389-users December 2015

389-users@lists.fedoraproject.org

14 participants
16 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

Announcing 389 Windows Console 1.1.15
by Noriko Hosoi 23 Feb '16

23 Feb '16

389 Windows Console 1.1.15 The 389 Directory Server team is proud to announce 389-console-win version 1.1.15. Windows installers are available to download from Download 389 Windows Console (32-bit) <http://www.port389.org/binaries/389-Console-1.1.15-i386.msi> and Download 389 Windows Console (64-bit) <http://www.port389.org/binaries/389-Console-1.1.15-x86_64.msi>. Highlights in 389-console-win-1.1.15 * Windows Console now has the same bug fixes and enhancements made for the Fedora 389-console. Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install and update, use Programs and Features on Control Panel. Feedback We are very interested in your feedback! If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelogs Please refer 389-console-1.1.19, 389-admin-console-1.1.10 release notes <http://www.port389.org/docs/389ds/releases/release-console-1-1-9.html> and 389-ds-console-1.2.12 and idm-console-framework-1.1.14 release notes <http://www.port389.org/docs/389ds/releases/release-ds-console-1-2-12.html>. http://www.port389.org/docs/389ds/releases/release-windows-console-1-1-15.h…

2 2

389 Windows Console
by Phil Daws 15 Jan '16

15 Jan '16

Hello, I have 389 up and running in my lab, with encryption enabled, but when I connect too the Administration panel and double click on the Directory Server it just hangs. The CA certificate has been imported using: d:\Scratch\firefox_add-certs\bin>certutil -A -d "C:\Documents and Settings\phild\.389-console" -n "CA Certificate" -t CT,, -i d:\Downloads\CA-chain.pem -a Am I missing something obvious please ? Thanks, Phil

3 14

PCI SSL TLS certificate requirements change
by Mayberry, Alexander 10 Jan '16

10 Jan '16

Hi, we are using SSLv3 certs, and have a multi-master replication environment. I have over 2000 clients currently using these CAs, and updating them to TLS seems highly disruptive. Does anyone know of a way to add the updated TLS cert, while still honoring the old SSLv3 certs from clients? Or perhaps a way to add new replicas in to the environment with the new TLS certs, but also add them in to the replication pool with the old SSLv3 systems? Maybe a good guide/white paper on how to achieve this for PCI requirements? Alexander Mayberry Enterprise Systems Engineer SD Group: EIT Infrastructure – OMA Enterprise.Systems Engineering.Infrastructure

2 5

NSMMReplicationPlugin - replication keep alive entry <cn=repl keep alive 6,dc=mydomain> already exists
by bahan w 23 Dec '15

23 Dec '15

Hello. I'm using FreeIPA and I have 4 masters which replicates to each others. On all the masters, I can see the following message from time to time : ### NSMMReplicationPlugin - replication keep alive entry <cn=repl keep alive 6,dc=mydomain> already exists ### I don't really understand this message in fact. May you explain it to me please ? Best regards. Bahan

2 5

How to show all the config in dirsrv
by bahan w 23 Dec '15

23 Dec '15

Hello ! I'm currently checking how to show the whole configuration of dirsrv with ldapsearch but I cannot find a proper way to do it for the moment. I was thinking to use this : ### ldapsearch -x -D "cn=Directory Manager" -h <myserver> -p 389 -W -b "cn=config,dc=mydomain" ### But it returns me a 32 return code, no such object. Do you know how to show all the attributes of config please ? Best regards. Bahan

2 2

unsubscribe
by Mark Hammons 17 Dec '15

17 Dec '15

-------------------- Mark Hammons - +33 06 03 69 56 56 Research Engineer @ BioEmergences[1] Lab Phone: 01 69 82 34 19 -------- [1] bioemergences.iscpif.fr

