Problem browsing LDAP with Outlook
by Chris Bryant
When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS.
When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well.
I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also.
Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration.
Thanks,
Chris
USA.NET
You Run Your Business. We'll Run Your Email.
This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.
3 years, 1 month
MemberOf group restrictions to a client system (server and client running CentOS 7)
by Janet Houser
Hi,
I'm new to 389-ds and last week downloaded and installed the software.
I have a running instance of the server, and I've added TLS/SSL. I've configured a CentOS 7 client to be able to query
the server using TLS/SSL, and all appears working.
I've created users and groups on the 389-ds server successfully. For each user and group, I've enabled posix attributes and my client
can see the unix users and groups using the "getent password" or "getent group" commands.
Now, here's where I'm getting tripped up..........
I need to limit which users have access to which systems. I've been trying to do this via memberOf group limitations.
I found the following online resource (https://thornelabs.net/2013/01/28/aix-restrict-server-login-via-ldap-grou...)
which is close enough to CentOS that the initial commands worked.
I enabled the MemberOf plugin and changed the attributes per the link, and restarted the system.
I created a test group (that I didn't enable a posix GID) and tried to add a single user via:
Right click on group -- > click Properties --> then Members --> click Add --> Search for user --> click Add.
When I try to go this route (which worked before enabling the memberOf plugin) it worked. Now it seems I get the error:
"Cannot save to directory server.
netscape.ldap.LDAPException: error resiult(65): Object class violation"
And the messages file throws the error (/var/log/dirsrv/slapd-<instancename>/errors:
"Entry "uid=test,ou=People,dc=int,dc=com" -- attribute "memberOf" not allowed
[17/Feb/2016:11:22:58 -0700] memberof-plugin - memberof_postop_modify: failed to add dn (cn=testgroup,ou=Groups,dc=int,dc=com) to target. Error (65)"
So it seems my server isn't quite using the memberOf plugin properly, but I'm not sure what else to enable. I'll have to solve this issue before
I even try to filter login access via groups on my client system.
I should mention that if I go under the advanced tab for one of the groups I created, I can add the the attribute "uniquemember", but I'm not sure what I
should set the "value" to be.
I've tried creating new users to see if I could set their "uniquemember" attributes, but no luck. It seems that I don't have the ability to set this attribute
on individual users, only groups.
This might not be the right road to head down when trying to restrict access to servers via groups, so I'm open to any suggestions.
Any suggestions would be appreciated.
3 years, 1 month
Replication Delay
by Fong, Trevor
Hi Everyone,
I’ve set up a new 389 DS cluster (389-Directory/1.3.6.1 B2018.016.1710) and have set up a replication agreement from our old cluster (389-Directory/1.2.11.15 B2014.300.2010) to a master node in the new cluster. Problem is that updates in the old cluster take up to 15 mins to make it into the new cluster. We need it to be near instantaneous, like it normally is. Any ideas what I can check?
Thanks a lot,
Trev
_________________________________________________
Trevor Fong
Senior Programmer Analyst
Information Technology | Engage. Envision. Enable.
The University of British Columbia
trevor.fong(a)ubc.ca<mailto:trevor.fong@ubc.ca> | 1-604-827-5247<tel:604-827-5247> | it.ubc.ca<http://it.ubc.ca>
5 years, 4 months
ldapsearch doesn't return the userpassword field
by Janet Houser
Hi,
I've been looking through the archives for information, but I haven't stumbled on a solution to my problem.
I'm running ds-389 (389-ds-base-1.3.4.0) on a centos 7 box (CentOS Linux release 7.2.1511). I have a centos OS client configured using SSL/TLS
which queries the LDAP server. Per a previous thread, I configured the memeberOf plugin and all seems to be working properly.
I have a php script that will run on the client and change the LDAP password for the user. The problem is, the script looks for the SSHA has
of the password when an ldapsearch is issued.
However, when I issue a general ldapsearch (anonymously) I don't get the userpassword field. I read in your archives that I might have
to be the "directory manager" user in order to see the hashed password. I've been playing around with the ldapsearch syntax, but I can't
quite get it right.
Anyway, my question is, can I set a flag in 389-ds that will display the hashed userpassword? I think that will solve my problem with the php script returning an error that it can't retrieve the old password.
Thanks,
5 years, 4 months
ACI to allow group to access one attribute
by Angel Bosch
hi,
I need one specific attribute to be hidden for anyone but one group.
I've tested this one:
(targetattr = "myCustomAttr") (version 3.0; acl "deny all but admins"; deny (all) groupdn != "ldap:///cn=admins,ou=Groups,dc=company,dc=global";)
and seems to work.
Is this the right way to do it?
