11:23 p.m.
From the examples I've found, there seems to be "just
something
missing"(tm) in them. Someone please direct me to "something
that just
works."(tm) as it's making me blind, crazy, old and cranky. Ric
--
================================================
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
Linux user# 44256 Sign up at: http://counter.li.org/
http://www.sourceforge.net/projects/oar
http://www.wayward4now.net <---down4now too
================================================
11:30 p.m.
Ric Moore wrote:
>From the examples I've found, there seems to be "just
something
missing"(tm) in them. Someone please direct me to "something that just
works."(tm) as it's making me blind, crazy, old and cranky. Ric
Maybe you could start by tell folks what you need/want? I think your
request is way to general. I know you are blind, crazy, and cranky...but
stop and think for a moment.
6:26 p.m.
On Wed, 2008-01-09 at 17:31 -0600, Les Mikesell wrote:
Craig White wrote:
>
> LDAP is simply a set of protocols.
So is X. It makes as much sense to make an LDAP server default to doing
nothing as it would to present a grey X frame when you log in.
----
I'm not certain where you're going with this.
----
> There is no set usage for doing
> anything at all. In fact, what it was designed to do represents an
> insignificant percentage of its current actual usage.
But there are clients in the distribution that expect certain configuration.
----
but there is no 'certain configuration' unless you are running Windows
clients and Windows LDAP server. Perhaps that is what you want.
----
> You seem to think that there should be some pre-configuration
performed.
> Describe it then. If you could describe it, you could bugzilla an RFE.
> We might have something to actually discuss.
What did you do to make it so fedora clients could authenticate to the
server? I'd want that, plus samba authentication for the same set of
users with the same passwords - and if Macs work with the same config,
so much the better. Would it break anything to ship with the schema you
are using as the default?
----
First off, there is no Red Hat tool capable of providing a single
password for both Posix and Windows users (userPassword and
sambaNTPassword)...at least not that I am aware of. Out of the box, you
cannot get what you want from Fedora/Red Hat.
Secondly, just from the point of picking the basedn, there is no
prescribed way. The first configuration detail, you got a big problem.
Thirdly, there is absolutely no schema for Macs that I am aware of that
is available from anywhere but Apple. The way schema's work is that the
LDAP server comes with their basic schema files and then you can add the
samba schema (from samba packages), any address book client schema that
you choose and any other schema that suits your purpose. For example,
Horde/IMP has the option for you to store user prefs in LDAP...that of
course requires a schema. They also have a schema for each user's
free/busy calendars.
Fourthly, you'd have to figure out your Certificate Authority and
distribute that to all the clients (unless you want clients doing
authentication across the LAN unencrypted). I'm sure you're not
suggesting that each computer with Fedora installed merely accept the
default certificate.
Fifthly, are you using SASL, kerberos, TLS, SSL? How can you standardize
when there isn't a standard methodology?
Sixthly, are you using programs that are only capable of communicating
with LDAPv2? Must we enable? Are you allowing anonymous binds?
Seventhly, which users are allowed to see which attributes? Are you
going to use rootbinddn for everything? Doesn't it make sense to have a
less than all powerful 'root' user to attach to
samba/postfix/cyrus/etc?
Lastly, you are assuming that the point of LDAP is authentication which
was not what it was designed to do. They recently added things like
password policy to openldap and fedora but neither is fully mature. LDAP
authentication is hardly a mature product. There is absolutely no
standardization whatsoever and if Red Hat actually declared that there
was a Red Hat way, I'd hate to see the shitstorm over that.
I think your energies would be better spent railing because Fedora / Red
Hat scripts don't provide automatic backup, checkpoints, etc. because
the LDAP data is much more fragile than /etc/passwd (actually, I'm
speaking of OpenLDAP because I believe that Fedora-DS actually does).
----
>>> Again, if you think something is wrong with the way they
distributing
>>> the software, bugzilla an RFE
>> Having made it work, you are the expert... Do you think it could be
>> done better? Or is there some reason that the configuration used in one
>> place can't work in another?
> ----
> I'm happy with the way it is, otherwise I would have filed an RFE
How long did it take to get it to where you were happy with it, and why
is it necessary for everyone to repeat that process?
----
It isn't necessary at all. You can buy Windows and have it their way. If
you want to make an omelet, you have to break some eggs.
Took me several weeks before I could trust myself and thus a network
that relied upon me to troubleshoot/maintain it.
LDAP really requires flexibility, not the rigidity that you think it
needs. If you jump into a package like OGO (OpenGroupware), you are
going to have to conform to their way or be prepared to severely adapt.
Who knows what each installation is trying to accomplish?
Your statements presuppose that there is a correct way to do these
things...there isn't. Again, it's an erector set and it's just one of
many pieces for authentication which probably also include
installation/configuration of padl stuff, kerberos, SASL, SSL, and so
much else. Each setup is unique.
Craig
8:35 p.m.
On Thu, 2008-01-10 at 08:53 +0800, Ed Greshko wrote:
Craig White wrote:
> ----
> I'm not certain where you're going with this.
> ----
Actually, I'm just wondering if Ric ever got his ldap server up and running.
----
you already know the answer to that
----
He was "blind, crazy, old and cranky" at the start of this thread.
----
but he didn't just get there.
----
I can't
begin to imagine his state of mind by now.
----
I try not ever to go there myself
----
He stopped by and asked for
directions and a discussion erupted about GPS and what is the best map
projection technique and why you can't there from here. :-) :-) :-)
Ramble on....
----
thanks, I was worried that we didn't have permission for me to
counterpoint all of Les's anti Fedora/Red Hat attitudes. It's a tough
job but not without its rewards, feel free to relieve me at any point.
Craig
8:32 p.m.
Les Mikesell:
> Is there some reason that there isn't a standard schema
shipped with the
> server that supplies what the clients in the distribution expect?
Craig White:
If I understand your term 'clients' to mean an address book
client like
Kontact, I would venture to guess that Kontact like Evolution and all
other address book clients each has their own schema. If you are
decrying that all of the various address book clients all have differing
notions about schema's, then you should take that up with them.
I would think that Les was thinking what I was: If you supply a
distribution with specific LDAP and mail software, that you'd also
supply the bits that allowed them to work together, particularly your
flagship products.
e.g. Configurations to suit using LDAP with Evolution, kmail,
Thunderbird, etc.
You can't really expect Evolution, et al, to supply it, because they
don't know what LDAP server you've included.
--
[tim@bigblack ~]$ uname -ipr
2.6.23.12-52.fc7 i686 i386
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
8:34 a.m.
On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
Brian Millett wrote:
> I have a file of names, phone numbers, etc. that has the following format
> that is used at my work:
> Name|Email|Ext.|Home #|Cellular #|Pager|Title
>
> sample data:
>
> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of Technology
> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
>
>
>
> I wrote a perl script to parse this and put it into a valid ldif format:
Thanks for your script, which I shall study.
But one problem with setting up an address book in this way
is that there seems to be no standard LDAP format for addresses,
and an email client probably will not understand a particular format.
For example, I use kmail, which claims to understand LDAP.
But if you export your kmail (or kaddressbook) list in LDIF format
it is more of less useless for putting on an openldap server.
As far as I can see, the only reasonably general format for this is vCard
(which is more or less what kmail uses)
but there doesn't seem to be any standard way
of translating vCard to LDAP (or LDIF) format.
It's amazing to me that there is not a standard way
of putting an address book on an openldap server
which can be understood by all email clients
since this seems to be the major use of openldap.
But I am far from expert in this subject;
perhaps I have misunderstood the situation?
----
On Fedora (I think, for certain on RHEL), the openldap-servers comes
with many 'migration' scripts from padl that can take static file
entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
migrate them into an LDIF which you can then import. Their scripts are
very, very good and should be the basis for anyone looking to migrate to
LDAP.
Address Book clients such as Kontact (which is what Kmail would use), or
Thunderbird, Evolution, Outlook, etc. all have differing notions of
which attributes LDAP should offer. Let me repeat this another
way...THERE ARE NO STANDARDS for attributes that Address Book client
applications will use. This can be viewed as a negative or a positive.
Positive because you can support a variety of address book clients in a
variety of ways. Negative because if you don't know what you're doing,
it's confusing.
Therefore, whatever any program exports as an LDIF will differ from each
other program and it's up to the 'administrator' to do find/replace for
the attributes that they intend to use on the LDAP server...the only
other way is the Microsoft way which is prescribed. Once you absorb the
methodology, it becomes clear that the Microsoft way is limiting.
Craig
6:51 a.m.
On Thu, 2008-01-10 at 12:33 +0000, Timothy Murphy wrote:
Craig White wrote:
> MOST e-mail address book 'clients' are actually read-only clients and
> don't make any attempt to have write access. Evolution is capable of
> writing to LDAP address books and I believe that Kontact (KaddressBook)
> can now also 'write' to LDAP address books.
How exactly can one use KAddressBook in this way?
Does anyone know?
I assume you are saying that KAddressBook
can talk to an openLDAP server?
----
I use it as a 'read' client - sets up the same as any other LDAP address
book client and yes, it works fine with any LDAP v2 or LDAP v3 server.
It does appear to have 'write' abilities to LDAP. I can't find any
suitable schema which means that it has surely has attributes that can't
be saved to LDAP.
Craig
5:25 a.m.
On Thu, 2008-01-10 at 00:35 -0600, Les Mikesell wrote:
Craig White wrote:
> thanks, I was worried that we didn't have permission for me to
> counterpoint all of Les's anti Fedora/Red Hat attitudes.
I don't have a particularly anti Fedora/Red Hat attitude. I am just
against shipping things that don't work and making it unnecessarily
difficult to add the parts that can fix it. And your replies about how
you have been able to find instructions elsewhere and make things work
anyway with great amounts of effort that every user will have to repeat
aren't exactly counterpoints.
----
with respect to LDAP...
I would submit that it's merely because you don't understand what the
technology offers and how it accomplishes its tasks that is the problem.
Fedora is not a turnkey distribution but perhaps a respin would do
exactly what you are looking for.
With respect to Sun's Java...
It would appear that the Fedora package managers have decided not to
include the Sun java package because of license restrictions. If they
were to apply the same standards with all software, by permitting Sun's
restricted licensed java, they would open the flood gates. RHEL
packagers have a different beast to satisfy...the corporate user and
they obviously relented. You know why CentOS packagers won't include
java.
With respect to LDAP and finding instructions elsewhere...
It is a bitch but the reality simply is, there is no one way to do
anything at all with LDAP. The information flow on first glance appears
to be even worse than you know...try asking how to integrate SASL into
OpenLDAP on OpenLDAP-software mailing list and you'll be told that it's
off topic and to go elsewhere. OpenLDAP developers provide a tool that
meets (as best as possible), various RFC's concerning LDAP and those
RFC's have been fluid, not static. They are unconcerned with specific
application as their mail list makes clear.
If you want to see the complexity of it, merely look to Brennan's Home
Networking Guide for a shared LDAP Address Book...
http://www.brennan.id.au/20-Shared_Address_Book_LDAP.html
of course this is his way and I expect that it works. I didn't use it,
didn't audit it for accuracy but have a lot of confidence in his
efforts. The problem is that I am not sure that following Betty
Crocker's recipes makes you a cook. I believe the adage is that if you
give a man a fish, you feed him for a day but if you teach him how to
fish, he can eat for the rest of his life. You just need to learn how to
fish.
I can only wonder what the length of description and amount of time it
would take to do similar for LDAP authentication but in the end, it
would still represent only one way to do LDAP authentication.
Craig
10:56 p.m.