1 0

389 replication issue
by Frank Munsche 17 Dec '15

17 Dec '15

Hi Guys, I got a replication issue with the 389 ds running at centos 6.7 and the following 389 pkgs installed: 389-admin.x86_64 1.1.35-1.el6 @epel 389-admin-console.noarch 1.1.8-1.el6 @epel 389-adminutil.x86_64 1.1.19-1.el6 @epel 389-console.noarch 1.1.7-1.el6 @epel 389-ds-base.x86_64 1.2.11.15-65.el6_7 @updates 389-ds-base-libs.x86_64 1.2.11.15-65.el6_7 @updates 389-ds-console.noarch 1.2.6-1.el6 @epel 389-dsgw.x86_64 1.1.11-1.el6 @epel I'm running a multimaster configuration based on two directory servers (ds1, ds2) When the replication is initiated at ds1 (replication from ds1 to ds2, nsds5BeginReplicaRefresh set to 'start') , I find these entries in the error log of ds1: [15/Dec/2015:19:10:11 +0000] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=ds1TOds2" (ds2:389)". [15/Dec/2015:19:10:11 +0000] NSMMReplicationPlugin - Need to create replication keep alive entry <cn=repl keep alive 1,dc=example,dc=org> [15/Dec/2015:19:10:11 +0000] NSMMReplicationPlugin - add dn: cn=repl keep alive 1,dc=example,dc=org objectclass: top objectclass: ldapsubentry objectclass: extensibleObject cn: repl keep alive 1 [15/Dec/2015:19:10:14 +0000] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=ds1TOds2" (ds2:389)". Sent 341 entries. [15/Dec/2015:19:10:14 +0000] NSMMReplicationPlugin - agmt="cn=ds1TOds2" (ds2:389): Consumer failed to replay change (uniqueid 72eca481-a35f11e5- a546a0ed-cca505a5, CSN 56706593000100010000): Server is unwilling to perform (53). Will retry later. [15/Dec/2015:19:15:16 +0000] NSMMReplicationPlugin - agmt="cn=ds1TOds2" (ds2:389): Consumer failed to replay change (uniqueid 72eca481-a35f11e5- a546a0ed-cca505a5, CSN 56706593000100010000): Server is unwilling to perform (53). Will retry later. I was wondering about : NSMMReplicationPlugin - agmt="cn=ds1TOds2" (ds2:389): Consumer failed to replay change (uniqueid 72eca481-a35f11e5-a546a0ed-cca505a5, CSN 56706593000100010000): Server is unwilling to perform (53). Will retry later. Checked the access log at ds2: [15/Dec/2015:19:10:14 +0000] conn=28 fd=64 slot=64 connection from 192.168.22.11 to 172.17.0.12 [15/Dec/2015:19:10:14 +0000] conn=28 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [15/Dec/2015:19:10:14 +0000] conn=28 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [15/Dec/2015:19:10:14 +0000] conn=28 TLS1.2 256-bit AES [15/Dec/2015:19:10:14 +0000] conn=28 op=1 BIND dn="cn=replication manager,cn=config" method=128 version=3 [15/Dec/2015:19:10:14 +0000] conn=28 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=replication manager,cn=config" [15/Dec/2015:19:10:14 +0000] conn=28 op=2 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [15/Dec/2015:19:10:14 +0000] conn=28 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [15/Dec/2015:19:10:14 +0000] conn=28 op=3 SRCH base="" scope=0 filter="(objectClass=*)" attrs="supportedControl supportedExtension" [15/Dec/2015:19:10:14 +0000] conn=28 op=3 RESULT err=0 tag=101 nentries=1 etime=0 [15/Dec/2015:19:10:14 +0000] conn=28 op=4 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [15/Dec/2015:19:10:14 +0000] conn=28 op=4 RESULT err=0 tag=120 nentries=0 etime=0 [15/Dec/2015:19:10:14 +0000] conn=28 op=5 SRCH base="cn=replica,cn=dc\3Dexample\2Cdc\3Dorg,cn=mapping tree,cn=config" scope=0 filter="(objectClass=*)" attrs="nsDS5ReplicaId" [15/Dec/2015:19:10:14 +0000] conn=28 op=5 RESULT err=0 tag=101 nentries=1 etime=0 [15/Dec/2015:19:10:14 +0000] conn=28 op=6 ADD dn="cn=repl keep alive 1,dc=example,dc=org" [15/Dec/2015:19:10:14 +0000] conn=28 op=6 RESULT err=53 tag=105 nentries=0 etime=0 csn=56706593000100010000 [15/Dec/2015:19:10:16 +0000] conn=28 op=7 EXT oid="2.16.840.1.113730.3.5.5" name="Netscape Replication End Session" [15/Dec/2015:19:10:16 +0000] conn=28 op=7 RESULT err=0 tag=120 nentries=0 etime=0 And crosschecked the csn 56706593000100010000 at ds1 with the changelog dump: changetype: add replgen: 566feaa1000000010000 csn: 56706593000100010000 nsuniqueid: 72eca481-a35f11e5-a546a0ed-cca505a5 parentuniqueid: 2cbf2300-a31611e5-8f779323-18f831a8 dn: cn=repl keep alive 1,dc=example,dc=org change:: add: objectClass objectClass: top objectClass: ldapsubentry objectClass: extensibleObject - add: cn cn: repl keep alive 1 - add: internalCreatorsName internalCreatorsName: cn=Multimaster Replication Plugin,cn=plugins,cn=config - add: internalModifiersName internalModifiersName: cn=Multimaster Replication Plugin,cn=plugins,cn=config - add: creatorsName creatorsName: - add: modifiersName modifiersName: - add: createTimestamp createTimestamp: 20151215191011Z - add: modifyTimestamp modifyTimestamp: 20151215191011Z - add: nsUniqueId nsUniqueId: 72eca481-a35f11e5-a546a0ed-cca505a5 - add: parentid parentid: 1 - add: entryid entryid: 342 - add: entrydn entrydn: cn=repl keep alive 1,dc=example,dc=org Does someone have a glue what the cn=repl keep alive 1,dc=example,dc=org is for and what causes the problem here? thank you very much, cheers, Frank

