Re: [Fedora-directory-users] fds vs passsync vs AD

[Paolo Barbato]

Dear list,

I repost original question on my troubles....anybody has any idea on 
why I'm facing such a problem ?

Regards,
Paolo.


> Thanks for reply, but I suspect I'm facing a different problem.
>
> Talking about SSL.
>
> As far as I understand SSL is used both for passync (AD -> FDS) and 
> replication agreement (AD <-> FDS). Note two different tasks.
>
> In first case work cert.db8 certificates. I've installed on both AD 
> and FDS, my CA certificate and FDS server certificate. Passync works 
> without  a hic. When I change pasword from windows it's exactly set 
> on FDS.
>
> Replication agreement is based on cert.db8 on FDS and MS 
> architecture on AD, I mean that I make use of mmc to install CA and 
> AD server signed certificate.
>
> Replication seems also work, since I see that AD and FDS users are 
> "merged" in one (almost) identical list.  So users that were in AD 
> are created on FDS and viceversa, with (almost) all parameters 
> setted.
>
> My problem arise when from a linux machine authenticated on FDS I 
> issue and passwd change password. Really all seems go right, since 
> FDS register new password, and also AD tell me that the change has 
> been committed :
>
> first event
> User Account Changed:
>   	Target Account Name:	barbato
>   	Target Domain:	TEST
>   	Target Account ID:	TEST\barbato
>   	Caller User Name:	sync manager
>   	Caller Domain:	TEST
>   	Caller Logon ID:	(0x0,0x318F76)
>   	Privileges:	-
>   Changed Attributes:
>   	Sam Account Name:	-
>   	Display Name:	-
>   	User Principal Name:	-
>   	Home Directory:	-
> and after a while a second security event:
>
> User Account password set:
>   	Target Account Name:	barbato
>   	Target Domain:	TEST
>   	Target Account ID:	TEST\barbato
>   	Caller User Name:	sync manager
>   	Caller Domain:	TEST
>   	Caller Logon ID:	(0x0,0x318F76)
>
>
> But when I try to log on AD with this new password AD tell me that 
> I'm usinig the wrong one. Note that also the previous doesn't work, 
> and this confirm that it has been really changed.
>
> Anybody has faced this ? Some other things to look into ?
>
> Regards,
> Paolo. 



-- 
------------------------------------------------------------------------------------------------
Paolo Barbato               email: mailto:[e-mail]
Network Administrator   phone: [phone]
                                             (39-049)-829-5000
Corso Stati Uniti,4            www: http://www.igi.cnr.it          
35127 Camin-Padova       PGP: 
http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp
ITALY                      JabberID: rfx_paolo_barbato(a)messenger.efda.org   
------------------------------------------------------------------------------------------------

[Fedora-directory-users] fds vs passsync vs AD

[Peter Santiago]

   Hi,

   I ran into a concrete wall...

    http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267

   To create a synchronization agreement:

   *  In the Directory Server Console, select the Configuration tab.
   *  In the left-hand navigation tree, right-click on the suffix to  
sync, and select New Synchronization Agreement. You can also highlight  
the suffix, and select Menu>Object>New Synchronization Agreement.

I followed the above steps in Fedora Directory Server...  There is no  
option for New Synchronization Agreement...  Perhaps it was removed or  
renamed???

   --
Peter Santiago         peters(a)psinergybbs.com
My website:            www.psinergybbs.com
My spamtrap address:   r34987y(a)psinergybbs.com

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

[Fedora-directory-users] fds vs passsync vs AD

[Glenn]

Paolo - Have you compared password complexity rules between AD and FD?  They 
should be the same.   -Glenn.

---------- Original Message -----------
From: Paolo Barbato <paolo.barbato(a)igi.cnr.it&gt;
To: "General discussion list for the Fedora Directory server project." 
<fedora-directory-users(a)redhat.com&gt;
Sent: Mon, 1 Oct 2007 08:28:12 +0200
Subject: Re: [Fedora-directory-users] fds vs passsync vs AD

