[Fedora-directory-users] Sync AD

[Pedro Rodrigues]

Hi

Does anyone have a document  like an howto that can explain how we can 
syncronize FDS with AD ? Anyone that  have already do this .
Thanks.



-- 
Cumprimentos Cordiais,
Pedro Rodrigues

Tecnologias de Informação
Centimfe - Centro Tecnológico da Indústria dos Moldes, Ferramentas Especiais e Plásticos
Zona Industrial
Rua da Espanha, Lote 8
Apartado 313
2431-904 Marinha Grande

tel.: [phone]
email.: pedro.rodrigues(a)centimfe.com
Web.: http://www.centimfe.com

[Rich Megginson]

Pedro Rodrigues wrote:

>  Hi
>
>  Does anyone have a document  like an howto that can explain how we can 
>  syncronize FDS with AD ? Anyone that  have already do this . 
http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267

Note that you are strongly encouraged to get it working _without_ 
SSL/TLS first, then go back and enable the use of SSL/TLS, despite what 
the docs say.  Do not run this in a production environment without using 
SSL/TLS.

>  Thanks.
>
>
>
> ------------------------------------------------------------------------
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>   
>

[Nabeel Moidu]

On 9/20/05, Rich Megginson <rmeggins(a)redhat.com&gt; wrote:
>  Pedro Rodrigues wrote:
>
>  > Hi
>  >
>  > Does anyone have a document like an howto that can explain how we can
>  > syncronize FDS with AD ? Anyone that have already do this .
>
>  http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
>
>  Note that you are strongly encouraged to get it working _without_
>  SSL/TLS first, then go back and enable the use of SSL/TLS, despite what
>  the docs say. Do not run this in a production environment without using
>  SSL/TLS.
>
>  > Thanks.
>  > 
Two doubts here
I have synced win2k03 group cn=users,dc=domain,dc=tld and FDS group
ou=people,dc=domain,dc=tld.
(The default groups , i have not touched the schema)
1)Are the attributes for any user in the two servers the same? If there are
attributes that are there in AD and not in FDS or vice versa , does it
simply ignore it during the sync?
2)When using this setup for Postfix authentication from the FDS , do we need
to add any additional attributes in the AD or the FDS (Since i intend to use
the AD for user creation) to get the postfix authentication working?
3)Lastly does postfix work with LDAP with the default installation along
with RHEL? The documentation in
http://www.postfix.org/LDAP_README.htmlspecifies configuration options
for use with OpenLDAP .Is it the same for
FDS?
I hope to put up a full doc wiki entry somewhere once the whole thing once
its all done.
Thanks in advance
Best Regards
Nabeel

[Dimitri Yioulos]

On Wednesday 21 September 2005 7:53 am, Nabeel Moidu wrote:
>  On 9/20/05, Rich Megginson <rmeggins(a)redhat.com&gt; wrote:
>  > Pedro Rodrigues wrote:
>  > > Hi
>  > >
>  > > Does anyone have a document like an howto that can explain how we can
>  > > syncronize FDS with AD ? Anyone that have already do this .
>  >
>  > http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
>  >
>  > Note that you are strongly encouraged to get it working _without_
>  > SSL/TLS first, then go back and enable the use of SSL/TLS, despite what
>  > the docs say. Do not run this in a production environment without using
>  > SSL/TLS.
>  >
>  > > Thanks.
>
>  Two doubts here
>  I have synced win2k03 group cn=users,dc=domain,dc=tld and FDS group
>  ou=people,dc=domain,dc=tld.
>  (The default groups , i have not touched the schema)
>  1)Are the attributes for any user in the two servers the same? If there are
>  attributes that are there in AD and not in FDS or vice versa , does it
>  simply ignore it during the sync?
>  2)When using this setup for Postfix authentication from the FDS , do we
>  need to add any additional attributes in the AD or the FDS (Since i intend
>  to use the AD for user creation) to get the postfix authentication working?
>  3)Lastly does postfix work with LDAP with the default installation along
>  with RHEL? The documentation in
>  http://www.postfix.org/LDAP_README.htmlspecifies configuration options
>  for use with OpenLDAP .Is it the same for
>  FDS?
>  I hope to put up a full doc wiki entry somewhere once the whole thing once
>  its all done.
>  Thanks in advance
>  Best Regards
>  Nabeel 
Nabeel,

Not answers to your questions, but a request to you:

For whatever reason, I've struggled to get my win2k3 ADS and FDS to sync 
properly.  Would you be kind enough to share a step-by-step of how you set up 
the sync?  (If others on the list feel that this should be done off-list, 
please let me know).

