How do I connect to 389-server via ldapsearch?

Hi,

I've installed the latest version on CentOS 8


https://directory.fedoraproject.org/docs/389ds/howto/quickstart.html



[root@radius-389-test ~]# rpm -qa |grep 389 |sort
389-ds-base-1.4.2.16-1.module_el8+9435+e6daf39f.x86_64
389-ds-base-libs-1.4.2.16-1.module_el8+9435+e6daf39f.x86_64
cockpit-389-ds-1.4.2.16-1.module_el8+9435+e6daf39f.noarch
python3-lib389-1.4.2.16-1.module_el8+9435+e6daf39f.noarch


I can connect via dsidm:


[root@radius-389-test ~]# dsidm radius-389-test user list
demo_user
[root@radius-389-test ~]# dsidm radius-389-test user get demo_user
dn: uid=demo_user,ou=people,dc=radius,dc=example,dc=org
cn: Demo User
displayName: Demo User
gidNumber: 99998
homeDirectory: /var/empty
legalName: Demo User Name
loginShell: /bin/false
objectClass: top
objectClass: nsPerson
objectClass: nsAccount
objectClass: nsOrgPerson
objectClass: posixAccount
uid: demo_user
uidNumber: 99998



However, I can't seem to connect to the server via ldapsearch or with 
Apache Directory Studio.


[root@radius-389-test ~]# ldapsearch -v -H 
"ldapi://%%2fvar%%2frun%%2fslapd-radius-389-test.socket" -b 
"ou=people,dc=radius,example,dc=org" -D "cn=Directory Manager" -x -W 
uid=demo_user
ldap_initialize( ldapi:///??base )
Enter LDAP Password:
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
[root@radius-389-test ~]# ldapsearch -v -H "ldap://127.0.0.1" -b 
"ou=people,dc=radius,example,dc=org" -D "cn=Directory Manager" -x -W 
uid=demo_userldap_initialize( ldap://127.0.0.1:389/??base )
Enter LDAP Password:
ldap_bind: Invalid credentials (49)
	additional info: Invalid credentials



This is the inf-file:

[general]
full_machine_name = radius-389-test.example.org
[slapd]
instance_name = radius-389-test
root_password = random
[backend-userroot]
create_suffix_entry = True
sample_entries = yes
suffix = dc=radius,dc=example,dc=org


What am I doing wrong?

[Mark Reynolds]

On 9/18/20 11:18 AM, rainer(a)ultra-secure.de wrote:
>  Hi,
>
>  I've installed the latest version on CentOS 8
>
>
>  https://directory.fedoraproject.org/docs/389ds/howto/quickstart.html
>
>
>
>  [root@radius-389-test ~]# rpm -qa |grep 389 |sort
>  389-ds-base-1.4.2.16-1.module_el8+9435+e6daf39f.x86_64
>  389-ds-base-libs-1.4.2.16-1.module_el8+9435+e6daf39f.x86_64
>  cockpit-389-ds-1.4.2.16-1.module_el8+9435+e6daf39f.noarch
>  python3-lib389-1.4.2.16-1.module_el8+9435+e6daf39f.noarch
>
>
>  I can connect via dsidm:
>
>
>  [root@radius-389-test ~]# dsidm radius-389-test user list
>  demo_user
>  [root@radius-389-test ~]# dsidm radius-389-test user get demo_user
>  dn: uid=demo_user,ou=people,dc=radius,dc=example,dc=org
>  cn: Demo User
>  displayName: Demo User
>  gidNumber: 99998
>  homeDirectory: /var/empty
>  legalName: Demo User Name
>  loginShell: /bin/false
>  objectClass: top
>  objectClass: nsPerson
>  objectClass: nsAccount
>  objectClass: nsOrgPerson
>  objectClass: posixAccount
>  uid: demo_user
>  uidNumber: 99998
>
>
>
>  However, I can't seem to connect to the server via ldapsearch or with 
>  Apache Directory Studio.
>
>
>  [root@radius-389-test ~]# ldapsearch -v -H 
>  "ldapi://%%2fvar%%2frun%%2fslapd-radius-389-test.socket" -b 
>  "ou=people,dc=radius,example,dc=org" -D "cn=Directory Manager" -x -W
>
>  uid=demo_user
>  ldap_initialize( ldapi:///??base )
>  Enter LDAP Password:
>  ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
>  [root@radius-389-test ~]# ldapsearch -v -H "ldap://127.0.0.1" -b 
>  "ou=people,dc=radius,example,dc=org" -D "cn=Directory Manager" -x -W
>
>  uid=demo_userldap_initialize( ldap://127.0.0.1:389/??base )
>  Enter LDAP Password:
>  ldap_bind: Invalid credentials (49)
>      additional info: Invalid credentials 
This means you used the wrong password, you need to use whatever was set 
for "root_password" in the INF file.  But it wouldn't hurt to check the 
access log for "err=49" and it will give you the exact reason for the 
failure (most likely bad password, but we'll see)...

