389-users August 2023

389-users@lists.fedoraproject.org

9 participants
14 discussions

ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0
by Graham Leggett 11 Dec '23

11 Dec '23

Hi all, We have a long standing 389ds master LDAP server that was found to be unable to contact it’s slaves. Most specifically, the slaves show nothing in their logs about any kind of connection, while the master is logging this: [12/Nov/2019:21:39:47.212715697 +0000] - ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0 (Unknown error, host “ldap01:636”) Key is "system error 0 (no error)”, which leaves us stumped. The error is obviously “success”. Has anyone seen this kind of thing before? This is 389ds running on CentOS7 as follows: 389-ds-base-1.3.9.1-10.el7.x86_64 Regards, Graham —

3 9

389-ds freezes with deadlock
by Julian Kippels 13 Sep '23

13 Sep '23

Hi, I am using 389-ds Version 2.3.1 and have encountered the same error twice in three days now. There are some MOD operations and then I get a line like this in the errors-log: [23/Aug/2023:13:27:17.971884067 +0200] - ERR - ldbm_back_seq - deadlock retry BAD 1601, err=0 Unexpected dbimpl error code After this the server keeps running, systemctl status says everything is fine, but new incoming connections are failing with timeouts. Any advice would be welcome. Thanks in advance Julian Kippels -- --------------------------------------------------------- | | Julian Kippels | | M.Sc. Informatik | | | | Zentrum für Informations- und Medientechnologie | | Heinrich-Heine-Universität Düsseldorf | | Universitätsstr. 1 | | Raum 25.41.O1.32 | | 40225 Düsseldorf / Germany | | | | Tel: +49-211-81-14920 | | mail: kippels(a)hhu.de ---------------------------------------------------------

3 8

Re: Internal Server Error
by Omar 30 Aug '23

30 Aug '23

Hello Mark, Sorry for the late reply, I was sick and didn't get back to work until today. Please find attached logs and configuration of my server. Let me know if you see how I can make this work with what I have. Thanks in advance, //omar ----------------------------------------------------------------------------------------- On 8/25/23 2:20 PM, Omar wrote: Hello Mark, I'm sorry, didn't know that the dsgw was no longer supported. We are trying to create an LDAP service with a GUI so that our users can change their passwords. I have installed and configured the following: - 389-ds-base - openldap-clients - idm-console-framework - 389-adminutil - 389-admin - 389-admin-console - 389-console - 389-ds-console - 389-dsgw I have deployed all these on Centos-7 and the versions are: - 389-console-1.1.19-6 - 389-ds-base-1.3.11.1-2 - 389-ds-console-1.2.16-1 - 389-admin-1.1.46-4 - 389-admin-console-1.1.12-1 - 389-ds-base-libs-1.3.11.1-2 - 389-adminutil-1.1.22-2 - 389-dsgw-1.1.11-5 Now that I know that the dsgw is no longer supported, what do you recommend I use as a GUI for all users? Users can log into 389-console, but you might need to configure some settings in adm.conf to make that work with just using the user's RDN of their DN. Otherwise you need to use the entire DN of the entry to log in. There might be other config files you need to edit. Sorry it's so old I don't recall all the details, but I know it's possible. But, did you look into the admin server error log? I would think dsgw could still work, but without knowing more about the failure it's hard to say. Our wiki has a few docs on it, but not much: https://www.port389.org/docs/389ds/administration/dsgw.html https://www.port389.org/docs/389ds/administration/dsgw-install-guide.html There was an upstream project started by William Brown (https://pagure.io/ 389-ds-portal) many years ago, but I don't think it's been updated in a long time. I'm not sure if it's functional or not. Our team does not work on this project, but you might want to look into it. Otherwise you need to develop your own user portal. There is also Openldap's Apache Directory Studio: https://directory.apache.org/studio/ but I don't think this is exactly what you are looking for. Regards, Mark Thanks for the support. //Omar On Thu, Aug 24, 2023 at 8:56 AM Mark Reynolds <mareynol(a)redhat.com> wrote: > > On 8/23/23 10:08 AM, Omar Pagan wrote: > > Getting the following error after following all the documentation for > deploying 389ds and 389dsgw. Please help. > > What documentation? dsgw (Directory Server Gateway) hasn't been > "supported/maintained" in over 10+ years so I am not surprised it's not > working. Also it was only provided to show what an LDAP webapp could > do. It was never a fully supported product. > > Or, are you referring to the old java console? 389-console? > > What platform are you trying to run this on? What is the rpm version of > 389-ds-base? 389-admin? > > What is in the admin server error log? Not sure where this log is > anymore(it's been so long since I looked at it), but its probably under > /var/log/dirsrv/admin-serv/ ? Something like that... > > HTH, > Mark > > > > > > Internal Server Error > > The server encountered an internal error or misconfiguration and was > unable to complete your request. > > > > Please contact the server administrator at [no address given] to inform > them of the time this error occurred, and the actions you performed just > before this error. > > > > More information about this error may be available in the server error > log. > > > > Apache/2.4 Server at 10.194.81.88 Port 9830 > > _______________________________________________ > > 389-users mailing list -- 389-users(a)lists.fedoraproject.org > > To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org > > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > > List Archives: https://lists.fedoraproject.org/archives/list/389 > -users(a)lists.fedoraproject.org > > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > -- > Directory Server Development Team > > -- Directory Server Development Team