2 1

nsAccountLock - Server is unwilling to perform
by Mitja Mihelič 15 Dec '15

15 Dec '15

Hi! We are using using nsAccountLock=true to lock user accounts. We also have dovecot authenticating users against the 389DS. If we set nsAccountLock=true, then we get Oct 20 14:39:30 SERVER dovecot: auth: Error: ldap(USERNAME,193.X.Y.Z,<aaaaaaaaaaaaaaaa>): ldap_bind() failed: Server is unwilling to perform Oct 20 14:39:31 SERVER dovecot: auth: ldap(USERNAME,193.X.Y.Z,<aaaaaaaaaaaaaaaa>): Falling back to expired data from cache Dovecot thinks the server is not working properly so it reads login info from its cache and authentication succeeds. Can I set 389DS to return a different response? Something that says: "User is locked" or "Authentication failed"... Kind regards, Mitja -- -- Mitja Mihelič ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia tel: +386 1 479 8800, fax: +386 1 479 88 99

3 4

Re: ldapsearch question
by Rich Megginson 15 Dec '15

15 Dec '15

On 12/14/2015 11:16 PM, Frank Munsche wrote: > > Hi Guys, > > I'm trying to understand why ldapsearch returns some objects of the > dit only > > when the dn is set to the object I'm looking for and the search scope > has to > > be base, e.g.: > > There is an object at the dn: cn=repl keep alive 1,dc=example,dc=org" > > A search operation using dc=example,dc=org as base and the scope 'sub' > will > > not return the entry. Setting the search base to the object itself > does not > > work either: > > ldapsearch -H ldap://ldap.example.org -D "cn=directory manager" -w > secret -ZZZ > > -x -s sub -b "cn=repl keep alive 1,dc=example,dc=org" > > # extended LDIF > > # > > # LDAPv3 > > # base <cn=repl keep alive 1,dc=example,dc=org> with scope subtree > > # filter: (objectclass=*) > > # requesting: ALL > > # > > # search result > > search: 3 > > result: 0 Success > > But using the object's dn and setting the scope to 'base' does return the > > entry: > > ldapsearch -H ldap://ldap.example.org -D "cn=directory manager" -w > secret -ZZZ > > -x -s base -b "cn=repl keep alive 1,dc=example,dc=org" > > # extended LDIF > > # > > # LDAPv3 > > # base <cn=repl keep alive 1,dc=example,dc=org> with scope baseObject > > # filter: (objectclass=*) > > # requesting: ALL > > # > > # repl keep alive 1, example.org > > dn: cn=repl keep alive 1,dc=example,dc=org > > objectClass: top > > objectClass: ldapsubentry > > objectClass: extensibleObject > > cn: repl keep alive 1 > > # search result > > search: 3 > > result: 0 Success > > Does someone have an explanation for this? > Yes. This entry is an "ldapSubEntry". Entries with this objectclass do not appear in regular searches. They only appear if you a) include (objectclass=ldapsubentry) in your search filter or b) specify the DN exactly as the base DN. > thank you, > > cheers, frank >