On Wed, 2008-01-09 at 23:25 -0500, Ric Moore wrote:
On Wed, 2008-01-09 at 10:40 -0700, Craig White wrote:
> On Wed, 2008-01-09 at 11:15 -0600, Les Mikesell wrote:
> > Craig White wrote:
> >
> > > His confusion is very common...I admit that I too was confused by that
> > > very notion when I first started mucking with LDAP. One would think that
> > > if you use say OpenOffice to save say Test.DOC that Microsoft Word
> > > should be able to open that file [1]. Likewise, since LDIF is the world
> > > of LDAP, shouldn't one expect that an LDIF file exported by Kontact
be
> > > usable with openldap?
> >
> > Is there some reason that there isn't a standard schema shipped with the
> > server that supplies what the clients in the distribution expect?
> ----
> If I understand your term 'clients' to mean an address book client like
> Kontact, I would venture to guess that Kontact like Evolution and all
> other address book clients each has their own schema. If you are
> decrying that all of the various address book clients all have differing
> notions about schema's, then you should take that up with them.
>
> Most, if not all LDAP implementations include an inetOrgPerson schema
> that is consistent because this is part of an RFC. Each of the address
> book clients that I have looked at, use attributes that go beyond the
> inetOrgPerson schema and that is what is really being discussed.
>
> Now if you are referring to something other than address book 'clients',
> then you will have to be more specific.
My own pre-conceived notion was this. I use Kaddressbook for our 1,500
contacts. I use Evolution for my pop-email account with gmail and am
interested in getting everything talking to each other and my Windows
using boss. I send him the addressbook.csv master file, then he tells me
that he's added shit to it, and it all goes to hell. I have not been
able to just import his edited copy without a ton of duplicates.
So, hosting an ldap server, in my mind, would allow him to just add to
the addressbook hosted here. Am I far off base in my expectations?? NOW
he wants a comma delimited file of just the email addresses, so he can
hit return and send one massive email spew to everyone on the list.
Back when I had a list like that and in /etc/aliases I could just note
the group to the file name and sendmail pounded out the emails. We're
talking about 8 years ago. Guess how much I remember? <grins>
So, all personal data in kaddressbook, I might handle the group emails
from Evolution or not, or crank up sendmail or procmail to handle the
mass mailings if I can coax out the email addresses, OR learn something
new that I don't know. I took some time off away from Linux and the gap
in what I knew then and what is there now is pretty significant. Thanks
for your patience. Ric
----
MOST e-mail address book 'clients' are actually read-only clients and
don't make any attempt to have write access. Evolution is capable of
writing to LDAP address books and I believe that Kontact (KaddressBook)
can now also 'write' to LDAP address books.
That said, if you try to use either program, beyond the most basic
attributes, each of the various programs you mentioned (evolution,
kaddressbook, and whatever boss uses) would have different concepts of
extended attributes beyond the basic inetOrgPerson and thus, would offer
their own schema which makes supporting more than one specific address
book client extremely difficult.
here is a schema for Mozilla (Thunderbird/SeaMonkey)
http://wiki.mozilla.org/MailNews:Mozilla_LDAP_Address_Book_Schema
googling for kaddressbook schema turned up a bunch of empty holes but I
am not going to spend much time on it...perhaps the Kolab schema is
appropriate, I just don't know but perhaps Rex has an idea.
This is an exhaustive, complicated but interesting concept on how to
handle Outlook and Thunderbird users...
http://www.yolinux.com/TUTORIALS/LinuxTutorialLDAP-GILSchemaExtension.html
Evolution has it's own schema and I think Tim can tell you how to find
it.
I typically install horde/imp/kronolith/ingo/turba which is a web based
mail/mail filtering/shared calendars/shared address books solution and
it actually is a very cool LDAP client which not only provides
reasonable web based LDAP addressbook editing, it also imports CSV into
LDAP, thereby saving you from the pain of converting from a csv file
into an ldif. Of course this adds a whole new layer of complexity to the
solution but it has a big payoff at the end because you get a workgroup
collaboration software system (shared tasks, shared calendars, shared
address books and even shared mail if you have a system like cyrus which
has an ACL methodology to share mailboxes).
That said, it's highly doubtful that you can use any mail program that
you are thinking of to send more than an e-mail to more than 50 people
because that typically isn't permitted. If the intent is to do e-mail
blasting/bulk e-mailing, it's only reasonable to use a program designed
for that purpose because not only will it queue e-mails one at a time,
it should also be able to encode the recipient in a manner that can
automate handling of e-mail rejections, opt-out (consider the Can-SPAM
act or whatever it's called) and have contact management built-in.
Generally, you would want some methodology to automatically handle
bounces, redeliveries, etc. This is a lot more complicated than you
think it is.
Craig
10:45 p.m.
On Thu, 2008-01-10 at 08:53 +0800, Ed Greshko wrote:
Craig White wrote:
> ----
> I'm not certain where you're going with this.
> ----
Actually, I'm just wondering if Ric ever got his ldap server up and running.
He was "blind, crazy, old and cranky" at the start of this thread. I can't
begin to imagine his state of mind by now. He stopped by and asked for
directions and a discussion erupted about GPS and what is the best map
projection technique and why you can't there from here. :-) :-) :-)
I've already gone blind, crazy is in it's early stages of onset, old
just happens by the minute, and cranky? No, I've gone numb. The bit
about adding users "could" be shortened if you could just use the
existing passwd file, but I realize that not everyone in my "users" need
have access to ldap. So, that doesn't happen by design. I grok that.
<sigh> I'd rather have a nice big fat GUI with a vertical list of users,
and a column of check-boxes titled LDAP and just by ticking off the
boxes with the mouse, users would be added. <cackles> Yeah, too much
like Windows.
I do enjoy the interchanges between Les and Craig as it proves Karl Marx
right. "Thesis versus Antithesis equals Synthesis". Somewhere between
the two, something useful may emerge. "The truth is out there" and so is
the ultimate "Right Thing(tm)". Now, I'll nip off and start with step 8
and see how it goes. Thanks to everyone, this is a lively
thought-provoking thread. Ric
--
================================================
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
Linux user# 44256 Sign up at: http://counter.li.org/
http://www.sourceforge.net/projects/oar
http://www.wayward4now.net <---down4now too
================================================
10:25 p.m.
On Wed, 2008-01-09 at 10:40 -0700, Craig White wrote:
On Wed, 2008-01-09 at 11:15 -0600, Les Mikesell wrote:
> Craig White wrote:
>
> > His confusion is very common...I admit that I too was confused by that
> > very notion when I first started mucking with LDAP. One would think that
> > if you use say OpenOffice to save say Test.DOC that Microsoft Word
> > should be able to open that file [1]. Likewise, since LDIF is the world
> > of LDAP, shouldn't one expect that an LDIF file exported by Kontact be
> > usable with openldap?
>
> Is there some reason that there isn't a standard schema shipped with the
> server that supplies what the clients in the distribution expect?
----
If I understand your term 'clients' to mean an address book client like
Kontact, I would venture to guess that Kontact like Evolution and all
other address book clients each has their own schema. If you are
decrying that all of the various address book clients all have differing
notions about schema's, then you should take that up with them.
Most, if not all LDAP implementations include an inetOrgPerson schema
that is consistent because this is part of an RFC. Each of the address
book clients that I have looked at, use attributes that go beyond the
inetOrgPerson schema and that is what is really being discussed.
Now if you are referring to something other than address book 'clients',
then you will have to be more specific.
My own pre-conceived notion was this. I use Kaddressbook for our 1,500
contacts. I use Evolution for my pop-email account with gmail and am
interested in getting everything talking to each other and my Windows
using boss. I send him the addressbook.csv master file, then he tells me
that he's added shit to it, and it all goes to hell. I have not been
able to just import his edited copy without a ton of duplicates.
So, hosting an ldap server, in my mind, would allow him to just add to
the addressbook hosted here. Am I far off base in my expectations?? NOW
he wants a comma delimited file of just the email addresses, so he can
hit return and send one massive email spew to everyone on the list.
Back when I had a list like that and in /etc/aliases I could just note
the group to the file name and sendmail pounded out the emails. We're
talking about 8 years ago. Guess how much I remember? <grins>
So, all personal data in kaddressbook, I might handle the group emails
from Evolution or not, or crank up sendmail or procmail to handle the
mass mailings if I can coax out the email addresses, OR learn something
new that I don't know. I took some time off away from Linux and the gap
in what I knew then and what is there now is pretty significant. Thanks
for your patience. Ric
--
================================================
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
Linux user# 44256 Sign up at: http://counter.li.org/
http://www.sourceforge.net/projects/oar
http://www.wayward4now.net <---down4now too
================================================
10:20 p.m.
On Wed, 2008-01-09 at 23:10 -0500, Ric Moore wrote:
On Wed, 2008-01-09 at 22:39 +0800, Ed Greshko wrote:
> Craig White wrote:
> > On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
> >> Brian Millett wrote:
> >>
> >>> I have a file of names, phone numbers, etc. that has the following
format
> >>> that is used at my work:
> >>> Name|Email|Ext.|Home #|Cellular #|Pager|Title
> >>>
> >>> sample data:
> >>>
> >>> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of
Technology
> >>> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
> >>>
> >>>
> >>>
> >>> I wrote a perl script to parse this and put it into a valid ldif
format:
> >> Thanks for your script, which I shall study.
> >>
> >> But one problem with setting up an address book in this way
> >> is that there seems to be no standard LDAP format for addresses,
> >> and an email client probably will not understand a particular format.
> >>
> >> For example, I use kmail, which claims to understand LDAP.
> >> But if you export your kmail (or kaddressbook) list in LDIF format
> >> it is more of less useless for putting on an openldap server.
> >>
> >> As far as I can see, the only reasonably general format for this is vCard
> >> (which is more or less what kmail uses)
> >> but there doesn't seem to be any standard way
> >> of translating vCard to LDAP (or LDIF) format.
> >>
> >> It's amazing to me that there is not a standard way
> >> of putting an address book on an openldap server
> >> which can be understood by all email clients
> >> since this seems to be the major use of openldap.
> >>
> >> But I am far from expert in this subject;
> >> perhaps I have misunderstood the situation?
> > ----
> > On Fedora (I think, for certain on RHEL), the openldap-servers comes
> > with many 'migration' scripts from padl that can take static file
> > entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
> > migrate them into an LDIF which you can then import. Their scripts are
> > very, very good and should be the basis for anyone looking to migrate to
> > LDAP.
> >
> > Address Book clients such as Kontact (which is what Kmail would use), or
> > Thunderbird, Evolution, Outlook, etc. all have differing notions of
> > which attributes LDAP should offer. Let me repeat this another
> > way...THERE ARE NO STANDARDS for attributes that Address Book client
> > applications will use. This can be viewed as a negative or a positive.
> > Positive because you can support a variety of address book clients in a
> > variety of ways. Negative because if you don't know what you're doing,
> > it's confusing.
> >
> > Therefore, whatever any program exports as an LDIF will differ from each
> > other program and it's up to the 'administrator' to do find/replace
for
> > the attributes that they intend to use on the LDAP server...the only
> > other way is the Microsoft way which is prescribed. Once you absorb the
> > methodology, it becomes clear that the Microsoft way is limiting.
>
> Funny.... I knew that Ric's extremely general question was going to fan out
> to be much more than he thought he was asking......
Good lord, you got that one right!
>
> I'd dump all that I know about ldap here....but it would take me too long to
> type it all and maybe never answer the question that Ric thinks he is
> asking. :-)
It looks like it'll take a pile of answers to figure out the question.
Several of the sites that I followed seemed to work, until it blew up.
The next example paragraph, in the how-to noted a successful completion
and I got a spew of error code.
I got some sort of IQ and darn good SAT scores, and I know sure as hell
that I can follow a blooming script. So, I tried another site which gave
"slightly" different instructions and it blew up. I knew from the get-go
that I was over my head, so I was very careful to go step-by-step.