Can I face any side effects?
regards,
abosch
--
5 years, 6 months
replication issue
by JESSE LUNT
Hello,
I have inherited a 389 LDAP environment, which is running on RHEL
5.5 server. There are two RHEL 5.5 servers in the LDAP environment (389ds1
and 389ds2)
Currently the directory is only on one system as the replication hasn't
been working for aprox a year (yikes!!!) I am trying to create a
replication agreement between two servers. When I add the replication
agreement I receive an error " LDAP server is unwilling to perform"
My thought is before I introduce a newer version of the LDAP I should try
to get the replication between the two existing servers working.
Any thoughts on where to begin troubleshooting this? I am a 389 LDAP
noob....
Thanks,
Jesse
--
5 years, 7 months
Re: password policy
by Mark Reynolds
On 02/27/2018 03:15 PM, Alberto Viana wrote:
> Hey Mark,
>
> Another question, what is the right way to disable a subtree policty
> (could not found anything in the docs, even the RHDS)?
>
> Just delete the policy entry (nsPwPolicyEntry and nsPwTemplateEntry)?
Correct, it can not be turned off. It exists or doesn't. When it's not
present the global policy takes effect.
>
>
> And once I did that, the global policy takes over?
>
> Thanks
>
> On Tue, Feb 27, 2018 at 4:59 PM, Mark Reynolds <mreynolds(a)redhat.com
> <mailto:mreynolds@redhat.com>> wrote:
>
>
>
> On 02/27/2018 02:30 PM, Alberto Viana wrote:
>> Mark,
>>
>> Thanks a lot.
> No problem Alberto!
>>
>> On Tue, Feb 27, 2018 at 4:28 PM, Mark Reynolds
>> <mreynolds(a)redhat.com <mailto:mreynolds@redhat.com>> wrote:
>>
>>
>>
>> On 02/27/2018 02:22 PM, Alberto Viana wrote:
>>> I think I was not clear enough,
>>>
>>> I have 2 users under cn=config (my replication users) under
>>> dn: cn=config
>>>
>>> uid=rep389,cn=config
>>> uid=repad,cn=config
>>>
>>> If I set a global password policy, this policy applies to
>>> these users?
>> Yes it does
>>>
>>> Tanks
>>>
>>> On Tue, Feb 27, 2018 at 3:58 PM, Mark Reynolds
>>> <mreynolds(a)redhat.com <mailto:mreynolds@redhat.com>> wrote:
>>>
>>> Correct, all the "global" password policy settings are
>>> stored in the cn=config entry.
>>>
>>>
>>> On 02/27/2018 01:24 PM, Alberto Viana wrote:
>>>> Hi guys,
>>>>
>>>> When I enable global password policy, is that suppose
>>>> to affect cn=config?
>>>>
>>>> I Just want to confirm that.
>>>>
>>>>
>>>> _______________________________________________
>>>> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
>>>> <mailto:389-users@lists.fedoraproject.org>
>>>> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>>>> <mailto:389-users-leave@lists.fedoraproject.org>
>>>
>>>
>>
>>
>
>
5 years, 7 months
Re: password policy
by Mark Reynolds
On 02/27/2018 02:22 PM, Alberto Viana wrote:
> I think I was not clear enough,
>
> I have 2 users under cn=config (my replication users) under dn: cn=config
>
> uid=rep389,cn=config
> uid=repad,cn=config
>
> If I set a global password policy, this policy applies to these users?
Yes it does
>
> Tanks
>
> On Tue, Feb 27, 2018 at 3:58 PM, Mark Reynolds <mreynolds(a)redhat.com
> <mailto:mreynolds@redhat.com>> wrote:
>
> Correct, all the "global" password policy settings are stored in
> the cn=config entry.
>
>
> On 02/27/2018 01:24 PM, Alberto Viana wrote:
>> Hi guys,
>>
>> When I enable global password policy, is that suppose to affect
>> cn=config?
>>
>> I Just want to confirm that.
>>
>>
>> _______________________________________________
>> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
>> <mailto:389-users@lists.fedoraproject.org>
>> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>> <mailto:389-users-leave@lists.fedoraproject.org>
>
>
5 years, 7 months
password policy
by Alberto Viana
Hi guys,
When I enable global password policy, is that suppose to affect cn=config?
I Just want to confirm that.
5 years, 7 months
notify users before delete them
by Maria Tsiolakki
Hello,
We have recently setup a new 389 directory server.
One of our problems is to maintain user's accounts. Once we find
proposed accounts for deletion i.e user has retired etc, we want to sent
him an email, inform him that his account will be inactive in 30 days.
Once 30 days are gone, then the account is disabled, for another 30
days and then removed.
Are there any plugins that can help us to achieve the above scenario,
whole or partially?
Thank you in advance
Maria
--
**
5 years, 7 months