>  Dear list,
>  
>  I repost original question on my troubles....anybody has any idea on 
>  why I'm facing such a problem ?
>  
>  Regards,
>  Paolo.
>  
>  >Thanks for reply, but I suspect I'm facing a different problem.
>  >
>  >Talking about SSL.
>  >
>  >As far as I understand SSL is used both for passync (AD -> FDS) and 
>  >replication agreement (AD <-> FDS). Note two different tasks.
>  >
>  >In first case work cert.db8 certificates. I've installed on both AD 
>  >and FDS, my CA certificate and FDS server certificate. Passync works 
>  >without  a hic. When I change pasword from windows it's exactly set 
>  >on FDS.
>  >
>  >Replication agreement is based on cert.db8 on FDS and MS 
>  >architecture on AD, I mean that I make use of mmc to install CA and 
>  >AD server signed certificate.
>  >
>  >Replication seems also work, since I see that AD and FDS users are 
>  >"merged" in one (almost) identical list.  So users that were in AD 
>  >are created on FDS and viceversa, with (almost) all parameters 
>  >setted.
>  >
>  >My problem arise when from a linux machine authenticated on FDS I 
>  >issue and passwd change password. Really all seems go right, since 
>  >FDS register new password, and also AD tell me that the change has 
>  >been committed :
>  >
>  >first event
>  >User Account Changed:
>  >  	Target Account Name:	barbato
>  >  	Target Domain:	TEST
>  >  	Target Account ID:	TEST\barbato
>  >  	Caller User Name:	sync manager
>  >  	Caller Domain:	TEST
>  >  	Caller Logon ID:	(0x0,0x318F76)
>  >  	Privileges:	-
>  >  Changed Attributes:
>  >  	Sam Account Name:	-
>  >  	Display Name:	-
>  >  	User Principal Name:	-
>  >  	Home Directory:	-
>  >and after a while a second security event:
>  >
>  >User Account password set:
>  >  	Target Account Name:	barbato
>  >  	Target Domain:	TEST
>  >  	Target Account ID:	TEST\barbato
>  >  	Caller User Name:	sync manager
>  >  	Caller Domain:	TEST
>  >  	Caller Logon ID:	(0x0,0x318F76)
>  >
>  >
>  >But when I try to log on AD with this new password AD tell me that 
>  >I'm usinig the wrong one. Note that also the previous doesn't work, 
>  >and this confirm that it has been really changed.
>  >
>  >Anybody has faced this ? Some other things to look into ?
>  >
>  >Regards,
>  >Paolo.
>  
>  -- 
>  ----------------------------------------------------------------------------
--------------------
>  Paolo Barbato               email: mailto:[e-mail]
>  Network Administrator   phone: [phone]
>                                               (39-049)-829-5000
>  Corso Stati Uniti,4            www: http://www.igi.cnr.it          
>  35127 Camin-Padova       PGP: 
>  http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp
>  ITALY                      JabberID: 
>  rfx_paolo_barbato(a)messenger.efda.org   
>  ----------------------------------------------------------------------------
--------------------
>  
>  --
>  Fedora-directory-users mailing list
>  Fedora-directory-users(a)redhat.com
>  https://www.redhat.com/mailman/listinfo/fedora-directory-users 
------- End of
Original Message -------

[Fedora-directory-users] fds vs passsync vs AD

[Peter Santiago]

Hi,

I ran into a concrete wall...

http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267

To create a synchronization agreement:

   1. In the Directory Server Console, select the Configuration tab.
   2. In the left-hand navigation tree, right-click on the suffix to
      sync, and select New Synchronization Agreement. You can also
      highlight the suffix, and select Menu>Object>New Synchronization
      Agreement.

I followed the above steps in Fedora Directory Server... There is no 
option for New Synchronization Agreement... Perhaps it was removed or 
renamed???

-- 
Peter Santiago peters(a)psinergybbs.com
My website: www.psinergybbs.com
My spamtrap address: r34987y(a)psinergybbs.com





--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users

[Fedora-directory-users] need for Winsync clarification

[Peter Santiago]

Hi,

I ran into a concrete wall...

http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267

To create a synchronization agreement:

    1. In the Directory Server Console, select the Configuration tab.
    2. In the left-hand navigation tree, right-click on the suffix to
       sync, and select New Synchronization Agreement. You can also
       highlight the suffix, and select Menu>Object>New Synchronization
       Agreement.

I followed the above steps in Fedora Directory Server... There is no
option for New Synchronization Agreement... Perhaps it was removed or
renamed???

-- 
Peter Santiago peters(a)psinergybbs.com
My website: www.psinergybbs.com
My spamtrap address: r34987y(a)psinergybbs.com

[Fedora-directory-users] need for Winsync clarification

[David Boreham]

Peter Santiago wrote:
> http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
>
>  To create a synchronization agreement:
>
>     1. In the Directory Server Console, select the Configuration tab.
>     2. In the left-hand navigation tree, right-click on the suffix to
>        sync, and select New Synchronization Agreement. You can also
>        highlight the suffix, and select Menu>Object>New Synchronization
>        Agreement.
>
>  I followed the above steps in Fedora Directory Server... There is no
>  option for New Synchronization Agreement... Perhaps it was removed or
>  renamed???  
I think the menu item is disabled until the changelog is configured.
Strangely, the winsync docs appear to fail to mention this step.
This is the best documentation I could find on enabling the changelog :
http://www.redhat.com/docs/manuals/dir-server/ag/7.1/replicat.html#1100336