Since I have the step-by-step from the horse's mouth, I hope to achieve
success, especially when Ed did it in 3 minutes!! I'll report
back ...after I find a toothpick to remove the carpet from my teeth.
----
Ed's smarter than most of us. It took me a few weeks but I was trying to
get samba included - actually a vampire (import - suck the blood) of an
existing Windows domain controller to be the part of the initial wave so
I made it hard on myself.
I found the answer to be, LDAP System Administration by Gerald Carter.
It's getting old, long in the tooth (it actually uses ldbm which has
long been deprecated), but it made perfectly good sense.
Craig
10:10 p.m.
On Wed, 2008-01-09 at 22:39 +0800, Ed Greshko wrote:
Craig White wrote:
> On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
>> Brian Millett wrote:
>>
>>> I have a file of names, phone numbers, etc. that has the following format
>>> that is used at my work:
>>> Name|Email|Ext.|Home #|Cellular #|Pager|Title
>>>
>>> sample data:
>>>
>>> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of Technology
>>> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
>>>
>>>
>>>
>>> I wrote a perl script to parse this and put it into a valid ldif format:
>> Thanks for your script, which I shall study.
>>
>> But one problem with setting up an address book in this way
>> is that there seems to be no standard LDAP format for addresses,
>> and an email client probably will not understand a particular format.
>>
>> For example, I use kmail, which claims to understand LDAP.
>> But if you export your kmail (or kaddressbook) list in LDIF format
>> it is more of less useless for putting on an openldap server.
>>
>> As far as I can see, the only reasonably general format for this is vCard
>> (which is more or less what kmail uses)
>> but there doesn't seem to be any standard way
>> of translating vCard to LDAP (or LDIF) format.
>>
>> It's amazing to me that there is not a standard way
>> of putting an address book on an openldap server
>> which can be understood by all email clients
>> since this seems to be the major use of openldap.
>>
>> But I am far from expert in this subject;
>> perhaps I have misunderstood the situation?
> ----
> On Fedora (I think, for certain on RHEL), the openldap-servers comes
> with many 'migration' scripts from padl that can take static file
> entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
> migrate them into an LDIF which you can then import. Their scripts are
> very, very good and should be the basis for anyone looking to migrate to
> LDAP.
>
> Address Book clients such as Kontact (which is what Kmail would use), or
> Thunderbird, Evolution, Outlook, etc. all have differing notions of
> which attributes LDAP should offer. Let me repeat this another
> way...THERE ARE NO STANDARDS for attributes that Address Book client
> applications will use. This can be viewed as a negative or a positive.
> Positive because you can support a variety of address book clients in a
> variety of ways. Negative because if you don't know what you're doing,
> it's confusing.
>
> Therefore, whatever any program exports as an LDIF will differ from each
> other program and it's up to the 'administrator' to do find/replace for
> the attributes that they intend to use on the LDAP server...the only
> other way is the Microsoft way which is prescribed. Once you absorb the
> methodology, it becomes clear that the Microsoft way is limiting.
Funny.... I knew that Ric's extremely general question was going to fan out
to be much more than he thought he was asking......
Good lord, you got that one right!
I'd dump all that I know about ldap here....but it would take me too long to
type it all and maybe never answer the question that Ric thinks he is
asking. :-)
It looks like it'll take a pile of answers to figure out the question.
Several of the sites that I followed seemed to work, until it blew up.
The next example paragraph, in the how-to noted a successful completion
and I got a spew of error code.
I got some sort of IQ and darn good SAT scores, and I know sure as hell
that I can follow a blooming script. So, I tried another site which gave
"slightly" different instructions and it blew up. I knew from the get-go
that I was over my head, so I was very careful to go step-by-step.
Since I have the step-by-step from the horse's mouth, I hope to achieve
success, especially when Ed did it in 3 minutes!! I'll report
back ...after I find a toothpick to remove the carpet from my teeth.
:) Ric
--
================================================
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
Linux user# 44256 Sign up at: http://counter.li.org/
http://www.sourceforge.net/projects/oar
http://www.wayward4now.net <---down4now too
================================================
3:04 p.m.
On Wed, 2008-01-09 at 14:44 -0600, Les Mikesell wrote:
Craig White wrote:
>>> ----
>>> coming from the guy who last week decried that it seemed the intent of
>>> Fedora was to be a self-contained distribution, this is extremely
>>> laughable.
>> You mean they have to complete the inclusion of every possible package
>> in the universe before making their own clients talk to their own
>> server? Otherwise I don't how this relates to anything. And is there
>> some reason not to expect 'Fedora Directory Server' to not be part of
>> ... Fedora?
> ----
> I suppose if that was an area of concern, I would be monitoring
> Fedora-development list
Without really knowing anything about it, I'll make a wild guess and
assume that it is somehow related to having a java component that
doesn't work with the broken imitation-java that fedora has insisted on
shipping for years. And rather than make it easy to install a compliant
java that another company has made available for free, they don't
include it at all. But I could be wrong about that...
----
you may be correct, I simply don't know. FDS does require java
IIRC...not to run but to use the GUI consoles provided. If they were
hell bent on distributing FDS with Fedora, they could probably remove
the GUI consoles. They could replace them with something else. Is that
what this is about? Another java rant?
----
> ----
>>> It is impossible to know where you are coming from.
>> I'd like something that works... Do you really prefer an LDAP
>> authentication client that won't work with the server as shipped in the
>> same distribution?
> ----
> do you mean that it's not working? I must be doing something wrong then
> because my main server (RHEL) is the base ldap server and it's handing
> the authentication for all the Macintosh, Windows and Linux computers on
> my LAN including the Fedora 7 & Fedora 8 clients.
>
> Does your question imply without configuration ("as shipped" reference)?
Yes, but it relates to not having matching configurations for clients
and servers as much as shipping one without configuration.
----
each of the networks that I have installed LDAP as an authentication
daemon has a vastly different setup including one where I am using FDS
instead of openldap (approximately 8).
LDAP is simply a set of protocols. There is no set usage for doing
anything at all. In fact, what it was designed to do represents an
insignificant percentage of its current actual usage.
The nice thing that is provided by RHEL and of course Fedora, is that
the tools that handle the various bits (i.e. padl and pam stuff) is well
handled and easily configured.
You seem to think that there should be some pre-configuration performed.
Describe it then. If you could describe it, you could bugzilla an RFE.
We might have something to actually discuss.
----
> Heck, not even Windows does that (Neither server nor client will
> operate/authenticate without configuration). Configuration details is
> what job security is about ;-)
>
> Again, if you think something is wrong with the way they distributing
> the software, bugzilla an RFE
Having made it work, you are the expert... Do you think it could be
done better? Or is there some reason that the configuration used in one
place can't work in another?
----
I'm happy with the way it is, otherwise I would have filed an RFE
Craig
2:15 p.m.
On Wed, 2008-01-09 at 14:01 -0600, Les Mikesell wrote:
Craig White wrote:
>
>>>>> I suppose if Fedora saw itself as providing a turnkey distribution
with
>>>>> a notion towards a specific, pre-determined configuration that
simply
>>>>> worked out of the box, that would occur.
>>>> So no one expects anyone to have more than one fedora box and need them
>>>> to share network authentication?
>>>>
>>>>> i.e., isn't that what your
>>>>> 'e-smith' distro (or whatever it is called) does?
>>>> I thought the point of using any packaged distribution was that its own
>>>> components would work together. E-smith (now SME server) just does a
>>>> kickstart install and provides a web interface that does all your
>>>> config-file editing for you with a few concepts combined - mostly geared
>>>> towards being server for windows boxes. It does provide an ldap setup
>>>> suitable for an outlook address book, but it can't authenticate
against
>>>> its own LDAP server let alone a different instance.
>>> ----
>>> perhaps you need to bugzilla an RFE
>> I guess I always expected 'Fedora Directory Server' to be part of Fedora
>> and come set up to work. Maybe I missed something obvious here...
> ----
> coming from the guy who last week decried that it seemed the intent of
> Fedora was to be a self-contained distribution, this is extremely
> laughable.
You mean they have to complete the inclusion of every possible package
in the universe before making their own clients talk to their own
server? Otherwise I don't how this relates to anything. And is there
some reason not to expect 'Fedora Directory Server' to not be part of
... Fedora?
----
I suppose if that was an area of concern, I would be monitoring
Fedora-development list
----
> It is impossible to know where you are coming from.
I'd like something that works... Do you really prefer an LDAP
authentication client that won't work with the server as shipped in the
same distribution?
----
do you mean that it's not working? I must be doing something wrong then
because my main server (RHEL) is the base ldap server and it's handing
the authentication for all the Macintosh, Windows and Linux computers on
my LAN including the Fedora 7 & Fedora 8 clients.
Does your question imply without configuration ("as shipped" reference)?
Heck, not even Windows does that (Neither server nor client will
operate/authenticate without configuration). Configuration details is
what job security is about ;-)
Again, if you think something is wrong with the way they distributing
the software, bugzilla an RFE
Craig
11:15 a.m.
Craig White wrote:
His confusion is very common...I admit that I too was confused by
that
very notion when I first started mucking with LDAP. One would think that
if you use say OpenOffice to save say Test.DOC that Microsoft Word
should be able to open that file [1]. Likewise, since LDIF is the world
of LDAP, shouldn't one expect that an LDIF file exported by Kontact be
usable with openldap?
Is there some reason that there isn't a standard schema shipped with the
server that supplies what the clients in the distribution expect?
--
Les Mikesell
lesmikesell(a)gmail.com
10:35 a.m.
On Wed, 2008-01-09 at 22:59 +0800, Ed Greshko wrote:
Craig White wrote:
> On Wed, 2008-01-09 at 22:49 +0800, Ed Greshko wrote:
>> Craig White wrote:
>>> On Wed, 2008-01-09 at 22:39 +0800, Ed Greshko wrote:
>>>> Craig White wrote:
>>>>> On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
>>>>>> Brian Millett wrote:
>>>>>>
>>>>>>> I have a file of names, phone numbers, etc. that has the
following format
>>>>>>> that is used at my work:
>>>>>>> Name|Email|Ext.|Home #|Cellular #|Pager|Title
>>>>>>>
>>>>>>> sample data:
>>>>>>>
>>>>>>> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director
of Technology
>>>>>>> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java
Developer
>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> I wrote a perl script to parse this and put it into a valid
ldif format:
>>>>>> Thanks for your script, which I shall study.
>>>>>>
>>>>>> But one problem with setting up an address book in this way
>>>>>> is that there seems to be no standard LDAP format for
addresses,
>>>>>> and an email client probably will not understand a particular
format.
>>>>>>
>>>>>> For example, I use kmail, which claims to understand LDAP.
>>>>>> But if you export your kmail (or kaddressbook) list in LDIF
format
>>>>>> it is more of less useless for putting on an openldap server.
>>>>>>
>>>>>> As far as I can see, the only reasonably general format for this
is vCard
>>>>>> (which is more or less what kmail uses)
>>>>>> but there doesn't seem to be any standard way
>>>>>> of translating vCard to LDAP (or LDIF) format.
>>>>>>
>>>>>> It's amazing to me that there is not a standard way
>>>>>> of putting an address book on an openldap server
>>>>>> which can be understood by all email clients
>>>>>> since this seems to be the major use of openldap.
>>>>>>
>>>>>> But I am far from expert in this subject;
>>>>>> perhaps I have misunderstood the situation?
>>>>> ----
>>>>> On Fedora (I think, for certain on RHEL), the openldap-servers
comes
>>>>> with many 'migration' scripts from padl that can take static
file
>>>>> entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
>>>>> migrate them into an LDIF which you can then import. Their scripts
are
>>>>> very, very good and should be the basis for anyone looking to
migrate to
>>>>> LDAP.