2 1

Re: can someone point me in the right direction please
by William Brown 29 Aug '23

29 Aug '23

> On 30 Aug 2023, at 00:46, Jeffrey Westgate <Jeffrey.Westgate(a)arkansas.gov> wrote: > > I've inherited an old ldap config - 389-Directory/1.2.11.15 B2018.129.1448 - and it's on a server where the OS in nearing EOS. > > I am leaning on trying to get to RHEL 9, and dnf-installing latest which seems to be 2.2.4-3.el9 > > My intuition tells me this is not a straight-forward drop the old and install it to the new, based on changes to the db that I'm aware of... > > I'm hoping there is a sort of how-to to get from here to there? step-by-step, commands, etc? > > thanks for anything useable... Actually, most of the changes would be in the dse.ldif TBH rather than the DB. But you could try it and see what happens 🤔? Anyway, the best way to proceed IMO would be db2ldif on the 1.2 server, then ldif2db on the 2.2 server. Then you need to compare both servers dse.ldif and bring over any plugin configs and indexes that were configured. Mostly that should get you to parity. Then you can setup new replicas etc. Hope that helps :) > > > > – > Jeff Westgate > UNIX/Linux Support Team Lead > Transformation and Shared Services, Division of Information Systems > > > _______________________________________________ > 389-users mailing list -- 389-users(a)lists.fedoraproject.org > To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject… > Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue -- Sincerely, William Brown Senior Software Engineer, Identity and Access Management SUSE Labs, Australia

1 0

can someone point me in the right direction please
by Jeffrey Westgate 29 Aug '23

29 Aug '23

I've inherited an old ldap config - 389-Directory/1.2.11.15 B2018.129.1448 - and it's on a server where the OS in nearing EOS. I am leaning on trying to get to RHEL 9, and dnf-installing latest which seems to be 2.2.4-3.el9 My intuition tells me this is not a straight-forward drop the old and install it to the new, based on changes to the db that I'm aware of... I'm hoping there is a sort of how-to to get from here to there? step-by-step, commands, etc? thanks for anything useable... – Jeff Westgate UNIX/Linux Support Team Lead Transformation and Shared Services, Division of Information Systems

