add user aci problem

[Alberto Viana]

389-Directory/1.3.2.17 B2014.182.124


I'm trying to add an user (whitout using the manager, with a regular user):

Without any aci:

ldap_add: Insufficient access (50)
additional info: Insufficient 'add' privilege to the 'userPassword'
attribute


My aci:

dn: ou=test,dc=my,dc=domain
changetype: modify
add: aci
aci: (targetattr = "*") (target = "ldap:///test,dc=my,dc=domain")
(version
3.0;acl "POP-AL write permission";allow (all) (userdn =
"ldap:///uid=my_user,ou=app,dc=my,dc=domain");)

Also tried without "target" with same result.

ldap_add: Constraint violation (19)
additional info: invalid password syntax - passwords with storage scheme
are not allowed


I have an older server 389-Directory/1.3.2.17 B2014.182.124, and this works
fine.
What am I missing in the newer version? Or is that a bug?

Thanks

Alberto Viana

[Mark Reynolds]

On 11/10/2014 12:22 PM, Alberto Viana wrote:
>  389-Directory/1.3.2.17 <http://1.3.2.17> B2014.182.124
>
>
>  I'm trying to add an user (whitout using the manager, with a regular
>  user):
>
>  Without any aci:
>
>  ldap_add: Insufficient access (50)
>  additional info: Insufficient 'add' privilege to the 'userPassword'
>  attribute
>
>
>  My aci:
>
>  dn: ou=test,dc=my,dc=domain
>  changetype: modify
>  add: aci
>  aci: (targetattr = "*") (target = "ldap:///test,dc=my,dc=domain")
>  (version 3.0;acl "POP-AL write permission";allow (all) (userdn =
>  "ldap:///uid=my_user,ou=app,dc=my,dc=domain");)
>
>  Also tried without "target" with same result.
>
>  ldap_add: Constraint violation (19)
>  additional info: invalid password syntax - passwords with storage
>  scheme are not allowed 
Hi Alberto

Only a Password Administrator or the root dn(cn=directory manager) can
add prehashed passwords.  Please see this doc for more info:

http://www.port389.org/docs/389ds/design/password-administrator.html

Regards,
Mark
>  I have an older server 389-Directory/1.3.2.17 <http://1.3.2.17>
>  B2014.182.124, and this works fine.
>  What am I missing in the newer version? Or is that a bug?
>
>  Thanks
>
>  Alberto Viana
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

[Alberto Viana]

Mark,

It works, but when I do a ldapserch to this entry, it shows me that:

passwordAdminDN:: C9cq90J/

Is the expected behavior?

I put a group on it. In 389-console show even more strange characters  :)

Thanks

On Mon, Nov 10, 2014 at 5:10 PM, Mark Reynolds <mareynol(a)redhat.com&gt; wrote:

>  On 11/10/2014 12:22 PM, Alberto Viana wrote:
>
>   389-Directory/1.3.2.17 B2014.182.124
>
>
>   I'm trying to add an user (whitout using the manager, with a regular
>  user):
>
>   Without any aci:
>
>   ldap_add: Insufficient access (50)
>   additional info: Insufficient 'add' privilege to the 'userPassword'
>  attribute
>
>
>   My aci:
>
>   dn: ou=test,dc=my,dc=domain
>  changetype: modify
>  add: aci
>  aci: (targetattr = "*") (target = "ldap:///test,dc=my,dc=domain")
>  (version 3.0;acl "POP-AL write permission";allow (all) (userdn =
>  "ldap:///uid=my_user,ou=app,dc=my,dc=domain");)
>
>   Also tried without "target" with same result.
>
>   ldap_add: Constraint violation (19)
>   additional info: invalid password syntax - passwords with storage scheme
>  are not allowed
>
>  Hi Alberto
>
>  Only a Password Administrator or the root dn(cn=directory manager) can add
>  prehashed passwords.  Please see this doc for more info:
>
>  http://www.port389.org/docs/389ds/design/password-administrator.html
>
>  Regards,
>  Mark
>
>
>
>   I have an older server 389-Directory/1.3.2.17 B2014.182.124, and this
>  works fine.
>  What am I missing in the newer version? Or is that a bug?
>
>   Thanks
>
>   Alberto Viana
>
>
>
>  --
>  389 users mailing
> [e-mail]://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>

[Mark Reynolds]

On 11/13/2014 07:22 AM, Alberto Viana wrote:
>  Mark,
>
>  It works, but when I do a ldapserch to this entry, it shows me that:
>
>  passwordAdminDN:: C9cq90J/
>
>  Is the expected behavior? 
Hi Alberto,

Yeah this is a known bug (the value is being base64 encoded), but the
feature should still work correctly though.