>>>>>
>>>>> Address Book clients such as Kontact (which is what Kmail would
use), or
>>>>> Thunderbird, Evolution, Outlook, etc. all have differing notions of
>>>>> which attributes LDAP should offer. Let me repeat this another
>>>>> way...THERE ARE NO STANDARDS for attributes that Address Book
client
>>>>> applications will use. This can be viewed as a negative or a
positive.
>>>>> Positive because you can support a variety of address book clients
in a
>>>>> variety of ways. Negative because if you don't know what
you're doing,
>>>>> it's confusing.
>>>>>
>>>>> Therefore, whatever any program exports as an LDIF will differ from
each
>>>>> other program and it's up to the 'administrator' to do
find/replace for
>>>>> the attributes that they intend to use on the LDAP server...the
only
>>>>> other way is the Microsoft way which is prescribed. Once you absorb
the
>>>>> methodology, it becomes clear that the Microsoft way is limiting.
>>>> Funny.... I knew that Ric's extremely general question was going to
fan out
>>>> to be much more than he thought he was asking......
>>>>
>>>> I'd dump all that I know about ldap here....but it would take me too
long to
>>>> type it all and maybe never answer the question that Ric thinks he is
>>>> asking. :-)
>>> ----
>>> lateral answer, I directed him to the Administrator's Guide on the
>>> OpenLDAP's website.
>>>
>>> This was simply a clarification on why different address book clients
>>> write different attributes in an exported LDIF file which probably will
>>> fail when you try to ldapadd/slapadd them into LDAP
>> Right....but he can't even get as far as getting an ldap server running.
>> Or, that is my take from his initial query. So, getting into depth about
>> what clients are expecting from the ldap server is putting the cart before
>> the horse....so to speak.
> ----
> hence my previous direction to Administrator Guide
>
> useless and unresponsive answers is not the exclusive domain of a select
> few.
Sorry...don't understand that cryptic message.
----
his question, you and I directed him to the openldap admin guide, mine
from openldap.org website and yours from huihoo.com website. These
answers seemed to be entirely responsive to OP.
the cryptic part I presume was your stating that you knew the answers
would be unresponsive to his needs but rather chase out into various
tangents which of course had already happened. This thread was proof of
that fact and I was remarking that it sometimes can't be helped. I only
sought to clarify the follow up to the now unresponsive (to OP) thread
because Timothy is trying to find out why in essence, Kmail (actually
Kontact) is exporting contacts into an LDIF that can't be imported into
LDAP server.
His confusion is very common...I admit that I too was confused by that
very notion when I first started mucking with LDAP. One would think that
if you use say OpenOffice to save say Test.DOC that Microsoft Word
should be able to open that file [1]. Likewise, since LDIF is the world
of LDAP, shouldn't one expect that an LDIF file exported by Kontact be
usable with openldap?
Of course all of this is entirely useless and unresponsive to OP's
original question.
Craig
[1] Another interesting tangent clearly not related to OP or follow-up,
Microsoft Office may not be able to open documents created by Microsoft
Office (or OpenOffice.org)...
http://www.news.com/Office-2003-update-blocks-older-file-formats/2100-101...
8:49 a.m.
Craig White wrote:
On Wed, 2008-01-09 at 22:39 +0800, Ed Greshko wrote:
> Craig White wrote:
>> On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
>>> Brian Millett wrote:
>>>
>>>> I have a file of names, phone numbers, etc. that has the following
format
>>>> that is used at my work:
>>>> Name|Email|Ext.|Home #|Cellular #|Pager|Title
>>>>
>>>> sample data:
>>>>
>>>> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of
Technology
>>>> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
>>>>
>>>>
>>>>
>>>> I wrote a perl script to parse this and put it into a valid ldif format:
>>> Thanks for your script, which I shall study.
>>>
>>> But one problem with setting up an address book in this way
>>> is that there seems to be no standard LDAP format for addresses,
>>> and an email client probably will not understand a particular format.
>>>
>>> For example, I use kmail, which claims to understand LDAP.
>>> But if you export your kmail (or kaddressbook) list in LDIF format
>>> it is more of less useless for putting on an openldap server.
>>>
>>> As far as I can see, the only reasonably general format for this is vCard
>>> (which is more or less what kmail uses)
>>> but there doesn't seem to be any standard way
>>> of translating vCard to LDAP (or LDIF) format.
>>>
>>> It's amazing to me that there is not a standard way
>>> of putting an address book on an openldap server
>>> which can be understood by all email clients
>>> since this seems to be the major use of openldap.
>>>
>>> But I am far from expert in this subject;
>>> perhaps I have misunderstood the situation?
>> ----
>> On Fedora (I think, for certain on RHEL), the openldap-servers comes
>> with many 'migration' scripts from padl that can take static file
>> entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
>> migrate them into an LDIF which you can then import. Their scripts are
>> very, very good and should be the basis for anyone looking to migrate to
>> LDAP.
>>
>> Address Book clients such as Kontact (which is what Kmail would use), or
>> Thunderbird, Evolution, Outlook, etc. all have differing notions of
>> which attributes LDAP should offer. Let me repeat this another
>> way...THERE ARE NO STANDARDS for attributes that Address Book client
>> applications will use. This can be viewed as a negative or a positive.
>> Positive because you can support a variety of address book clients in a
>> variety of ways. Negative because if you don't know what you're doing,
>> it's confusing.
>>
>> Therefore, whatever any program exports as an LDIF will differ from each
>> other program and it's up to the 'administrator' to do find/replace
for
>> the attributes that they intend to use on the LDAP server...the only
>> other way is the Microsoft way which is prescribed. Once you absorb the
>> methodology, it becomes clear that the Microsoft way is limiting.
> Funny.... I knew that Ric's extremely general question was going to fan out
> to be much more than he thought he was asking......
>
> I'd dump all that I know about ldap here....but it would take me too long to
> type it all and maybe never answer the question that Ric thinks he is
> asking. :-)
----
lateral answer, I directed him to the Administrator's Guide on the
OpenLDAP's website.
This was simply a clarification on why different address book clients
write different attributes in an exported LDIF file which probably will
fail when you try to ldapadd/slapadd them into LDAP
Right....but he can't even get as far as getting an ldap server running.
Or, that is my take from his initial query. So, getting into depth about
what clients are expecting from the ldap server is putting the cart before
the horse....so to speak.
8:45 a.m.
On Wed, 2008-01-09 at 22:39 +0800, Ed Greshko wrote:
Craig White wrote:
> On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
>> Brian Millett wrote:
>>
>>> I have a file of names, phone numbers, etc. that has the following format
>>> that is used at my work:
>>> Name|Email|Ext.|Home #|Cellular #|Pager|Title
>>>
>>> sample data:
>>>
>>> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of Technology
>>> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
>>>
>>>
>>>
>>> I wrote a perl script to parse this and put it into a valid ldif format:
>> Thanks for your script, which I shall study.
>>
>> But one problem with setting up an address book in this way
>> is that there seems to be no standard LDAP format for addresses,
>> and an email client probably will not understand a particular format.
>>
>> For example, I use kmail, which claims to understand LDAP.
>> But if you export your kmail (or kaddressbook) list in LDIF format
>> it is more of less useless for putting on an openldap server.
>>
>> As far as I can see, the only reasonably general format for this is vCard
>> (which is more or less what kmail uses)
>> but there doesn't seem to be any standard way
>> of translating vCard to LDAP (or LDIF) format.
>>
>> It's amazing to me that there is not a standard way
>> of putting an address book on an openldap server
>> which can be understood by all email clients
>> since this seems to be the major use of openldap.
>>
>> But I am far from expert in this subject;
>> perhaps I have misunderstood the situation?
> ----
> On Fedora (I think, for certain on RHEL), the openldap-servers comes
> with many 'migration' scripts from padl that can take static file
> entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
> migrate them into an LDIF which you can then import. Their scripts are
> very, very good and should be the basis for anyone looking to migrate to
> LDAP.
>
> Address Book clients such as Kontact (which is what Kmail would use), or
> Thunderbird, Evolution, Outlook, etc. all have differing notions of
> which attributes LDAP should offer. Let me repeat this another
> way...THERE ARE NO STANDARDS for attributes that Address Book client
> applications will use. This can be viewed as a negative or a positive.
> Positive because you can support a variety of address book clients in a
> variety of ways. Negative because if you don't know what you're doing,
> it's confusing.
>
> Therefore, whatever any program exports as an LDIF will differ from each
> other program and it's up to the 'administrator' to do find/replace for
> the attributes that they intend to use on the LDAP server...the only
> other way is the Microsoft way which is prescribed. Once you absorb the
> methodology, it becomes clear that the Microsoft way is limiting.
Funny.... I knew that Ric's extremely general question was going to fan out
to be much more than he thought he was asking......
I'd dump all that I know about ldap here....but it would take me too long to
type it all and maybe never answer the question that Ric thinks he is
asking. :-)
----
lateral answer, I directed him to the Administrator's Guide on the
OpenLDAP's website.
This was simply a clarification on why different address book clients
write different attributes in an exported LDIF file which probably will
fail when you try to ldapadd/slapadd them into LDAP
Craig
8:39 a.m.
Craig White wrote:
On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
> Brian Millett wrote:
>
>> I have a file of names, phone numbers, etc. that has the following format
>> that is used at my work:
>> Name|Email|Ext.|Home #|Cellular #|Pager|Title
>>
>> sample data:
>>
>> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of Technology
>> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
>>
>>
>>
>> I wrote a perl script to parse this and put it into a valid ldif format:
> Thanks for your script, which I shall study.
>
> But one problem with setting up an address book in this way
> is that there seems to be no standard LDAP format for addresses,
> and an email client probably will not understand a particular format.
>
> For example, I use kmail, which claims to understand LDAP.
> But if you export your kmail (or kaddressbook) list in LDIF format
> it is more of less useless for putting on an openldap server.
>
> As far as I can see, the only reasonably general format for this is vCard
> (which is more or less what kmail uses)
> but there doesn't seem to be any standard way
> of translating vCard to LDAP (or LDIF) format.
>
> It's amazing to me that there is not a standard way
> of putting an address book on an openldap server
> which can be understood by all email clients
> since this seems to be the major use of openldap.
>
> But I am far from expert in this subject;
> perhaps I have misunderstood the situation?
----
On Fedora (I think, for certain on RHEL), the openldap-servers comes
with many 'migration' scripts from padl that can take static file
entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
migrate them into an LDIF which you can then import. Their scripts are
very, very good and should be the basis for anyone looking to migrate to
LDAP.
Address Book clients such as Kontact (which is what Kmail would use), or
Thunderbird, Evolution, Outlook, etc. all have differing notions of
which attributes LDAP should offer. Let me repeat this another
way...THERE ARE NO STANDARDS for attributes that Address Book client
applications will use. This can be viewed as a negative or a positive.
Positive because you can support a variety of address book clients in a
variety of ways. Negative because if you don't know what you're doing,
it's confusing.
Therefore, whatever any program exports as an LDIF will differ from each
other program and it's up to the 'administrator' to do find/replace for
the attributes that they intend to use on the LDAP server...the only
other way is the Microsoft way which is prescribed. Once you absorb the
methodology, it becomes clear that the Microsoft way is limiting.
Funny.... I knew that Ric's extremely general question was going to fan out
to be much more than he thought he was asking......
I'd dump all that I know about ldap here....but it would take me too long to
type it all and maybe never answer the question that Ric thinks he is
asking. :-)
12:13 a.m.
On Tue, 2008-01-08 at 13:30 +0800, Ed Greshko wrote:
Ric Moore wrote:
>>From the examples I've found, there seems to be "just something
> missing"(tm) in them. Someone please direct me to "something that just
> works."(tm) as it's making me blind, crazy, old and cranky. Ric
Maybe you could start by tell folks what you need/want? I think your
request is way to general. I know you are blind, crazy, and cranky...but
stop and think for a moment.