HTH,

Mark

>  This is the inf-file:
>
>  [general]
>  full_machine_name = radius-389-test.example.org
>  [slapd]
>  instance_name = radius-389-test
>  root_password = random
>  [backend-userroot]
>  create_suffix_entry = True
>  sample_entries = yes
>  suffix = dc=radius,dc=example,dc=org
>
>
>  What am I doing wrong?
>
>
>
>
>
>
>
>
>
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]... 
-- 

389 Directory Server Development Team

Am 2020-09-18 22:33, schrieb Mark Reynolds:

>  
>  This means you used the wrong password, you need to use whatever was
>  set for "root_password" in the INF file.  But it wouldn't hurt to
>  check the access log for "err=49" and it will give you the exact
>  reason for the failure (most likely bad password, but we'll see)... 



Hi Mark,

I checked and the password is correct.

There's also no space at the end or anything "special".

I'm cutting and pasting it as it is.

I've also tried just letting it choose the default password.


LDAPTLS_REQCERT=never ldapsearch -v -H "ldaps://127.0.0.1" -b 
"ou=people,dc=radius,example,dc=org" -D "cn=Directory Manager" -x -W 
uid=demo


The log says

[21/Sep/2020:11:08:49.098113115 +0200] conn=8 fd=64 slot=64 SSL 
connection from 127.0.0.1 to 127.0.0.1
[21/Sep/2020:11:08:49.112684656 +0200] conn=8 TLS1.3 128-bit AES-GCM
[21/Sep/2020:11:08:49.112748221 +0200] conn=8 op=0 BIND dn="cn=Directory 
Manager" method=128 version=3
[21/Sep/2020:11:08:49.112851150 +0200] conn=8 op=0 RESULT err=49 tag=97 
nentries=0 wtime=0.014598292 optime=0.000112993 etime=0.014709096 - 
Invalid credentials
[21/Sep/2020:11:08:49.114878267 +0200] conn=8 op=1 UNBIND
[21/Sep/2020:11:08:49.114889967 +0200] conn=8 op=1 fd=64 closed - U1


Do you see any obvious error in the INF-file?




Best Regards
Rainer

Am 2020-09-21 11:14, schrieb rainer(a)ultra-secure.de:
>  Am 2020-09-18 22:33, schrieb Mark Reynolds:
>  
> > 
> > This means you used the wrong password, you need to use whatever was
> > set for "root_password" in the INF file.  But it wouldn't hurt to
> > check the access log for "err=49" and it will give you the exact
> > reason for the failure (most likely bad password, but we'll see)...
>  
>  
>  
>  
>  Hi Mark,
>  
>  I checked and the password is correct.
>  
>  There's also no space at the end or anything "special".
>  
>  I'm cutting and pasting it as it is.
>  
>  I've also tried just letting it choose the default password.
>  
>  
>  LDAPTLS_REQCERT=never ldapsearch -v -H "ldaps://127.0.0.1" -b
>  "ou=people,dc=radius,example,dc=org" -D "cn=Directory Manager" -x -W
>  uid=demo 

Maybe using dc=example instead of just example might be a good start...

[Mark Reynolds]

On 9/21/20 5:14 AM, rainer(a)ultra-secure.de wrote:
>  Am 2020-09-18 22:33, schrieb Mark Reynolds:
>
> >
> > This means you used the wrong password, you need to use whatever was
> > set for "root_password" in the INF file.  But it wouldn't hurt to
> > check the access log for "err=49" and it will give you the exact
> > reason for the failure (most likely bad password, but we'll see)...
>
>
>
>
>  Hi Mark,
>
>  I checked and the password is correct.
>
>  There's also no space at the end or anything "special".
>
>  I'm cutting and pasting it as it is.
>
>  I've also tried just letting it choose the default password.
>
>
>  LDAPTLS_REQCERT=never ldapsearch -v -H "ldaps://127.0.0.1" -b 
>  "ou=people,dc=radius,example,dc=org" -D "cn=Directory Manager" -x -W
>
>  uid=demo
>
>
>  The log says
>
>  [21/Sep/2020:11:08:49.098113115 +0200] conn=8 fd=64 slot=64 SSL 
>  connection from 127.0.0.1 to 127.0.0.1
>  [21/Sep/2020:11:08:49.112684656 +0200] conn=8 TLS1.3 128-bit AES-GCM
>  [21/Sep/2020:11:08:49.112748221 +0200] conn=8 op=0 BIND 
>  dn="cn=Directory Manager" method=128 version=3
>  [21/Sep/2020:11:08:49.112851150 +0200] conn=8 op=0 RESULT err=49 
>  tag=97 nentries=0 wtime=0.014598292 optime=0.000112993 
>  etime=0.014709096 - Invalid credentials 
Sorry this means you ARE using the wrong password.  You can try 
resetting the password:

https://www.port389.org/docs/389ds/howto/howto-resetdirmgrpassword.html

HTH,

Mark

>  Best Regards
>  Rainer
>  _______________________________________________
>  389-users mailing list -- 389-users(a)lists.fedoraproject.org
>  To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: 
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives: 
>  https://lists.fedoraproject.org/archives/list/[e-mail]... 
-- 

389 Directory Server Development Team