. Vesa Alho > >> -- > >> 389 users mailing list > >> > > 389-users@lists.fedoraproject.orghttps://admin.fedoraproject.org/mailman/listinfo/389-users>> > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org> https://admin.fedoraproject.org/mailman/listinfo/389-users> > > -- > 389 users mailing list > 389-users@lists.fedoraproject.orghttps://admin.fedoraproject.org/mailman/listinfo/389-users >

3 4

Distributed Numeric Assignment plugin fails with indexing
by Scott Crooks 25 Mar '13

25 Mar '13

Greetings, We're using 389-ds on CentOS 6.4 with 3 master LDAP servers in different locations. All three master servers have a problem adding new users in our organization database using the DNA plugin. We receive the following (unhelpful) error message in the log files: /[22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD begin// //[22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD parameter untagged: uid// //[22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD target=cn=testuser01,ou=Organizations,dc=test,dc=net// //*[22/Mar/2013:09:54:37 +0800] dna-plugin - dna_pre_op: failed to allocate a new ID!!*//* *//*[22/Mar/2013:09:54:37 +0800] dna-plugin - dna_pre_op: operation failure [1]*//* *//[22/Mar/2013:09:54:37 +0800] roles-plugin - --> roles_post_op// //[22/Mar/2013:09:54:37 +0800] roles-plugin - --> roles_cache_change_notify// //[22/Mar/2013:09:54:37 +0800] roles-plugin - <-- roles_post_op/ We've tried indexing the uidNumber and employeeNumber attributes as described here: *http://www.spinics.net/linux/fedora/389-users/msg10796.html* One curious fact: there are exactly 1000 users in our database for ou=Organizations,dc=test,dc=net. When following the instructions for the above link, the log outputs the following /*organizations: Indexing attribute: employeenumber*//* *//*organizations: Indexed 1000 entries (97%).*//* *//*organizations: Finished indexing.*// / Our organization uses employeenumber rather than uidNumber, but they're the same in the end. We find it strange that the user creation fails at *exactly* 1000 entries. Any ideas on where the configuration is wrong? We assume it's a configuration problem. Untitled Document Best Regards Scott Crooks Systems Engineer scott.crooks(a)mcon.net <mailto:scott.crooks@mcon.net> Phone: +86 10 8587 7441 Mobile: +86 138 1089 8314 http://www.mcon.net Logo MCON China Ltd. Suite 1202, e-Tower 12C Guanghua Road Chaoyang District Beijing 100020 *??????**?**? ??**?**(**? ?**)**????** *?? ??????????12? ??01??1202? ??:100020 Member of mcon group: Australia . Austria . China . Czech Republic . Germany . India . Japan . Malaysia . Russia . South Korea . Switzerland . USA

4 5

Re: [389-users] SSH public keys and 389?
by s.oreilly 25 Mar '13

25 Mar '13

I have just done this. I will see if I can find the docs. You need to add an objectclass (ldappublickey) and an attribute (sshpublickey) to the schema. Regards Sean O'Reilly On Mon 25/03/13 1:02 PM , Vesa Alho listat(a)alho.fi sent: > Hi, > > What would it take to store SSH public keys in 389? > > I found this old thread in archives, but mentioned link doesn't work: > http://www.mail-archive.com/389-users@lists.fedoraproject.org/msg02389.html > Other googling revealed guides which seem to require patched version of > openssh-server and openldap guides. > > I guess freeipa would support this, but any chance with only 389? > > -Mr. Vesa Alho > -- > 389 users mailing list > 389-users@lists.fedoraproject.orghttps://admin.fedoraproject.org/mailman/listinfo/389-users >

2 1

SSH public keys and 389?
by Vesa Alho 25 Mar '13

25 Mar '13

Hi, What would it take to store SSH public keys in 389? I found this old thread in archives, but mentioned link doesn't work: http://www.mail-archive.com/389-users@lists.fedoraproject.org/msg02389.html Other googling revealed guides which seem to require patched version of openssh-server and openldap guides. I guess freeipa would support this, but any chance with only 389? -Mr. Vesa Alho

1 0

centOS vs Redhat vs 389 and partial replication problems
by Morgan Jones 22 Mar '13