Just a really good tried and true website reference for setting up ldap.
I've googled, went to various sites which all are a bit different from
each other, in procedure, and none has resulted in a working ldap
server. Even after trying to mentally diff them and come up with
something in the middle. Ergo, my appeal is to someone/anyone that has
used a webpage reference that works, step by step, I'd dearly love to
have it. I'm trying to use openldap. I thought sendmail was difficult.
It's a cakewalk compared to ldap/openldap. :) Ric
--
================================================
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
Linux user# 44256 Sign up at: http://counter.li.org/
http://www.sourceforge.net/projects/oar
http://www.wayward4now.net <---down4now too
================================================
11:33 p.m.
On Thu, 2008-01-10 at 15:30 +1030, Tim wrote:
On Wed, 2008-01-09 at 19:53 -0700, Craig White wrote:
> do this...
>
> # rpm -ql evolution-data-server|grep schema
Now, Thunderbird, Kmail, and the other main and popular mail clients
that come supplied with Fedora... You do know what I meant by
"Evolution, *et* *al*"?
----
since the beginning of Netscape and Netscape directory server, pinning
the MozillaOrgPerson schema down has been equivalent to nailing jello to
the wall or getting the RIAA to admit that it's legal to rip CD's to
your hard drive. I think the best concept with Mozilla address books,
since they are read only anyway, is just to ignore the schema. Others
can differ and I'm good with that.
I did the google thing for kaddressbook and couldn't find anything
definitive. It can't be Fedora's issue for not supplying either of them.
----
Can they all "just start working" with your LDAP server, or
not? The
answer will be "no," won't it. Otherwise none of us would have been
having this discussion.
----
sure they work just fine without adding any schema, so your supposition
is wrong. The devil, as always, is in the details.
For example, I will use Evolution since that is the client I primarily
use myself. I note that you are also using the same version as I (must
be F7 - Evolution 2.10.3)
Click 'Contacts' => 'New'
you get a nice screen with 3 tabs
Contact | Personal Information | Mailing Address
On the Contact screen, you can put in name, email, telephone number but
if you put anything into say the categories or the instant messaging
field, or most of the fields represented on the Personal Information or
Mailing Address tabs you will get an error when you try to save on an
LDAP server that doesn't support those attributes. The schema solves
that issue.
Then there's the mapping issue...it's entirely possible that Evolution
will map to an attribute that Kaddressbook will miss and vice versa.
This becomes a much larger problem when you consider that everyone's
concept of extended attributes (i.e. custom schema) is no longer
compatible with each other. So some LDAP clients permit custom mapping
but now you are manually mapping attributes - see my link in other
e-mail with information on combined Outlook/Mozilla LDAP clients.
They all work as read clients, some work as write clients but if you
expect that you can get an LDAP address book working with various
clients without actually knowing what you are doing, I say good luck.
In the end, you'll likely find that e-mail client address books aren't
really good client applications for editing LDAP entries or creating new
ones. Typically those are custom applications written in things like PHP
or Ruby or perl. Tain't much different in Windows world.
Craig
12:42 a.m.
Ric Moore wrote:
On Tue, 2008-01-08 at 13:30 +0800, Ed Greshko wrote:
> Ric Moore wrote:
>> >From the examples I've found, there seems to be "just something
>> missing"(tm) in them. Someone please direct me to "something that just
>> works."(tm) as it's making me blind, crazy, old and cranky. Ric
> Maybe you could start by tell folks what you need/want? I think your
> request is way to general. I know you are blind, crazy, and cranky...but
> stop and think for a moment.
Just a really good tried and true website reference for setting up ldap.
I've googled, went to various sites which all are a bit different from
each other, in procedure, and none has resulted in a working ldap
server. Even after trying to mentally diff them and come up with
something in the middle. Ergo, my appeal is to someone/anyone that has
used a webpage reference that works, step by step, I'd dearly love to
have it. I'm trying to use openldap. I thought sendmail was difficult.
It's a cakewalk compared to ldap/openldap. :) Ric
Have you tried starting at step 8 from this quick start guide?
http://docs.huihoo.com/openldap/admin23/quickstart.html
I just did it and got a working directory up in 3 minutes time. That
included the time it took to install openldap-servers.
--
The man on tops walks a lonely street; the "chain" of command is often a noose.
4:38 a.m.
On Wed, 2008-01-09 at 01:13 -0500, Ric Moore wrote:
On Tue, 2008-01-08 at 13:30 +0800, Ed Greshko wrote:
> Ric Moore wrote:
> >>From the examples I've found, there seems to be "just something
> > missing"(tm) in them. Someone please direct me to "something that
just
> > works."(tm) as it's making me blind, crazy, old and cranky. Ric
>
> Maybe you could start by tell folks what you need/want? I think your
> request is way to general. I know you are blind, crazy, and cranky...but
> stop and think for a moment.
Just a really good tried and true website reference for setting up ldap.
I've googled, went to various sites which all are a bit different from
each other, in procedure, and none has resulted in a working ldap
server. Even after trying to mentally diff them and come up with
something in the middle. Ergo, my appeal is to someone/anyone that has
used a webpage reference that works, step by step, I'd dearly love to
have it. I'm trying to use openldap. I thought sendmail was difficult.
It's a cakewalk compared to ldap/openldap. :) Ric
Don't know about a website that will get you started in a jiffy but last
year I bought the O'Reilly LDAP book and it was most helpful with
learning LDAP and getting openldap going.
Regards,
Patrick
7:53 a.m.
--- Ed Greshko <Ed.Greshko(a)greshko.com> wrote:
Mr.Scrooge wrote:
> --- Ed Greshko <Ed.Greshko(a)greshko.com> wrote:
>
>> Craig White wrote:
>>
>>> ----
>>> I'm not certain where you're going with this.
>>> ----
>> Actually, I'm just wondering if Ric ever got his ldap server up and
running.
>>
>> He was "blind, crazy, old and cranky" at the start of this thread. I
can't
>> begin to imagine his state of mind by now. He stopped by and asked for
>> directions and a discussion erupted about GPS and what is the best map
>> projection technique and why you can't there from here. :-) :-) :-)
>>
>> Ramble on....
>>
> I happen to like flexibility and I hate cut and paste computing. It's funny
because you'd
think
> the former would be more expensive than the latter.....
Well that certainly is a personal decision. Sometimes people just want
something to work and they don't want to delve into the details at the moment.
True it is a personal decision but when it breaks who's going to fix it? The downside,
in my
opinion to what i term cut and paste computing is that when it breaks you don't know
what to do.
If you got your hands dirty putting it together then getting under the hood doesn't
scare you and
generally the problem becomes easier to solve. It may not be true in all cases but it
helps alot
when you know what went into setting it up vs. relying on a preconfigured notion of what
it should
be and having no say in the matter.
I'm glad to see Ric got it working. His message came in after I
sent mine
about not knowing if he got it running or not.
I certainly hope the "circle jerk" doesn't continue too much longer.
Heaven
knows we have seen a few of those recently. :-) I can't remember any of
those types of "discussions" ending with one party saying "You're
right! I
see the error in my ways".
Surrender? Never!!! ;)
-Max
____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs
6:33 a.m.
Craig White wrote:
MOST e-mail address book 'clients' are actually read-only
clients and
don't make any attempt to have write access. Evolution is capable of
writing to LDAP address books and I believe that Kontact (KaddressBook)
can now also 'write' to LDAP address books.
How exactly can one use KAddressBook in this way?
Does anyone know?
I assume you are saying that KAddressBook
can talk to an openLDAP server?
--
Timothy Murphy
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland
11 p.m.
On Wed, 2008-01-09 at 19:53 -0700, Craig White wrote:
do this...
# rpm -ql evolution-data-server|grep schema
Now, Thunderbird, Kmail, and the other main and popular mail clients
that come supplied with Fedora... You do know what I meant by
"Evolution, *et* *al*"?
Can they all "just start working" with your LDAP server, or not? The
answer will be "no," won't it. Otherwise none of us would have been
having this discussion.
--
[tim@bigblack ~]$ uname -ipr
2.6.23.12-52.fc7 i686 i386
Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.
________________________________________________________________
rm -rfd /*
12:35 a.m.
Craig White wrote:
thanks, I was worried that we didn't have permission for me to
counterpoint all of Les's anti Fedora/Red Hat attitudes.
I don't have a particularly anti Fedora/Red Hat attitude. I am just
against shipping things that don't work and making it unnecessarily
difficult to add the parts that can fix it. And your replies about how
you have been able to find instructions elsewhere and make things work
anyway with great amounts of effort that every user will have to repeat
aren't exactly counterpoints.
--
Les Mikesell
lesmikesell(a)gmail.com
10:05 p.m.
Mr.Scrooge wrote:
--- Ed Greshko <Ed.Greshko(a)greshko.com> wrote:
> Craig White wrote:
>
>> ----
>> I'm not certain where you're going with this.
>> ----
> Actually, I'm just wondering if Ric ever got his ldap server up and running.
>
> He was "blind, crazy, old and cranky" at the start of this thread. I
can't
> begin to imagine his state of mind by now. He stopped by and asked for
> directions and a discussion erupted about GPS and what is the best map
> projection technique and why you can't there from here. :-) :-) :-)
>
> Ramble on....
>
I happen to like flexibility and I hate cut and paste computing. It's funny because
you'd think
the former would be more expensive than the latter.....
Well that certainly is a personal decision. Sometimes people just want
something to work and they don't want to delve into the details at the moment.
I'm glad to see Ric got it working. His message came in after I sent mine
about not knowing if he got it running or not.
I certainly hope the "circle jerk" doesn't continue too much longer. Heaven
knows we have seen a few of those recently. :-) I can't remember any of
those types of "discussions" ending with one party saying "You're
right! I
see the error in my ways".
9:48 p.m.
On Wed, 2008-01-09 at 14:42 +0800, Ed Greshko wrote:
> Just a really good tried and true website reference for setting
up ldap.
> I've googled, went to various sites which all are a bit different from
> each other, in procedure, and none has resulted in a working ldap
> server. Even after trying to mentally diff them and come up with
> something in the middle. Ergo, my appeal is to someone/anyone that has
> used a webpage reference that works, step by step, I'd dearly love to
> have it. I'm trying to use openldap. I thought sendmail was difficult.
> It's a cakewalk compared to ldap/openldap. :) Ric
Have you tried starting at step 8 from this quick start guide?
http://docs.huihoo.com/openldap/admin23/quickstart.html
I just did it and got a working directory up in 3 minutes time. That
included the time it took to install openldap-servers.
Thank you, this looks like it knows what it's talking about. :) Ric
--
================================================
My father, Victor Moore (Vic) used to say:
"There are two Great Sins in the world...
..the Sin of Ignorance, and the Sin of Stupidity.
Only the former may be overcome." R.I.P. Dad.
Linux user# 44256 Sign up at: http://counter.li.org/
http://www.sourceforge.net/projects/oar
http://www.wayward4now.net <---down4now too
================================================
9:29 p.m.
--- Ed Greshko <Ed.Greshko(a)greshko.com> wrote:
Craig White wrote:
> ----
> I'm not certain where you're going with this.
> ----
Actually, I'm just wondering if Ric ever got his ldap server up and running.
He was "blind, crazy, old and cranky" at the start of this thread. I can't
begin to imagine his state of mind by now. He stopped by and asked for
directions and a discussion erupted about GPS and what is the best map
projection technique and why you can't there from here. :-) :-) :-)
Ramble on....
I happen to like flexibility and I hate cut and paste computing. It's funny
because you'd think
the former would be more expensive than the latter.....
