On 7/18/19 12:09 PM, Leonard Lawton wrote:
On 7/18/19 9:05 AM, Mark Reynolds wrote:
>
> On 7/18/19 11:35 AM, Leonard wrote:
>> After upgrading to the following versions, I cannot login to the
>> console. I am presented with the error "error result (49): invalid
>> credentials".
>>
>> 389-admin-1.1.38-1.3.amzn1.x86_64
>> 389-ds-base-libs-1.3.8.4-18.60.amzn1.x86_64
>> 389-adminutil-1.1.21-1.1.amzn1.x86_64
>> 389-ds-base-1.3.8.4-18.60.amzn1.x86_64
>>
>> I don't remember exactly what the versions were prior.
>>
>> In the slapd access log, I see the following error associated with
>> the login attempt "conn=160830 op=0 RESULT err=49 tag=97 nentries=0
>> etime=0.0026096322 - No suffix for bind dn found"
>
> Can you provide the complete access log clip showing the BIND and the
> RESULT lines?
Here's everything associated with the connection.
[18/Jul/2019:15:08:34.131169944 +0000] conn=160830 fd=145 slot=145 SSL
connection from xx.xx.xx.xx to xx.xx.xx.xx
[18/Jul/2019:15:08:34.157152520 +0000] conn=160830 TLS1.2 256-bit AES
[18/Jul/2019:15:08:34.157225415 +0000] conn=160830 op=0 BIND
dn="(anon)" method=128 version=3
[18/Jul/2019:15:08:34.157305053 +0000] conn=160830 op=0 RESULT err=49
tag=97 nentries=0 etime=0.0026096322 - No suffix for bind dn found
Well there is a problem, "(anon)" is not A DN, so of course it is not
found.
I think you are running into a known issue...
The latest version of 389-adminutil is 1.1.23, but you are on
389-adminutil-1.1.21
The latest version of 389-admin is 1.1.46-1, but you are on
389-admin-1.1.38-1.3. The latest version of 389-admin does have a fix
around authentication.
I suspect if you log into the console using the full DN "uid=admin,
ou=Administrators, ou=TopologyManagement, o=NetscapeRoot" it will work,
but without the fix from 1.1.46 this is probably your only option.
If you are using the full DN and it's not working, then run the console
in debug mode: 389-console -D 9 Then post that output and the access
log output again.
Thanks,
Mark
>
> What this errors means is that the bind DN provided does not exist.
> So we need to see the full log output to see what BIND DN was
> actually used.
>
>>
>> I am using the username "admin" when logging in. I am however able
>> to bind successfully as "uid=admin, ou=Administrators,
>> ou=TopologyManagement, o=NetscapeRoot" when using ldapsearch, etc on
>> the same host as running the console.
>>
>> SSLv2/3 are disabled and only TLS 1.2 is enabled on the server.
>>
>> adm.conf has:
>>
>> sslVersionMax: TLS1.2
>> sslVersionMin: TLS1.2
>>
>> ssl bits from console.conf:
>>
>> NSSNickname Admin-Console
>> NSSCipherSuite
>>
+rsa_rc4_128_md5,+rsa_rc4_128_sha,+rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha
>> NSSProtocol TLSv1.2
>> NSSVerifyClient none
>> NSSPassPhraseDialog file:/etc/dirsrv/admin-serv/pin.txt
>>
>> certutil:
>> Certificate Nickname Trust Attributes
>> SSL,S/MIME,JAR/XPI
>>
>> Server-Cert u,u,u
>> CA Certificate CTu,u,u
>> Admin-Console u,u,u
>>
>>
>>
>> So far I've tried running setup-ds-admin.pl -u, deleting my .389
>> directory, and changing the password of "uid=admin,
>> ou=Administrators, ou=TopologyManagement, o=NetscapeRoot"
>> _______________________________________________
>> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
>> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>> Fedora Code of Conduct:
>>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
>> List Archives:
>>
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
>
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
--
389 Directory Server Development Team