1 0

Re: Internal Server Error
by Mark Reynolds 25 Aug '23

25 Aug '23

On 8/25/23 2:20 PM, Omar wrote: > Hello Mark, > > I'm sorry, didn't know that the dsgw was no longer supported. We are > trying to create an LDAP service with a GUI so that our users can > change their passwords. > > I have installed and configured the following: > > * 389-ds-base > * openldap-clients > * idm-console-framework > * 389-adminutil > * 389-admin > * 389-admin-console > * 389-console > * 389-ds-console > * 389-dsgw > > I have deployed all these on Centos-7 and the versions are: > > * 389-console-1.1.19-6 > * 389-ds-base-1.3.11.1-2 > * 389-ds-console-1.2.16-1 > * 389-admin-1.1.46-4 > * 389-admin-console-1.1.12-1 > * 389-ds-base-libs-1.3.11.1-2 > * 389-adminutil-1.1.22-2 > * 389-dsgw-1.1.11-5 > > Now that I know that the dsgw is no longer supported, what do you > recommend I use as a GUI for all users? Users can log into 389-console, but you might need to configure some settings in adm.conf to make that work with just using the user's RDN of their DN. Otherwise you need to use the entire DN of the entry to log in. There might be other config files you need to edit. Sorry it's so old I don't recall all the details, but I know it's possible. But, did you look into the admin server error log? I would think dsgw could still work, but without knowing more about the failure it's hard to say. Our wiki has a few docs on it, but not much: https://www.port389.org/docs/389ds/administration/dsgw.html https://www.port389.org/docs/389ds/administration/dsgw-install-guide.html There was an upstream project started by William Brown (https://pagure.io/389-ds-portal) many years ago, but I don't think it's been updated in a long time. I'm not sure if it's functional or not. Our team does not work on this project, but you might want to look into it. Otherwise you need to develop your own user portal. There is also Openldap's Apache Directory Studio: https://directory.apache.org/studio/ but I don't think this is exactly what you are looking for. Regards, Mark > > Thanks for the support. > > //Omar > > On Thu, Aug 24, 2023 at 8:56 AM Mark Reynolds <mareynol(a)redhat.com> wrote: > > > On 8/23/23 10:08 AM, Omar Pagan wrote: > > Getting the following error after following all the > documentation for deploying 389ds and 389dsgw. Please help. > > What documentation? dsgw (Directory Server Gateway) hasn't been > "supported/maintained" in over 10+ years so I am not surprised > it's not > working. Also it was only provided to show what an LDAP webapp could > do. It was never a fully supported product. > > Or, are you referring to the old java console? 389-console? > > What platform are you trying to run this on? What is the rpm > version of > 389-ds-base? 389-admin? > > What is in the admin server error log? Not sure where this log is > anymore(it's been so long since I looked at it), but its probably > under > /var/log/dirsrv/admin-serv/ ? Something like that... > > HTH, > Mark > > > > > > Internal Server Error > > The server encountered an internal error or misconfiguration and > was unable to complete your request. > > > > Please contact the server administrator at [no address given] to > inform them of the time this error occurred, and the actions you > performed just before this error. > > > > More information about this error may be available in the server > error log. > > > > Apache/2.4 Server at 10.194.81.88 Port 9830 > > _______________________________________________ > > 389-users mailing list -- 389-users(a)lists.fedoraproject.org > > To unsubscribe send an email to > 389-users-leave(a)lists.fedoraproject.org > > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > > List Archives: > https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject… > > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > > -- > Directory Server Development Team > -- Directory Server Development Team

1 0

Re: Internal Server Error
by Omar Pagan 25 Aug '23

25 Aug '23

Hello Mark, I'm sorry, didn't know that the dsgw was no longer supported. We are trying to create an LDAP service with a GUI so that our users can change their passwords. I have installed and configured the following: 389-ds-base openldap-clients idm-console-framework 389-adminutil 389-admin 389-admin-console 389-console 389-ds-console 389-dsgw I have deployed all these on Centos-7 and the versions are: 389-console-1.1.19-6 389-ds-base-1.3.11.1-2 389-ds-console-1.2.16-1 389-admin-1.1.46-4 389-admin-console-1.1.12-1 389-ds-base-libs-1.3.11.1-2 389-adminutil-1.1.22-2 389-dsgw-1.1.11-5 Now that I know that the dsgw is no longer supported, what do you recommend I use as a GUI for all users? Thanks for the support. //Omar

1 0

Replication question
by tdarby＠arizona.edu 24 Aug '23

24 Aug '23

I've got two 389 multi-supplier replicated instances that I want to replicate to two new ones just temporarily for migration purposes. Since this is production, it would be ideal if it could be replicating right up to the second I make the new ones live. However, I simplified the configuration on the new one and now I'm wondering if this scheme will still work. On the old one, I have two replicated DBs, one mapped to ou=b,dc=a,dc=arizona,dc=edu and the other mapped to dc=a,dc=arizona,dc=edu. On the new one, I decided to have just one replicated DB, mapped to dc=arizona, dc=edu. Is it possible to replicate the old ones to the new instance? I'm thinking no, but I had to ask.