-Max
____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs
8:53 p.m.
On Thu, 2008-01-10 at 13:02 +1030, Tim wrote:
Les Mikesell:
>> Is there some reason that there isn't a standard schema shipped with the
>> server that supplies what the clients in the distribution expect?
Craig White:
> If I understand your term 'clients' to mean an address book client like
> Kontact, I would venture to guess that Kontact like Evolution and all
> other address book clients each has their own schema. If you are
> decrying that all of the various address book clients all have differing
> notions about schema's, then you should take that up with them.
I would think that Les was thinking what I was: If you supply a
distribution with specific LDAP and mail software, that you'd also
supply the bits that allowed them to work together, particularly your
flagship products.
e.g. Configurations to suit using LDAP with Evolution, kmail,
Thunderbird, etc.
You can't really expect Evolution, et al, to supply it, because they
don't know what LDAP server you've included.
----
Were you trying to make the fact that you don't know what you're talking
about so obvious that you ran it up a flag pole or did it just happen by
accident?
do this...
# rpm -ql evolution-data-server|grep schema
Craig
6:53 p.m.
Craig White wrote:
----
I'm not certain where you're going with this.
----
Actually, I'm just wondering if Ric ever got his ldap server up and running.
He was "blind, crazy, old and cranky" at the start of this thread. I can't
begin to imagine his state of mind by now. He stopped by and asked for
directions and a discussion erupted about GPS and what is the best map
projection technique and why you can't there from here. :-) :-) :-)
Ramble on....
6:27 p.m.
On Wed, 2008-01-09 at 17:57 -0600, Les Mikesell wrote:
Chris wrote:
>
> I have not really followed the thread - but to cut to the chase (for me
> at least) is your ldap server working as in; Windows AD is doing a one
> way sync to your ldap server?
I don't think you can do that with the openldap shipped with the disto,
but it is possible with Fedora Directory Server.
> To me - this is the most important piece of the puzzle. I have tried
> about a year ago to setup an OS ldap server in our AD domain, but was
> never able to either find docs on the above, or figure it out.
>
> I tallied it up to the fact that I'm too new to Linux to have gotten it
> to work - then again, many users I come across have wanted to do what I
> want to do - simply, have AD do a one way sync to my ldap server,
> period.
>
> Thoughts?
There is a simpler but less functional way to use AD or windows domain
passwords. Just enable 'smb' authentication and configure the domain as
the 'workgroup' and provide the server(s) to check. You still need to
add users to your Linux box(es) but you don't have to set up or maintain
passwords.
----
winbindd - you don't need to add users to your Linux boxes at all BUT
that was not responsive to OP because he wanted to user OS LDAP server.
Craig
5:57 p.m.
Chris wrote:
I have not really followed the thread - but to cut to the chase (for me
at least) is your ldap server working as in; Windows AD is doing a one
way sync to your ldap server?
I don't think you can do that with the openldap shipped with the disto,
but it is possible with Fedora Directory Server.
To me - this is the most important piece of the puzzle. I have tried
about a year ago to setup an OS ldap server in our AD domain, but was
never able to either find docs on the above, or figure it out.
I tallied it up to the fact that I'm too new to Linux to have gotten it
to work - then again, many users I come across have wanted to do what I
want to do - simply, have AD do a one way sync to my ldap server,
period.
Thoughts?
There is a simpler but less functional way to use AD or windows domain
passwords. Just enable 'smb' authentication and configure the domain as
the 'workgroup' and provide the server(s) to check. You still need to
add users to your Linux box(es) but you don't have to set up or maintain
passwords.
--
Les Mikesell
lesmikesell(a)gmail.com
5:31 p.m.
Craig White wrote:
> Without really knowing anything about it, I'll make a wild
guess and
> assume that it is somehow related to having a java component that
> doesn't work with the broken imitation-java that fedora has insisted on
> shipping for years. And rather than make it easy to install a compliant
> java that another company has made available for free, they don't
> include it at all. But I could be wrong about that...
----
you may be correct, I simply don't know. FDS does require java
IIRC...not to run but to use the GUI consoles provided. If they were
hell bent on distributing FDS with Fedora, they could probably remove
the GUI consoles. They could replace them with something else. Is that
what this is about? Another java rant?
They are usability rants in all cases.
>> Does your question imply without configuration ("as
shipped" reference)?
> Yes, but it relates to not having matching configurations for clients
> and servers as much as shipping one without configuration.
----
each of the networks that I have installed LDAP as an authentication
daemon has a vastly different setup including one where I am using FDS
instead of openldap (approximately 8).
LDAP is simply a set of protocols.
So is X. It makes as much sense to make an LDAP server default to doing
nothing as it would to present a grey X frame when you log in.
There is no set usage for doing
anything at all. In fact, what it was designed to do represents an
insignificant percentage of its current actual usage.
But there are clients in the distribution that expect certain configuration.
The nice thing that is provided by RHEL and of course Fedora, is
that
the tools that handle the various bits (i.e. padl and pam stuff) is well
handled and easily configured.
You seem to think that there should be some pre-configuration performed.
Describe it then. If you could describe it, you could bugzilla an RFE.
We might have something to actually discuss.
What did you do to make it so fedora clients could authenticate to the
server? I'd want that, plus samba authentication for the same set of
users with the same passwords - and if Macs work with the same config,
so much the better. Would it break anything to ship with the schema you
are using as the default?
>> Again, if you think something is wrong with the way they
distributing
>> the software, bugzilla an RFE
> Having made it work, you are the expert... Do you think it could be
> done better? Or is there some reason that the configuration used in one
> place can't work in another?
----
I'm happy with the way it is, otherwise I would have filed an RFE
How long did it take to get it to where you were happy with it, and why
is it necessary for everyone to repeat that process?
--
Les Mikesell
lesmikesell(a)gmail.com
3:18 p.m.
On Wed, 2008-01-09 at 15:10 -0600, Chris wrote:
On Wed, 09 Jan 2008 14:44:24 -0600
Les Mikesell <lesmikesell(a)gmail.com> wrote:
> Having made it work, you are the expert... Do you think it could be
> done better? Or is there some reason that the configuration used in
> one place can't work in another?
>
I have not really followed the thread
----
best for one's sanity to NOT follow a thread that has Les and me going
back and forth
----
- but to cut to the chase (for me
at least) is your ldap server working as in; Windows AD is doing a one
way sync to your ldap server?
----
that's actually possible with Fedora DS
http://directory.fedoraproject.org (I think this will get you there)
----
To me - this is the most important piece of the puzzle. I have tried
about a year ago to setup an OS ldap server in our AD domain, but was
never able to either find docs on the above, or figure it out.
I tallied it up to the fact that I'm too new to Linux to have gotten it
to work - then again, many users I come across have wanted to do what I
want to do - simply, have AD do a one way sync to my ldap server,
period.
Thoughts?
----
Many
answer, above
Craig
3:10 p.m.
On Wed, 09 Jan 2008 14:44:24 -0600
Les Mikesell <lesmikesell(a)gmail.com> wrote:
Having made it work, you are the expert... Do you think it could be
done better? Or is there some reason that the configuration used in
one place can't work in another?
I have not really followed the thread - but to cut to the chase (for me
at least) is your ldap server working as in; Windows AD is doing a one
way sync to your ldap server?
To me - this is the most important piece of the puzzle. I have tried
about a year ago to setup an OS ldap server in our AD domain, but was
never able to either find docs on the above, or figure it out.
I tallied it up to the fact that I'm too new to Linux to have gotten it
to work - then again, many users I come across have wanted to do what I
want to do - simply, have AD do a one way sync to my ldap server,
period.
Thoughts?
--
Best regards,
Chris
2:44 p.m.
Craig White wrote:
>> ----
>> coming from the guy who last week decried that it seemed the intent of
>> Fedora was to be a self-contained distribution, this is extremely
>> laughable.
> You mean they have to complete the inclusion of every possible package
> in the universe before making their own clients talk to their own
> server? Otherwise I don't how this relates to anything. And is there
> some reason not to expect 'Fedora Directory Server' to not be part of
> ... Fedora?
----
I suppose if that was an area of concern, I would be monitoring
Fedora-development list
Without really knowing anything about it, I'll make a wild guess and
assume that it is somehow related to having a java component that
doesn't work with the broken imitation-java that fedora has insisted on
shipping for years. And rather than make it easy to install a compliant
java that another company has made available for free, they don't
include it at all. But I could be wrong about that...
----
>> It is impossible to know where you are coming from.
> I'd like something that works... Do you really prefer an LDAP
> authentication client that won't work with the server as shipped in the
> same distribution?
----
do you mean that it's not working? I must be doing something wrong then
because my main server (RHEL) is the base ldap server and it's handing
the authentication for all the Macintosh, Windows and Linux computers on
my LAN including the Fedora 7 & Fedora 8 clients.
Does your question imply without configuration ("as shipped" reference)?
Yes, but it relates to not having matching configurations for clients
and servers as much as shipping one without configuration.
Heck, not even Windows does that (Neither server nor client will
operate/authenticate without configuration). Configuration details is
what job security is about ;-)
Again, if you think something is wrong with the way they distributing
the software, bugzilla an RFE
Having made it work, you are the expert... Do you think it could be
done better? Or is there some reason that the configuration used in one
place can't work in another?
--
Les Mikesell
lesmikesell(a)gmail.com
2:01 p.m.
Craig White wrote:
>>>> I suppose if Fedora saw itself as providing a turnkey distribution with
>>>> a notion towards a specific, pre-determined configuration that simply
>>>> worked out of the box, that would occur.
>>> So no one expects anyone to have more than one fedora box and need them
>>> to share network authentication?
>>>
>>>> i.e., isn't that what your
>>>> 'e-smith' distro (or whatever it is called) does?
>>> I thought the point of using any packaged distribution was that its own
>>> components would work together. E-smith (now SME server) just does a
>>> kickstart install and provides a web interface that does all your
>>> config-file editing for you with a few concepts combined - mostly geared
>>> towards being server for windows boxes. It does provide an ldap setup
>>> suitable for an outlook address book, but it can't authenticate against
>>> its own LDAP server let alone a different instance.
>> ----
>> perhaps you need to bugzilla an RFE
> I guess I always expected 'Fedora Directory Server' to be part of Fedora
> and come set up to work. Maybe I missed something obvious here...
----
coming from the guy who last week decried that it seemed the intent of
Fedora was to be a self-contained distribution, this is extremely
laughable.
You mean they have to complete the inclusion of every possible package
in the universe before making their own clients talk to their own
server? Otherwise I don't how this relates to anything. And is there
some reason not to expect 'Fedora Directory Server' to not be part of
... Fedora?
It is impossible to know where you are coming from.
I'd like something that works... Do you really prefer an LDAP
authentication client that won't work with the server as shipped in the
same distribution?
--
Les Mikesell
lesmikesell(a)gmail.com
1:37 p.m.
On Wed, 2008-01-09 at 13:31 -0600, Les Mikesell wrote:
Craig White wrote:
>>> I suppose if Fedora saw itself as providing a turnkey distribution with
>>> a notion towards a specific, pre-determined configuration that simply
>>> worked out of the box, that would occur.
>> So no one expects anyone to have more than one fedora box and need them
>> to share network authentication?
>>
>>> i.e., isn't that what your
>>> 'e-smith' distro (or whatever it is called) does?
>> I thought the point of using any packaged distribution was that its own
>> components would work together. E-smith (now SME server) just does a
>> kickstart install and provides a web interface that does all your
>> config-file editing for you with a few concepts combined - mostly geared
>> towards being server for windows boxes. It does provide an ldap setup
>> suitable for an outlook address book, but it can't authenticate against
>> its own LDAP server let alone a different instance.