Regards,
Mark
>  I put a group on it. In 389-console show even more strange characters  :)
>
>  Thanks
>
>  On Mon, Nov 10, 2014 at 5:10 PM, Mark Reynolds <mareynol(a)redhat.com
>  <mailto:[e-mail]>> wrote:
>
>
>      On 11/10/2014 12:22 PM, Alberto Viana wrote:
> >     389-Directory/1.3.2.17 <http://1.3.2.17> B2014.182.124
> >
> >
> >     I'm trying to add an user (whitout using the manager, with a
> >     regular user):
> >
> >     Without any aci:
> >
> >     ldap_add: Insufficient access (50)
> >     additional info: Insufficient 'add' privilege to the
> >     'userPassword' attribute
> >
> >
> >     My aci:
> >
> >     dn: ou=test,dc=my,dc=domain
> >     changetype: modify
> >     add: aci
> >     aci: (targetattr = "*") (target =
> "ldap:///test,dc=my,dc=domain")
> >     (version 3.0;acl "POP-AL write permission";allow (all) (userdn =
> >     "ldap:///uid=my_user,ou=app,dc=my,dc=domain");)
> >
> >     Also tried without "target" with same result.
> >
> >     ldap_add: Constraint violation (19)
> >     additional info: invalid password syntax - passwords with storage
> >     scheme are not allowed
>      Hi Alberto
>
>      Only a Password Administrator or the root dn(cn=directory manager)
>      can add prehashed passwords.  Please see this doc for more info:
>
>      http://www.port389.org/docs/389ds/design/password-administrator.html
>
>      Regards,
>      Mark
> >
> >
> >     I have an older server 389-Directory/1.3.2.17 <http://1.3.2.17>
> >     B2014.182.124, and this works fine.
> >     What am I missing in the newer version? Or is that a bug?
> >
> >     Thanks
> >
> >     Alberto Viana
> >
> >
> >
> >     --
> >     389 users mailing list
> >     389-users(a)lists.fedoraproject.org
> <mailto:[e-mail]>
> >     https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

[Rich Megginson]

On 11/13/2014 07:26 AM, Mark Reynolds wrote:
>  On 11/13/2014 07:22 AM, Alberto Viana wrote:
> > Mark,
> >
> > It works, but when I do a ldapserch to this entry, it shows me that:
> >
> > passwordAdminDN:: C9cq90J/
> >
> > Is the expected behavior?
>  Hi Alberto,
>
>  Yeah this is a known bug (the value is being base64 encoded), but the 
>  feature should still work correctly though.
>
>  Regards,
>  Mark 
What is the value supposed to be?  A human readable DN?

$ python
> >> import base64
> >> base64.b64decode('C9cq90J/') 
'\x0b\xd7*\xf7B\x7f'

That doesn't look like a DN - it looks like random bytes.

> >
> > I put a group on it. In 389-console show even more strange characters  :)
> >
> > Thanks
> >
> > On Mon, Nov 10, 2014 at 5:10 PM, Mark Reynolds <mareynol(a)redhat.com 
> > <mailto:[e-mail]>> wrote:
> >
> >
> >     On 11/10/2014 12:22 PM, Alberto Viana wrote:
> >>     389-Directory/1.3.2.17 <http://1.3.2.17> B2014.182.124
> >>
> >>
> >>     I'm trying to add an user (whitout using the manager, with a
> >>     regular user):
> >>
> >>     Without any aci:
> >>
> >>     ldap_add: Insufficient access (50)
> >>     additional info: Insufficient 'add' privilege to the
> >>     'userPassword' attribute
> >>
> >>
> >>     My aci:
> >>
> >>     dn: ou=test,dc=my,dc=domain
> >>     changetype: modify
> >>     add: aci
> >>     aci: (targetattr = "*") (target =
> >>     "ldap:///test,dc=my,dc=domain") (version 3.0;acl "POP-AL
> write
> >>     permission";allow (all) (userdn =
> >>     "ldap:///uid=my_user,ou=app,dc=my,dc=domain");)
> >>
> >>     Also tried without "target" with same result.
> >>
> >>     ldap_add: Constraint violation (19)
> >>     additional info: invalid password syntax - passwords with
> >>     storage scheme are not allowed
> >     Hi Alberto
> >
> >     Only a Password Administrator or the root dn(cn=directory
> >     manager) can add prehashed passwords. Please see this doc for
> >     more info:
> >
> >     http://www.port389.org/docs/389ds/design/password-administrator.html
> >
> >     Regards,
> >     Mark
> >>
> >>
> >>     I have an older server 389-Directory/1.3.2.17 <http://1.3.2.17>
> >>     B2014.182.124, and this works fine.
> >>     What am I missing in the newer version? Or is that a bug?
> >>
> >>     Thanks
> >>
> >>     Alberto Viana
> >>
> >>
> >>
> >>     --
> >>     389 users mailing list
> >>     389-users(a)lists.fedoraproject.org 
> <mailto:[e-mail]>
> >>     https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
> >
> >
> >
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users