22 Mar '13

Hello everyone, We've standardized on CentOS Directory our ~30,000 user directory environment. It's a 6 servers total: two multi-master, two read-only consumers with a full replication agreement and two read-only consumers with a partial replication. We have a specific problem that we were *sure* was fixed in CentOS directory 8.2.8. It was not and now we're wondering if we'd be better off on 389 or Redhat Directory since we'd at least have reliable changelogs with the former and support to call for the latter. Here's the problem, in the master error logs: [19/Mar/2013:17:59:49 -0400] NSMMReplicationPlugin - agmt="cn=ldapm01-mgmt to ds01-mgmt" (ds01-mgmt:636): Failed to send update operation to consumer (uniqueid c3230b03-18e411e2-af56b819-045c296a, CSN 5148b7cd000100010000): Bad parameter to an ldap routine. Will retry later. [19/Mar/2013:17:59:49 -0400] NSMMReplicationPlugin - agmt="cn=ldapm01-mgmt to ds02-mgmt" (ds02-mgmt:636): Failed to send update operation to consumer (uniqueid c3230b03-18e411e2-af56b819-045c296a, CSN 5148b7cd000100010000): Bad parameter to an ldap routine. Will retry later. It repeats once every few seconds. Reinitializing replication solves it for a while, maybe an hour and then it re-occurs. Recently we've started seeing this: [21/Mar/2013:15:00:01 -0400] NSMMReplicationPlugin - agmt="cn=ldapm01-mgmt to ds01-mgmt" (ds01-mgmt:636): Unable to acquire replica: there is no replicated area "dc=philasd,dc=org" on the consumer server. Replication is aborting. deleting the host as a replica and re-adding it solves it but it shouldn't be happening. They were Sun Directory customers going to back to 5.2 so this product is comfortable for them but with the pain we've been feeling as we roll it into production we're trying to decide if we should consider alternatives. Does anyone have insight on the problem above or on whether it's best to stick with CentOS, switch to Redhat or 389? They're heavy users of open source and happy to self support. If Redhat support for directory is good they'd be happy to go that direction. thanks, -morgan

2 3

Possible to block large multivalued updates
by Jeffrey Dunham 21 Mar '13

21 Mar '13

I have run into a bug that is still open several times now causing large problems in our LDAP Service. https://fedorahosted.org/389/ticket/346 We have group updates that are very large in size (20k+ records) and while we're specifically targeting the engineering group responsible, there is nothing to stop another group to write bad code and abuse our service. When the large update occurs during replication of the group from our master to our search fleet we often miss SLAs on replication and search latency because the boxes go under such heavy load. Is there a way on our master servers we can block people from preforming such updates? Either to discard and error on the write or just drop that traffic all together. I'm open to any sort of suggestion this list might have to offer. -Jeff

2 1

Replication Between 8.2 Master and 9.0 Master
by Paul Whitney 21 Mar '13

21 Mar '13

Hi everyone, Not sure if this is the right forum to ask about RHDS vs 389DS, but.... I am currently using RHDS 8.2 and am looking to deploy 9.0 (master, hub, and consumer). Will I be able to replication between an 8.2 master and a 9.0 master? I have looked in the Administration Guide on Rhed hat Customer Portal and only see references to RHDS 4.x (scratching my head why am I seeing references to 4.x and not anything related to 8.x.). Paul M. Whitney paul.whitney(a)icloud.com Paul M. Whitney paul.whitney(a)icloud.com

2 1

How to Managed Entries Plugin for Linux Users?
by Chandan Kumar 21 Mar '13

21 Mar '13

Hello, I am deploying the 389 server (On CentOS 6) to manage the Linux Users/Password. So as part of Linux User management, I was trying to get the Managed Entries work for Posix user creation. I am following the standard Redhat documentation. https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/9.0… So I created the templates, exactly the way explained in the doc, but when I create the users it is not creating corresponding Groups. I am using following ldap commands to add entries. I could see the this plugin created in from the console server -> data -> Plugins -> Managed Entries -> <My plugin> User creation statements dn: uid=pappu1,ou=People,dc=ma,dc=net objectclass: person objectclass: inetorgperson objectclass: posixAccount cn: Pappu sn: Papa givenName: pappu1 uid:pappu1 uidNumber:9003 gidNumber:9003 objectclass: mepOriginEntry mepManagedEntry: cn=Pappu Group homeDirectory: /home/pappu1 The plugin dn: cn=Posix User-Group,cn=Managed Entries,cn=plugins,cn=config objectclass: extensibleObject cn: Posix User-Group originScope: ou=people,dc=ma,dc=ma originFilter: objectclass=posixAccount managedBase: ou=groups,dc=ma,dc=net managedTemplate: cn=Posix User-Group Template,ou=Templates,dc=ma,dc=net The template dn: cn=Posix User-Group Template, ou=Templates,dc=ma,dc=net objectclass: mepTemplateEntry cn: Posix User-Group Template mepRDNAttr: cn mepStaticAttr: objectclass: posixGroup mepMappedAttr: cn: $cn Group Entry mepMappedAttr: gidNumber: $gidNumber mepMappedAttr: memberUid: $uid -- http://about.me/chandank

4 6

Windows Sync
by s.oreilly 21 Mar '13

21 Mar '13

Hi, Am I correct in my understanding that I cannot sync OU's from Active Directory to 389-DS? I am trying to sync users fro an AD server that I do not control and most of the users are separated in to different OU's Is there any way of making this work? Regards Sean O'Reilly