> ----
> perhaps you need to bugzilla an RFE
I guess I always expected 'Fedora Directory Server' to be part of Fedora
and come set up to work. Maybe I missed something obvious here...
----
coming from the guy who last week decried that it seemed the intent of
Fedora was to be a self-contained distribution, this is extremely
laughable.
It is impossible to know where you are coming from.
Craig
1:31 p.m.
Craig White wrote:
>> I suppose if Fedora saw itself as providing a turnkey
distribution with
>> a notion towards a specific, pre-determined configuration that simply
>> worked out of the box, that would occur.
> So no one expects anyone to have more than one fedora box and need them
> to share network authentication?
>
>> i.e., isn't that what your
>> 'e-smith' distro (or whatever it is called) does?
> I thought the point of using any packaged distribution was that its own
> components would work together. E-smith (now SME server) just does a
> kickstart install and provides a web interface that does all your
> config-file editing for you with a few concepts combined - mostly geared
> towards being server for windows boxes. It does provide an ldap setup
> suitable for an outlook address book, but it can't authenticate against
> its own LDAP server let alone a different instance.
----
perhaps you need to bugzilla an RFE
I guess I always expected 'Fedora Directory Server' to be part of Fedora
and come set up to work. Maybe I missed something obvious here...
--
Les Mikesell
lesmikesell(a)gmail.com
1:18 p.m.
On Wed, 2008-01-09 at 12:51 -0600, Les Mikesell wrote:
Craig White wrote:
>>
>>> Now if you are referring to something other than address book
'clients',
>>> then you will have to be more specific.
>> I mean what you need if you check LDAP authentication in the system
>> authentication GUI or if you use it with samba as included in the
>> distribution. Adding optional attributes and aliases to support the
>> other clients in the distribution would make sense too. The question is
>> simply why doesn't the stuff included in the distribution come up
>> configured to match and working together?
> ----
> I suppose if Fedora saw itself as providing a turnkey distribution with
> a notion towards a specific, pre-determined configuration that simply
> worked out of the box, that would occur.
So no one expects anyone to have more than one fedora box and need them
to share network authentication?
> i.e., isn't that what your
> 'e-smith' distro (or whatever it is called) does?
I thought the point of using any packaged distribution was that its own
components would work together. E-smith (now SME server) just does a
kickstart install and provides a web interface that does all your
config-file editing for you with a few concepts combined - mostly geared
towards being server for windows boxes. It does provide an ldap setup
suitable for an outlook address book, but it can't authenticate against
its own LDAP server let alone a different instance.
----
perhaps you need to bugzilla an RFE
Craig
12:51 p.m.
Craig White wrote:
>
>> Now if you are referring to something other than address book 'clients',
>> then you will have to be more specific.
> I mean what you need if you check LDAP authentication in the system
> authentication GUI or if you use it with samba as included in the
> distribution. Adding optional attributes and aliases to support the
> other clients in the distribution would make sense too. The question is
> simply why doesn't the stuff included in the distribution come up
> configured to match and working together?
----
I suppose if Fedora saw itself as providing a turnkey distribution with
a notion towards a specific, pre-determined configuration that simply
worked out of the box, that would occur.
So no one expects anyone to have more than one fedora box and need them
to share network authentication?
i.e., isn't that what your
'e-smith' distro (or whatever it is called) does?
I thought the point of using any packaged distribution was that its own
components would work together. E-smith (now SME server) just does a
kickstart install and provides a web interface that does all your
config-file editing for you with a few concepts combined - mostly geared
towards being server for windows boxes. It does provide an ldap setup
suitable for an outlook address book, but it can't authenticate against
its own LDAP server let alone a different instance.
--
Les Mikesell
lesmikesell(a)gmail.com
12:31 p.m.
On Wed, 2008-01-09 at 12:13 -0600, Les Mikesell wrote:
Craig White wrote:
>>
>>> His confusion is very common...I admit that I too was confused by that
>>> very notion when I first started mucking with LDAP. One would think that
>>> if you use say OpenOffice to save say Test.DOC that Microsoft Word
>>> should be able to open that file [1]. Likewise, since LDIF is the world
>>> of LDAP, shouldn't one expect that an LDIF file exported by Kontact be
>>> usable with openldap?
>> Is there some reason that there isn't a standard schema shipped with the
>> server that supplies what the clients in the distribution expect?
> ----
> If I understand your term 'clients' to mean an address book client like
> Kontact, I would venture to guess that Kontact like Evolution and all
> other address book clients each has their own schema. If you are
> decrying that all of the various address book clients all have differing
> notions about schema's, then you should take that up with them.
>
> Most, if not all LDAP implementations include an inetOrgPerson schema
> that is consistent because this is part of an RFC. Each of the address
> book clients that I have looked at, use attributes that go beyond the
> inetOrgPerson schema and that is what is really being discussed.
>
> Now if you are referring to something other than address book 'clients',
> then you will have to be more specific.
I mean what you need if you check LDAP authentication in the system
authentication GUI or if you use it with samba as included in the
distribution. Adding optional attributes and aliases to support the
other clients in the distribution would make sense too. The question is
simply why doesn't the stuff included in the distribution come up
configured to match and working together?
----
I suppose if Fedora saw itself as providing a turnkey distribution with
a notion towards a specific, pre-determined configuration that simply
worked out of the box, that would occur. i.e., isn't that what your
'e-smith' distro (or whatever it is called) does?
Craig
12:13 p.m.
Craig White wrote:
>
>> His confusion is very common...I admit that I too was confused by that
>> very notion when I first started mucking with LDAP. One would think that
>> if you use say OpenOffice to save say Test.DOC that Microsoft Word
>> should be able to open that file [1]. Likewise, since LDIF is the world
>> of LDAP, shouldn't one expect that an LDIF file exported by Kontact be
>> usable with openldap?
> Is there some reason that there isn't a standard schema shipped with the
> server that supplies what the clients in the distribution expect?
----
If I understand your term 'clients' to mean an address book client like
Kontact, I would venture to guess that Kontact like Evolution and all
other address book clients each has their own schema. If you are
decrying that all of the various address book clients all have differing
notions about schema's, then you should take that up with them.
Most, if not all LDAP implementations include an inetOrgPerson schema
that is consistent because this is part of an RFC. Each of the address
book clients that I have looked at, use attributes that go beyond the
inetOrgPerson schema and that is what is really being discussed.
Now if you are referring to something other than address book 'clients',
then you will have to be more specific.
I mean what you need if you check LDAP authentication in the system
authentication GUI or if you use it with samba as included in the
distribution. Adding optional attributes and aliases to support the
other clients in the distribution would make sense too. The question is
simply why doesn't the stuff included in the distribution come up
configured to match and working together?
--
Les Mikesell
lesmikesell(a)gmail.com
11:40 a.m.
On Wed, 2008-01-09 at 11:15 -0600, Les Mikesell wrote:
Craig White wrote:
> His confusion is very common...I admit that I too was confused by that
> very notion when I first started mucking with LDAP. One would think that
> if you use say OpenOffice to save say Test.DOC that Microsoft Word
> should be able to open that file [1]. Likewise, since LDIF is the world
> of LDAP, shouldn't one expect that an LDIF file exported by Kontact be
> usable with openldap?
Is there some reason that there isn't a standard schema shipped with the
server that supplies what the clients in the distribution expect?
----
If I understand your term 'clients' to mean an address book client like
Kontact, I would venture to guess that Kontact like Evolution and all
other address book clients each has their own schema. If you are
decrying that all of the various address book clients all have differing
notions about schema's, then you should take that up with them.
Most, if not all LDAP implementations include an inetOrgPerson schema
that is consistent because this is part of an RFC. Each of the address
book clients that I have looked at, use attributes that go beyond the
inetOrgPerson schema and that is what is really being discussed.
Now if you are referring to something other than address book 'clients',
then you will have to be more specific.
Craig
7:51 a.m.
Ric Moore escribío:
On Tue, 2008-01-08 at 13:30 +0800, Ed Greshko wrote:
> Ric Moore wrote:
>> >From the examples I've found, there seems to be "just something
>> missing"(tm) in them. Someone please direct me to "something that just
>> works."(tm) as it's making me blind, crazy, old and cranky. Ric
> Maybe you could start by tell folks what you need/want? I think your
> request is way to general. I know you are blind, crazy, and cranky...but
> stop and think for a moment.
Just a really good tried and true website reference for setting up ldap.
I've googled, went to various sites which all are a bit different from
each other, in procedure, and none has resulted in a working ldap
server. Even after trying to mentally diff them and come up with
something in the middle. Ergo, my appeal is to someone/anyone that has
used a webpage reference that works, step by step, I'd dearly love to
have it. I'm trying to use openldap. I thought sendmail was difficult.
It's a cakewalk compared to ldap/openldap. :) Ric
Rick. There really is not much out there. Here is a simple way of setting up
the ldap. The configuration of the server is pretty well documented, but I
always found setting up the database to be a bit difficult.
This is ONE way to skin the cat. There are many ways. This worked for me.
I have a file of names, phone numbers, etc. that has the following format that
is used at my work:
Name|Email|Ext.|Home #|Cellular #|Pager|Title
sample data:
Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of Technology
Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
I wrote a perl script to parse this and put it into a valid ldif format:
#!/usr/bin/perl
#Here it checks if there are 3 command line arguments.