Thanks.

Dimitri

[David Boreham]

> For whatever reason, I've struggled to get my win2k3 ADS and FDS to sync 
> properly.  Would you be kind enough to share a step-by-step of how you set up 
> the sync?  
>   
>  
Search for the word 'step' in this page:
http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267

[David Boreham]

>  I have synced win2k03 group cn=users,dc=domain,dc=tld and FDS group 
>  ou=people,dc=domain,dc=tld.
>  (The default groups , i have not touched the schema)
>  1)Are the attributes for any user in the two servers the same? If 
>  there are  attributes that are there in AD and not in FDS or vice 
>  versa , does it simply ignore it during the sync? 
The attributes listed in the documentation are sync'ed. Others are ignored.
(the list is slightly different for groups vs. users).

>  2)When using this setup for Postfix authentication from the FDS , do
>
>  we need to add any additional attributes in the AD or the FDS (Since i 
>  intend to use the AD  for user creation) to get the postfix 
>  authentication working? 
Dunno. Obviously postfix will expect some schema. You can
either try to sync that over from AD, in which case it'd need to
conform to the sync'ed attributes list mentioned above. Or you'd
need to add the postfix-specific attributes on the FDS side.

>  3)Lastly does postfix work with LDAP with the default installation 
>  along with RHEL? The documentation in 
>  http://www.postfix.org/LDAP_README.html specifies configuration 
>  options for use with OpenLDAP .Is it the same for FDS? 
Not sure, but this may help:
http://www.ldapsource.com/content/ldap_postfix.html
It seems that Postfix can be configured to use whatever attribute
names you want, so you may be able to use standard schema
at least in the case that you aren't doing virtual domains.

[Dimitri Yioulos]

On Wednesday 21 September 2005 10:38 am, David Boreham wrote:
>  >For whatever reason, I've struggled to get my win2k3 ADS and
> FDS to sync
>  >properly.  Would you be kind enough to share a step-by-step of how you set
>  > up the sync?
>
>  Search for the word 'step' in this page:
>  http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
>
>
>  --
>  Fedora-directory-users mailing list
>  Fedora-directory-users(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-directory-users 
David,

Thanks for pointing me to the manual - I've read it.  I'm sure it's my own 
stupidity that has caused me to misconfigure something regarding sync.  I was 
hoping that someone who had gone through the process of setting up winsync 
might share that with me; perhaps that would help me catch my error.  
Obviously, the manual didn't work for a non-genius like me.

Dimitri

[David Boreham]

> Thanks for pointing me to the manual - I've read it.  I'm sure it's my own 
> stupidity that has caused me to misconfigure something regarding sync.  I was 
> hoping that someone who had gone through the process of setting up winsync 
> might share that with me; perhaps that would help me catch my error.  
> Obviously, the manual didn't work for a non-genius like me.
>
>   
>  
The step by step guide in the manual was written by someone
that had gone through the steps themselves (a non-developer).
Anyway, could you try the steps listed in the 'troubleshooting'
section of the winsync manual chapter, in particular enable
replication logging ? That will probably produce some useful
error log output, which you can post here and we'll attempt to
determine what's not working.