1 0

Error enabling SSL
by Phil Daws 15 Dec '15

15 Dec '15

Hello, Am trying to enable SSL on my 389 lab instance but having real issues. I imported the CA certificate chain, created a CSR, signed and installed the certificate. Then went into Directory Server -> Configuration and enabled SSL. Restarted the directory server but now get this error in the log: [12/Dec/2015:11:51:02 +0000] - SSL alert: Security Initialization: Unable to authenticate (Netscape Portable Runtime error -8177 - The security password entered is incorrect.) [12/Dec/2015:11:51:02 +0000] - ERROR: SSL Initialization Failed. Disabling SSL. When I issue systemctl restart dirsrv@lab389 it does not prompt for a password, and if I create a pin.txt that does not work. Yet if I use certutil that all looks good: [root@ads01 slapd-lab389]# certutil -d /etc/dirsrv/slapd-lab389/ -K certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" Enter Password or Pin for "NSS Certificate DB": < 0> rsa 725d885b5d0a1ce92babc48d230108e46dd44866 server-cert Version: [root@lab389 slapd-lab389]# rpm -qa | grep 389 389-ds-base-1.3.3.1-23.el7_1.x86_64 389-admin-1.1.38-1.el7.x86_64 389-ds-base-libs-1.3.3.1-23.el7_1.x86_64 389-adminutil-1.1.21-2.el7.x86_64 Any ideas please ? Thanks. Phil

3 7

upgrade replication Q
by ghiureai 07 Dec '15

07 Dec '15

Hi List, Since this our first time running a 389-DS upgrade in a replication master/slave env, and there are no special references in documentation, from your past experience, should we consider upgrading first the slave or master DS? ( upgrade 389-DS 1.2.2 to 1.3.4 ) Thank you for your continue support Isabella

1 0

Delivery reports about your e-mail
by Rich Megginson 07 Dec '15

07 Dec '15

Your message was not delivered due to the following reason: Your message was not delivered because the destination server was unreachable within the allowed queue period. The amount of time a message is queued before it is returned depends on local configura- tion parameters. Most likely there is a network problem that prevented delivery, but it is also possible that the computer is turned off, or does not have a mail system running right now. Your message was not delivered within 7 days: Host 23.15.238.86 is not responding. The following recipients could not receive this message: <389-users(a)lists.fedoraproject.org> Please reply to postmaster(a)redhat.com if you feel this message to be in error.

1 0

upgrade to 389-ds-base-1.3.4 Q
by ghiureai 04 Dec '15

04 Dec '15

Hi List, we are tying to upgrade to 389-ds 1.3.4 from 1.2.2 , after rpm installed and update the server , when restarting the DS geting the following in DS errorlog, there is no such "entryallowWeakCipher" in cfg file , what should we dissable see entries for this cn SSL alert: Cipher rsa_rc4_128_md5 is weak. It is enabled since allowWeakCipher is "on" (default setting for the backward compatibility). We strongly recommend to set it to "off". Please replace the value of allowWeakCipher with "off" in the encryption config entry cn=encryption,cn=config and restart the server. dn: cn=encryption,cn=config objectClass: top objectClass: nsEncryptionConfig cn: encryption nsSSLSessionTimeout: 0 nsSSLClientAuth: allowed nsSSL2: off nsSSL3: off ----->>> This was on but turn to "off" creatorsName: cn=server,cn=plugins,cn=config modifiersName: uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo t createTimestamp: xxxxxxxxxxxxxxxx modifyTimestamp:xxxxxxxxxxxxxxxxxxxx nsSSL3Ciphers: -rsa_null_md5,-rsa_null_sha,+rsa_rc4_128_md5,+rsa_rc4_40_md5,+r sa_rc2_40_md5,+rsa_des_sha,+rsa_fips_des_sha,+rsa_3des_sha,+rsa_fips_3des_sha ,+fortezza,+fortezza_rc4_128_sha,+fortezza_null,+tls_rsa_export1024_with_rc4_ 56_sha,+tls_rsa_aes_128_sha,+tls_rsa_aes_256_sha xxxxxxxxxxxxxxxxxxx xxxxxxxxxxxxxxx Thank you for your time Isabella

2 10

Slow search results until cache populated
by Petteri Jekunen 03 Dec '15

03 Dec '15

Hi, Is it just ordinary behavior with 389 DS that search results may take a very loong time just after starting the server when there are no entries in the cache yet? And when the cache is fully saturated (enough cache configured for all the entries) results become dramatically down - for instance from 4 minutes to 4 seconds. If this this is so, is there anything that could be done to fill in the cache automatically after startup? We have some 60 000 entries, RHEL 7.1, 389-Directory/1.3.3.1 B2015.267.1737 on VMWare. We have quite a heavy use of roles, and this seems to be a significant issue especially with them - or at least with them. We have used the Sun DSEE previously and are quite new to 389 DS. The technology seems very similar although. Thanks a lot in advance! Regards, Petteri Jekunen, Tampere University of Applied Sciences

4 7

ldapsearch Max Return Result
by Joel Levin 30 Nov '15

30 Nov '15

Hi: I searched --- probably not effectively --- where is setting for max results returned by ldapsearch? Thanks.

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2015