2 1

Using JNDI and 389DS
by Chaudhari, Rohit K. 21 Mar '13

21 Mar '13

Hey everyone, I need help implementing a client-server SSL connection. I've been researching on the web and I have no idea how to get my Java application to talk to the 389DS securely. I have been looking into keytool and JSSE, but there is no clear cut explanation on how it should be done. I have a self-signed CA certificate that I created using certutil, and then a server certificate generated from that self-signed CA. Is there anyone who knows a path to a solution? Thanks, Rohit

3 3

389-ds-base-devel and rhel6
by Robert Viduya 20 Mar '13

20 Mar '13

I'm trying to set up 389 on an RHEL6 server, all our previous installs have been on RHEL5 or earlier. We have a locally developed plugin and we need the include files from package 389-ds-base-devel. I've got both epel and epel-389-ds-base configured as repos. However, yum is balking at installing that particular dev package with the following: Error: Package: 389-ds-base-devel-1.2.10.26-1.el6_3.x86_64 (epel-389-ds-base) Requires: svrcore-devel Error: Package: 389-ds-base-devel-1.2.10.26-1.el6_3.x86_64 (epel-389-ds-base) Requires: 389-ds-base-libs = 1.2.10.26-1.el6_3 Available: 389-ds-base-libs-1.2.8.2-1.el6.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.8.2-1.el6 Available: 389-ds-base-libs-1.2.8.2-1.el6_1.3.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.8.2-1.el6_1.3 Available: 389-ds-base-libs-1.2.9.14-1.el6.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.9.14-1.el6 Available: 389-ds-base-libs-1.2.9.14-1.el6_2.2.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.9.14-1.el6_2.2 Available: 389-ds-base-libs-1.2.10.2-15.el6.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.10.2-15.el6 Available: 389-ds-base-libs-1.2.10.2-18.el6_3.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.10.2-18.el6_3 Available: 389-ds-base-libs-1.2.10.2-20.el6_3.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.10.2-20.el6_3 Available: 389-ds-base-libs-1.2.10.12-1.el6.x86_64 (epel-389-ds-base) 389-ds-base-libs = 1.2.10.12-1.el6 Available: 389-ds-base-libs-1.2.10.14-1.el6.x86_64 (epel-389-ds-base) 389-ds-base-libs = 1.2.10.14-1.el6 Available: 389-ds-base-libs-1.2.10.26-1.el6_3.x86_64 (epel-389-ds-base) 389-ds-base-libs = 1.2.10.26-1.el6_3 Available: 389-ds-base-libs-1.2.11.15-11.el6.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.11.15-11.el6 Available: 389-ds-base-libs-1.2.11.15-12.el6_4.i686 (rhel-x86_64-server-6) 389-ds-base-libs = 1.2.11.15-12.el6_4 I've tried enabling and disabling either repo with no success. Am I missing something simple?

2 1

Using JNDI and 389DS
by Chaudhari, Rohit K. 20 Mar '13

20 Mar '13

Hey everyone, I need help implementing a client-server SSL connection. I've been researching on the web and I have no idea how to get my Java application to talk to the 389DS securely. I have been looking into keytool and JSSE, but there is no clear cut explanation on how it should be done. I have a self-signed CA certificate that I created using certutil, and then a server certificate generated from that self-signed CA. Is there anyone who knows a path to a solution? Thanks, Rohit

1 0

dsadmin python library
by Roberto Polli 20 Mar '13

20 Mar '13

Hi Rich, why don't move the useful dsadmin python library in a separate repo? I could contribute: * doc * code refactoring with new-style classes * some more exception stuff Let me know + Peace, R. -- Roberto Polli Community Manager Babel S.r.l. - http://www.babel.it T: +39.06.9826.9651 M: +39.340.652.2736 F: +39.06.9826.9680 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

2 9

389 hang while upgrading from 1.2.2 to 1.2.10
by Roberto Polli 20 Mar '13

20 Mar '13

Hi all, while upgrading with yum from 1.2.2 to 1.2.10, 389 hang while in ns-slapd upgradedb. gdb says it's in ldbm_ancestorid_create_index(), but it's running from 3hrs on an almost-empty database (there are just a few test entries). Can somebody shed some light on that? Thank you very much + Peace, R. -- Roberto Polli Community Manager Babel S.r.l. - http://www.babel.it T: +39.06.9826.9651 M: +39.340.652.2736 F: +39.06.9826.9680 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) CONFIDENZIALE: Questo messaggio ed i suoi allegati sono di carattere confidenziale per i destinatari in indirizzo. E' vietato l'inoltro non autorizzato a destinatari diversi da quelli indicati nel messaggio originale. Se ricevuto per errore, l'uso del contenuto e' proibito; si prega di comunicarlo al mittente e cancellarlo immediatamente.

2 3

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2013