[Nabeel Moidu]

Dimitri
Can you tell us where u got stuck or what is the error.
For me the sync was pretty straight through except for
finding the passsync.msi file which was in the installation package
itself( i wasted a lot of time googling for it).
By the way i used the default windows administrator user and setup
the sync without the ssl stuff.
Regards
Nabeel

On 9/21/05, David Boreham <david_list(a)boreham.org&gt; wrote:
>  >
>  >Thanks for pointing me to the manual - I've read it. I'm sure it's my
> own
>  >stupidity that has caused me to misconfigure something regarding sync. I
>  was
>  >hoping that someone who had gone through the process of setting up
>  winsync
>  >might share that with me; perhaps that would help me catch my error.
>  >Obviously, the manual didn't work for a non-genius like me.
>  >
>  >
>  >
>  The step by step guide in the manual was written by someone
>  that had gone through the steps themselves (a non-developer).
>  Anyway, could you try the steps listed in the 'troubleshooting'
>  section of the winsync manual chapter, in particular enable
>  replication logging ? That will probably produce some useful
>  error log output, which you can post here and we'll attempt to
>  determine what's not working.
>
>
>
>
>  --
>  Fedora-directory-users mailing list
>  Fedora-directory-users(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-directory-users
>

[Dimitri Yioulos]

On Wednesday 21 September 2005 11:38 am, Nabeel Moidu wrote:
>  Dimitri
>  Can you tell us where u got stuck or what is the error.
>  For me the sync was pretty straight through except for
>  finding the passsync.msi file which was in the installation package
>  itself( i wasted a lot of time googling for it).
>  By the way i used the default windows administrator user and setup
>  the sync without the ssl stuff.
>  Regards
>  Nabeel
>
>  On 9/21/05, David Boreham <david_list(a)boreham.org&gt; wrote:
>  > >Thanks for pointing me to the manual - I've read it. I'm sure it's
> my
>  > > own stupidity that has caused me to misconfigure something regarding
>  > > sync. I
>  >
>  > was
>  >
>  > >hoping that someone who had gone through the process of setting up
>  >
>  > winsync
>  >
>  > >might share that with me; perhaps that would help me catch my error.
>  > >Obviously, the manual didn't work for a non-genius like me.
>  >
>  > The step by step guide in the manual was written by someone
>  > that had gone through the steps themselves (a non-developer).
>  > Anyway, could you try the steps listed in the 'troubleshooting'
>  > section of the winsync manual chapter, in particular enable
>  > replication logging ? That will probably produce some useful
>  > error log output, which you can post here and we'll attempt to
>  > determine what's not working.
>  >
>  >
>  >
>  >
>  > --
>  > Fedora-directory-users mailing list
>  > Fedora-directory-users(a)redhat.com
>  > https://www.redhat.com/mailman/listinfo/fedora-directory-users 
Nabeel,

Thanks for your response!

I'm not sure where I'm getting stuck (and, at this point, I'm just totally 
confused).  If using the default administrator for sync purposes works, then 
that's what I'll do.  Do I need to create a corresponding user anywhere on 
the FDS box (in FDS or in the underlying OS [actually, the underlying OS 
doesn't like the user "administrator"]).  I don't care just yet about 
password synchronization, so do I need to use the Windows sync program?  Is 
it really just a matter of creating the proper sync agreement?

Thanks.

Dimitri

[Dimitri Yioulos]

On Wednesday 21 September 2005 11:32 am, David Boreham wrote:
>  >Thanks for pointing me to the manual - I've read it.  I'm
> sure it's my own
>  >stupidity that has caused me to misconfigure something regarding sync.  I
>  > was hoping that someone who had gone through the process of setting up
>  > winsync might share that with me; perhaps that would help me catch my
>  > error. Obviously, the manual didn't work for a non-genius like me.
>
>  The step by step guide in the manual was written by someone
>  that had gone through the steps themselves (a non-developer).
>  Anyway, could you try the steps listed in the 'troubleshooting'
>  section of the winsync manual chapter, in particular enable
>  replication logging ? That will probably produce some useful
>  error log output, which you can post here and we'll attempt to
>  determine what's not working.
>
>
>
>
>  --
>  Fedora-directory-users mailing list
>  Fedora-directory-users(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-directory-users 
David,

I read my reply to your previous post, and it did sound a bit testy - 
apologies.  But this has been very frustrating.  I've had fairly long 
conversations with you and others via irc about this.  I've uploaded verbose 
error log files, tried to see what might be happening on the ADS side, tried 
your modified ldapsearch tool (does that now ring a bell), and ... nada.  
It's killing me that it seems like a rather trivial setup that others have 
accomplished, but I can't.  The troubleshooting section of the winsync manual 
doesn't contain anything that applies to me.