[Ludwig Krispenz]

On 11/13/2014 03:49 PM, Rich Megginson wrote:
>  On 11/13/2014 07:26 AM, Mark Reynolds wrote:
> >
> > On 11/13/2014 07:22 AM, Alberto Viana wrote:
> >> Mark,
> >>
> >> It works, but when I do a ldapserch to this entry, it shows me that:
> >>
> >> passwordAdminDN:: C9cq90J/
> >>
> >> Is the expected behavior?
> > Hi Alberto,
> >
> > Yeah this is a known bug (the value is being base64 encoded), but the 
> > feature should still work correctly though.
> >
> > Regards,
> > Mark
>
>  What is the value supposed to be?  A human readable DN?
>
>  $ python
>  >>> import base64
>  >>> base64.b64decode('C9cq90J/')
>  '\x0b\xd7*\xf7B\x7f'
>
>  That doesn't look like a DN - it looks like random bytes. 
looks like:
https://fedorahosted.org/389/ticket/47952
> >>
> >> I put a group on it. In 389-console show even more strange 
> >> characters  :)
> >>
> >> Thanks
> >>
> >> On Mon, Nov 10, 2014 at 5:10 PM, Mark Reynolds <mareynol(a)redhat.com 
> >> <mailto:[e-mail]>> wrote:
> >>
> >>
> >>     On 11/10/2014 12:22 PM, Alberto Viana wrote:
> >>>     389-Directory/1.3.2.17 <http://1.3.2.17> B2014.182.124
> >>>
> >>>
> >>>     I'm trying to add an user (whitout using the manager, with a
> >>>     regular user):
> >>>
> >>>     Without any aci:
> >>>
> >>>     ldap_add: Insufficient access (50)
> >>>     additional info: Insufficient 'add' privilege to the
> >>>     'userPassword' attribute
> >>>
> >>>
> >>>     My aci:
> >>>
> >>>     dn: ou=test,dc=my,dc=domain
> >>>     changetype: modify
> >>>     add: aci
> >>>     aci: (targetattr = "*") (target =
> >>>     "ldap:///test,dc=my,dc=domain") (version 3.0;acl "POP-AL
> write
> >>>     permission";allow (all) (userdn =
> >>>     "ldap:///uid=my_user,ou=app,dc=my,dc=domain");)
> >>>
> >>>     Also tried without "target" with same result.
> >>>
> >>>     ldap_add: Constraint violation (19)
> >>>     additional info: invalid password syntax - passwords with
> >>>     storage scheme are not allowed
> >>     Hi Alberto
> >>
> >>     Only a Password Administrator or the root dn(cn=directory
> >>     manager) can add prehashed passwords.  Please see this doc for
> >>     more info:
> >>
> >>     http://www.port389.org/docs/389ds/design/password-administrator.html
> >>
> >>     Regards,
> >>     Mark
> >>>
> >>>
> >>>     I have an older server 389-Directory/1.3.2.17 <http://1.3.2.17>
> >>>     B2014.182.124, and this works fine.
> >>>     What am I missing in the newer version? Or is that a bug?
> >>>
> >>>     Thanks
> >>>
> >>>     Alberto Viana
> >>>
> >>>
> >>>
> >>>     --
> >>>     389 users mailing list
> >>>     389-users(a)lists.fedoraproject.org 
> <mailto:[e-mail]>
> >>>     https://admin.fedoraproject.org/mailman/listinfo/389-users
> >>
> >>
> >>
> >>
> >> --
> >> 389 users mailing list
> >> 389-users(a)lists.fedoraproject.org
> >> https://admin.fedoraproject.org/mailman/listinfo/389-users
> >
> >
> >
> > --
> > 389 users mailing list
> > 389-users(a)lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
>
>  --
>  389 users mailing list
>  389-users(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/389-users