2 1

Internal Server Error
by Omar Pagan 24 Aug '23

24 Aug '23

Getting the following error after following all the documentation for deploying 389ds and 389dsgw. Please help. Internal Server Error The server encountered an internal error or misconfiguration and was unable to complete your request. Please contact the server administrator at [no address given] to inform them of the time this error occurred, and the actions you performed just before this error. More information about this error may be available in the server error log. Apache/2.4 Server at 10.194.81.88 Port 9830

2 1

Announcing 389 Directory Server 2.3.7
by Thierry Bordaz 09 Aug '23

09 Aug '23

389 Directory Server 2.3.7 The 389 Directory Server team is proud to announce 389-ds-base version 2.3.7 Fedora packages are available on Fedora f38 Fedora 38: https://koji.fedoraproject.org/koji/taskinfo?taskID=104579000 <https://koji.fedoraproject.org/koji/taskinfo?taskID=104579000> Bodhi: https://bodhi.fedoraproject.org/updates/FEDORA-2023-0680e2e886 <https://bodhi.fedoraproject.org/updates/FEDORA-2023-0680e2e886> The new packages and versions are: * 389-ds-base-2.3.7-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.3.7.tar.gz> Highlights in 2.3.7 * Alarming messages logged by account policy plugin * Server may crash at startup Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base * bump version to 2.3.7 * Issue 4551 - Part 2 - Fix build warning of previous PR (#5888) * Issue 5834 - AccountPolicyPlugin erroring for some users (#5866) * Issue 5872 - part 2 - fix is_dbi regression (#5887) * Issue 5848 - dsconf should prevent setting the replicaID for hub and consumer roles (#5849) * Issue 5870 - ns-slapd crashes at startup if a backend has no suffix (#5871) * Issue 5883 - Remove connection mutex contention risk on autobind (#5886) * Issue 5872 - |dbscan()| in lib389 can return bytes * Bump version to 2.3.6 * Issue 5729 - Memory leak in factory_create_extension (#5814) * Issue 5877 - test_basic_ldapagent breaks test_setup_ds_as_non_root* tests * Issue 5853 - Update Cargo.lock and fix minor warning (#5854) * Issue 5867 - lib389 should use filter for tarfile as recommended by PEP 706 (#5868) * Issue 5864 - Server fails to start after reboot because it’s unable to access nsslapd-rundir * Issue 5856 - SyntaxWarning: invalid escape sequence * Issue 5859 - dbscan fails with AttributeError: ‘list’ object has no attribute ‘extends’ * Issue 4551 - Paged search impacts performance (#5838) * Issue 4169 - UI - Fix retrochangelog and schema Typeaheads (#5837) * issue 5833 - dsconf monitor backend fails on lmdb (#5835) * Issue 3555 - UI - Fix audit issue with npm - stylelint (#5836) * Bump version to 2.3.5 * Issue 5752 - RFE - Provide a history for LastLoginTime (#5807) * Issue 5793 - UI - fix suffix selection in export modal * Issue 5793 - UI - Fix minor crashes (#5827) * Issue 5825 - healthcheck - password storage scheme warning needs more info * Issue 5822 - Allow empty export path for db2ldif * Issue 5755 - Massive memory leaking on update operations (#5824) * Issue 5551 - Almost empty and not loaded ns-slapd high cpu load * Issue 5156 - RFE that implement slapi_memberof (#5694) * Issue 5722 - RFE When a filter contains ‘nsrole’, improve response time by rewriting the filter (#5723) * Issue 5755 - The Massive memory leaking on update operations (#5803) * Issue 5752 - CI - Add more tests for lastLoginHistorySize RFE (#5802) * Issue 2375 - CLI - Healthcheck - revise and add new checks * Issue 5793 - UI - move from webpack to esbuild bundler * Issue 5781 - Bug handling return code of pre-extended operation plugin. * Issue 5785 - move bash completion to post section of specfile * Issue 5646 - Various memory leaks (#5725) * Issue 5789 - Improve ds-replcheck error handling * Issue 5786 - CLI - registers tools for bash completion * Issue 5778 - UI - Remove error message if .dsrc is missing * Issue 4758 - Add tests for WebUI * Issue 5751 - Cleanallruv task crashes on consumer (#5775) * Issue 5743 - Disabling replica crashes the server (#5746)

1 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users August 2023