But, I'm loathe to quit.

Dimitri

[David Boreham]

> I read my reply to your previous post, and it did sound a bit testy -
>
> apologies.  But this has been very frustrating.  I've had fairly long 
> conversations with you and others via irc about this.  I've uploaded verbose 
> error log files, tried to see what might be happening on the ADS side, tried 
> your modified ldapsearch tool (does that now ring a bell), 
>  
Ok, so we were already working on your problem. I've been out
of the office for a few days, hence the lack of progress. We already
know that you haven't made a simple configuration error. There's
some problem with interaction between winsync on the FDS side
and your particular Win2003's AD.

The next thing I was going to ask you if you have the capability
to take ethereal or tcpdump traces of the LDAP traffic between
FDS and AD under the conditions we tried earlier (restart the
server then initiate a re-sync)? Those traces would be useful
in figuring out which side (AD or FDS) has caused the transmission
of entries to halt.

[Dimitri Yioulos]

>  Ok, so we were already working on your problem. I've been out
>  of the office for a few days, hence the lack of progress. We already
>  know that you haven't made a simple configuration error. There's
>  some problem with interaction between winsync on the FDS side
>  and your particular Win2003's AD.
>
>  The next thing I was going to ask you if you have the capability
>  to take ethereal or tcpdump traces of the LDAP traffic between
>  FDS and AD under the conditions we tried earlier (restart the
>  server then initiate a re-sync)? Those traces would be useful
>  in figuring out which side (AD or FDS) has caused the transmission
>  of entries to halt.
>  

OK, I'm happy to do that.  I've used both ethereal and tcpdump.  Is there a 
filter I should add to capture just the ldap traffic?

BTW, did you see my post on irc vis-a-vis the ldapsearch results?

Dimitri

[David Boreham]

> >
> >OK, I'm happy to do that.  I've used both ethereal and tcpdump.  Is there a 
> >filter I should add to capture just the ldap traffic?
> >
> >    
> > 
Everything on port 389 will be fine (disable SSL if you have been using it).

> >BTW, did you see my post on irc vis-a-vis the ldapsearch results?
> >
> >    
> > 
I saw that the modified ldapsearch produced correct results, which is why
I'm asking for a packet trace now.

[Dimitri Yioulos]

On Wednesday 21 September 2005 12:59 pm, David Boreham wrote:
>  >>OK, I'm happy to do that.  I've used both ethereal
> and tcpdump.  Is there
>  >> a filter I should add to capture just the ldap traffic?
>
>  Everything on port 389 will be fine (disable SSL if you have been using
>  it).
>
>  >>BTW, did you see my post on irc vis-a-vis the ldapsearch results?
>
>  I saw that the modified ldapsearch produced correct results, which is why
>  I'm asking for a packet trace now. 
David,

I ran tcpdump -s 0 port 389 and redirected the output to a file.  I fired off 
tcpdump just prior to starting the FDS server.  Then, I started the console, 
and did a full re-sync.  If I interpret the results correctly, the FDS and 
ADS boxes communicate on server start-up, buy sync dies immediately.
Shall I send the output to you off-list (I have the address)?

Dimitri

[David Boreham]

> I ran tcpdump -s 0 port 389 and redirected the output to a file.  I fired off 
> tcpdump just prior to starting the FDS server.  Then, I started the console, 
> and did a full re-sync.  If I interpret the results correctly, the FDS and 
> ADS boxes communicate on server start-up, buy sync dies immediately.
> Shall I send the output to you off-list (I have the address)?
>   
>  
Yes please.

[Nabeel Moidu]

On 9/21/05, Dimitri Yioulos <dyioulos(a)firstbhph.com&gt; wrote:
>  On Wednesday 21 September 2005 11:38 am, Nabeel Moidu wrote:
>  > Dimitri
>  > Can you tell us where u got stuck or what is the error.
>  > For me the sync was pretty straight through except for
>  > finding the passsync.msi file which was in the installation package
>  > itself( i wasted a lot of time googling for it).
>  > By the way i used the default windows administrator user and setup
>  > the sync without the ssl stuff.
>  > Regards
>  > Nabeel
>  >
>  > On 9/21/05, David Boreham <david_list(a)boreham.org&gt; wrote:
>  > > >Thanks for pointing me to the manual - I've read it. I'm sure
> it's my
>  > > > own stupidity that has caused me to misconfigure something regarding
>  > > > sync. I
>  > >
>  > > was
>  > >
>  > > >hoping that someone who had gone through the process of setting up
>  > >
>  > > winsync
>  > >
>  > > >might share that with me; perhaps that would help me catch my error.
>  > > >Obviously, the manual didn't work for a non-genius like me.
>  > >
>  > > The step by step guide in the manual was written by someone
>  > > that had gone through the steps themselves (a non-developer).
>  > > Anyway, could you try the steps listed in the 'troubleshooting'
>  > > section of the winsync manual chapter, in particular enable
>  > > replication logging ? That will probably produce some useful
>  > > error log output, which you can post here and we'll attempt to
>  > > determine what's not working.
>  > >
>  > >
>  > >
>  > >
>  > > --
>  > > Fedora-directory-users mailing list
>  > > Fedora-directory-users(a)redhat.com
>  > > https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
>  Nabeel,
>
>  Thanks for your response!
>
>  I'm not sure where I'm getting stuck (and, at this point, I'm just totally
>  confused). If using the default administrator for sync purposes works,
>  then
>  that's what I'll do. Do I need to create a corresponding user anywhere on
>  the FDS box (in FDS or in the underlying OS [actually, the underlying OS
>  doesn't like the user "administrator"]). I don't care just yet about
>  password synchronization, so do I need to use the Windows sync program? Is
>  it really just a matter of creating the proper sync agreement? 

Dimitri
I'll tell you the way i did in mine.I don't know if its the perfect way or
if it will bug me later.But so far it has worked.
In the windows part of the passsync.msi configuration (just run the msi file
again to reconfigure , for some reason the modify option never comes in the
windows 2003 services.msc tool as said in the tutorial) give the options for
user name as cn=sync manager , cn =config and the search base
ou=people,dc=domain,dc=com ( try going by what the tutorial says as far as
possible).
In the FDS create under the config a new Rolewith name sync manager and the
bind user in the sync agreement should be
cn=Administrator,cn=users,dc=domain,dc=com(the windows domain
administrator).
I didn't do anything further .I just started the sync and it worked.
As i told i am a beginner in LDAP , and have not completely read the FDS
schema docs ( I will do them before i finish this work) .When it all goes
into production once i get postfix also working with this then i will have
to plan which user with what privilege to use where and all that stuff.
I am in India and my timings is different from most of yours , thats why i
couldn't reply yesterday.
Regards
Nabeel

Thanks.
>  Dimitri
>

[Fedora-directory-users] FDS bug #163064

[William Francis]

in the Red Hat bugbase and not visable to me ...

Has this been fixed?  Is there a build available somewhere that I can 
download?

Thanks.

[Fedora-directory-users] FDS bug #163064

[Rich Megginson]

William Francis wrote:

>  in the Red Hat bugbase and not visable to me ... 
I'm not sure.  It was entered as a Red Hat DS bug and not a Fedora DS bug.

>  Has this been fixed? 
Not yet.

>  Is there a build available somewhere that I can download? 
Not yet, but very soon.

>  Thanks.
>
>  -- 
>  Fedora-directory-users mailing list
>  Fedora-directory-users(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-directory-users