if (scalar(@ARGV) < 3)
#Next print the usage if the command line arguments are < 3
{
print "Usage: ascii2ldif {asciifile} {organization name} {emaildomain}\n";
print "Example: ascii2ldif phonelist \"ace.com\"\n";
print "\nThis will create a ldif file with the same name of the
asciifile.\n";
print "The email domain, is the emaildomain name of your organization.\n";
print "\nFormat of entries:.\n";
print "Lastname, Firstname|userid|Ext.|Home Phone|Cellular|Pager|Title\n";
exit 1;
}
my $debug=0;
#This is the variable for the 1st command line arg. (filename of asciifile)
my $phonelist = shift (@ARGV);
print "phonelist=$phonelist\n" if $debug;
#This is the variable for creating the .ldif file
my $ldiflist = ">".$phonelist.".ldif";
print "=\n" if $debug;
#This is the variable for the 2rd command line arg. (Name of email domain)
my $orgName = shift (@ARGV);
print "=\n" if $debug;
#This is the variable for the 3rd command line arg. (Name of email domain)
my $emaildomain = shift (@ARGV);
print "=\n" if $debug;
#This is the variable for the Organization name and type of org)
my ($org, $orgType) = split(/\./,$emaildomain);
print "=\n" if $debug;
sub print_header {
#This prints the top of the tree of format:
#dn: dc=ec-group,dc=com
#dc: ec-group
#o: Enterprise Consulting Group
#objectClass: top
#objectclass: organization
#objectClass: dcObject
print OUT "dn: dc=$org, dc=$orgType\n";
print OUT "dc: $org\n";
print OUT "o: $orgName\n";
print OUT "objectClass: top\n";
print OUT "objectclass: organization\n";
print OUT "objectclass: dcObject\n\n";
}
sub print_entry {
my($givenName,$surName,$uid,$title,$officeNumber,$homeNumber,$mobil,$pager)
= @_;
# This creates an entry of format:
#
#dn: cn=Bill Ackermann, dc=ace, dc=com
#cn: Bill Ackermann
#sn: Ackermann
#givenName: Bill
#mail: wackerma(a)ace.com
#title: Systems Engineer
#homeTelephoneNumber: 1.212.836.4886
#telephoneNumber: 1.212.836.4886
#mobileTelephoneNumber: 1.212.836.4886
#pagerTelephoneNumber: 1.212.836.4886
#objectclass: top
#objectclass: person
#objectclass: organizationalPerson
#objectclass: inetOrgPerson
#
$cn = $givenName." ".$surName;
print OUT "dn: cn=$cn, dc=$org, dc=$orgType\n";
print OUT "cn: $cn\n";
print OUT "sn: $surName\n";
print OUT "givenName: $givenName\n" if $givenName ne "";
print OUT "initials: $initials\n" if $initials ne "";
print OUT "mail: $uid\@$emaildomain\n" if $uid ne "";
print OUT "title: $title\n" if $title ne "";
print OUT "telephoneNumber: $officeNumber\n" if $officeNumber ne
"";
print OUT "homeTelephoneNumber: $homeNumber\n" if $homeNumber ne
"";
print OUT "mobileTelephoneNumber: $mobil\n" if $mobil ne "";
print OUT "pagerTelephoneNumber: $pager\n" if $pager ne "";
print OUT "objectClass: top\n";
print OUT "objectClass: person\n";
print OUT "objectClass: organizationalPerson\n";
print OUT "objectClass: inetOrgPerson\n\n";
}
my($given, $surname, $initials, $email, $telephone, $home, $mobil, $pager, $title);
$given = $surname = $initials = $email = "";
$telephone = $home = $mobil = $pager = $title = "";
open(ENTRY, $phonelist);
# better be this form: Name|Email|Ext.|Home #|Cellular |Pager|Title
open(OUT, $ldiflist);
print_header;
while (<ENTRY>) {
chomp;
if ( $_ =~ /^\s*$/ ) {
next; #ignore blank lines
}
($initials,$email,$telephone,$home,$mobil,$pager,$title) = split /\|/;
($surname, $given) = split(/,/,$initials);
$given =~ s/^\s*|\s*$//g;
$surname =~ s/^\s*|\s*$//g;
$email =~ s/^\s*|\s*$//g;
$title =~ s/^\s*|\s*$//g;
$telephone =~ s/^\s*|\s*$//g;
$home =~ s/^\s*|\s*$//g;
$mobil =~ s/^\s*|\s*$//g;
$pager =~ s/^\s*|\s*$//g;
printf
"given=%s,surname=%s,email=%s,title=%s,telephone=%s,home=%s,mobil=%s,pager=%s\n",
$given,$surname,$email,$title,$telephone,$home,$mobil,$pager
if $debug;
print_entry($given,$surname,$email,$title,$telephone,$home,$mobil,$pager);
}
close(ENTRY);
close(OUT);
exit;
So when I run it as:
ascii2ldif phoneList "Enterprise Consulting Group" "ec-group.com"
I get a phoneList.ldif that looks like:
dn: dc=ec-group, dc=com
dc: ec-group
o: Enterprise Consulting Group
description: Top level LDAP for EC-GROUP.COM
objectClass: top
objectclass: organization
objectclass: dcObject
dn: ou=group,dc=ec-group,dc=com
ou: group
objectClass: top
objectClass: organizationalUnit
dn: ou=people,dc=ec-group,dc=com
ou: people
objectClass: top
objectClass: organizationalUnit
dn: ou=sales,dc=ec-group,dc=com
ou: sales
objectClass: top
objectClass: organizationalUnit
dn: cn=Steve B. Baker, ou=people, dc=ec-group, dc=com
cn: Steve B. Baker
sn: Baker
givenName: Steve B.
mail: sbb(a)ec-group.com
telephoneNumber: 15
homeTelephoneNumber: 314-215-4141
mobileTelephoneNumber: 314-591-8181
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
dn: cn=Chris Bowland, ou=people, dc=ec-group, dc=com
cn: Chris Bowland
sn: Bowland
givenName: Chris
mail: cyb(a)ec-group.com
title: 314-663-3132
telephoneNumber: 33
homeTelephoneNumber: 314-835-1216
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
Then I feed it to openldap with
slapadd -l phoneList.ldif
--
Brian Millett - [ Garibaldi, "The Gathering"]
"Commander, this little breach of security isn't going to affect my
Christmas bonus, is it?"
8:59 a.m.
Craig White wrote:
On Wed, 2008-01-09 at 22:49 +0800, Ed Greshko wrote:
> Craig White wrote:
>> On Wed, 2008-01-09 at 22:39 +0800, Ed Greshko wrote:
>>> Craig White wrote:
>>>> On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
>>>>> Brian Millett wrote:
>>>>>
>>>>>> I have a file of names, phone numbers, etc. that has the
following format
>>>>>> that is used at my work:
>>>>>> Name|Email|Ext.|Home #|Cellular #|Pager|Title
>>>>>>
>>>>>> sample data:
>>>>>>
>>>>>> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of
Technology
>>>>>> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
>>>>>>
>>>>>>
>>>>>>
>>>>>> I wrote a perl script to parse this and put it into a valid ldif
format:
>>>>> Thanks for your script, which I shall study.
>>>>>
>>>>> But one problem with setting up an address book in this way
>>>>> is that there seems to be no standard LDAP format for addresses,
>>>>> and an email client probably will not understand a particular
format.
>>>>>
>>>>> For example, I use kmail, which claims to understand LDAP.
>>>>> But if you export your kmail (or kaddressbook) list in LDIF format
>>>>> it is more of less useless for putting on an openldap server.
>>>>>
>>>>> As far as I can see, the only reasonably general format for this is
vCard
>>>>> (which is more or less what kmail uses)
>>>>> but there doesn't seem to be any standard way
>>>>> of translating vCard to LDAP (or LDIF) format.
>>>>>
>>>>> It's amazing to me that there is not a standard way
>>>>> of putting an address book on an openldap server
>>>>> which can be understood by all email clients
>>>>> since this seems to be the major use of openldap.
>>>>>
>>>>> But I am far from expert in this subject;
>>>>> perhaps I have misunderstood the situation?
>>>> ----
>>>> On Fedora (I think, for certain on RHEL), the openldap-servers comes
>>>> with many 'migration' scripts from padl that can take static
file
>>>> entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
>>>> migrate them into an LDIF which you can then import. Their scripts are
>>>> very, very good and should be the basis for anyone looking to migrate to
>>>> LDAP.
>>>>
>>>> Address Book clients such as Kontact (which is what Kmail would use), or
>>>> Thunderbird, Evolution, Outlook, etc. all have differing notions of
>>>> which attributes LDAP should offer. Let me repeat this another
>>>> way...THERE ARE NO STANDARDS for attributes that Address Book client
>>>> applications will use. This can be viewed as a negative or a positive.
>>>> Positive because you can support a variety of address book clients in a
>>>> variety of ways. Negative because if you don't know what you're
doing,
>>>> it's confusing.
>>>>
>>>> Therefore, whatever any program exports as an LDIF will differ from each
>>>> other program and it's up to the 'administrator' to do
find/replace for
>>>> the attributes that they intend to use on the LDAP server...the only
>>>> other way is the Microsoft way which is prescribed. Once you absorb the
>>>> methodology, it becomes clear that the Microsoft way is limiting.
>>> Funny.... I knew that Ric's extremely general question was going to fan
out
>>> to be much more than he thought he was asking......
>>>
>>> I'd dump all that I know about ldap here....but it would take me too long
to
>>> type it all and maybe never answer the question that Ric thinks he is
>>> asking. :-)
>> ----
>> lateral answer, I directed him to the Administrator's Guide on the
>> OpenLDAP's website.
>>
>> This was simply a clarification on why different address book clients
>> write different attributes in an exported LDIF file which probably will
>> fail when you try to ldapadd/slapadd them into LDAP
> Right....but he can't even get as far as getting an ldap server running.
> Or, that is my take from his initial query. So, getting into depth about
> what clients are expecting from the ldap server is putting the cart before
> the horse....so to speak.
----
hence my previous direction to Administrator Guide
useless and unresponsive answers is not the exclusive domain of a select
few.
Sorry...don't understand that cryptic message.
8:56 a.m.
On Wed, 2008-01-09 at 22:49 +0800, Ed Greshko wrote:
Craig White wrote:
> On Wed, 2008-01-09 at 22:39 +0800, Ed Greshko wrote:
>> Craig White wrote:
>>> On Wed, 2008-01-09 at 14:16 +0000, Timothy Murphy wrote:
>>>> Brian Millett wrote:
>>>>
>>>>> I have a file of names, phone numbers, etc. that has the following
format
>>>>> that is used at my work:
>>>>> Name|Email|Ext.|Home #|Cellular #|Pager|Title
>>>>>
>>>>> sample data:
>>>>>
>>>>> Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of
Technology
>>>>> Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
>>>>>
>>>>>
>>>>>
>>>>> I wrote a perl script to parse this and put it into a valid ldif
format:
>>>> Thanks for your script, which I shall study.
>>>>
>>>> But one problem with setting up an address book in this way
>>>> is that there seems to be no standard LDAP format for addresses,
>>>> and an email client probably will not understand a particular format.
>>>>
>>>> For example, I use kmail, which claims to understand LDAP.
>>>> But if you export your kmail (or kaddressbook) list in LDIF format
>>>> it is more of less useless for putting on an openldap server.
>>>>
>>>> As far as I can see, the only reasonably general format for this is
vCard
>>>> (which is more or less what kmail uses)
>>>> but there doesn't seem to be any standard way
>>>> of translating vCard to LDAP (or LDIF) format.
>>>>
>>>> It's amazing to me that there is not a standard way
>>>> of putting an address book on an openldap server
>>>> which can be understood by all email clients
>>>> since this seems to be the major use of openldap.
>>>>
>>>> But I am far from expert in this subject;
>>>> perhaps I have misunderstood the situation?
>>> ----
>>> On Fedora (I think, for certain on RHEL), the openldap-servers comes
>>> with many 'migration' scripts from padl that can take static file
>>> entries (/etc/passwd, /etc/shadow, /etc/group, /etc/hosts...) and
>>> migrate them into an LDIF which you can then import. Their scripts are
>>> very, very good and should be the basis for anyone looking to migrate to
>>> LDAP.
>>>
>>> Address Book clients such as Kontact (which is what Kmail would use), or
>>> Thunderbird, Evolution, Outlook, etc. all have differing notions of
>>> which attributes LDAP should offer. Let me repeat this another
>>> way...THERE ARE NO STANDARDS for attributes that Address Book client
>>> applications will use. This can be viewed as a negative or a positive.
>>> Positive because you can support a variety of address book clients in a
>>> variety of ways. Negative because if you don't know what you're
doing,
>>> it's confusing.
>>>
>>> Therefore, whatever any program exports as an LDIF will differ from each
>>> other program and it's up to the 'administrator' to do
find/replace for
>>> the attributes that they intend to use on the LDAP server...the only
>>> other way is the Microsoft way which is prescribed. Once you absorb the
>>> methodology, it becomes clear that the Microsoft way is limiting.
>> Funny.... I knew that Ric's extremely general question was going to fan out
>> to be much more than he thought he was asking......
>>
>> I'd dump all that I know about ldap here....but it would take me too long to
>> type it all and maybe never answer the question that Ric thinks he is
>> asking. :-)
> ----
> lateral answer, I directed him to the Administrator's Guide on the
> OpenLDAP's website.
>
> This was simply a clarification on why different address book clients
> write different attributes in an exported LDIF file which probably will
> fail when you try to ldapadd/slapadd them into LDAP
Right....but he can't even get as far as getting an ldap server running.
Or, that is my take from his initial query. So, getting into depth about
what clients are expecting from the ldap server is putting the cart before
the horse....so to speak.
----
hence my previous direction to Administrator Guide
useless and unresponsive answers is not the exclusive domain of a select
few.
Craig
8:24 a.m.
On Wed, 2008-01-09 at 01:13 -0500, Ric Moore wrote:
On Tue, 2008-01-08 at 13:30 +0800, Ed Greshko wrote:
> Ric Moore wrote:
> >>From the examples I've found, there seems to be "just something
> > missing"(tm) in them. Someone please direct me to "something that
just
> > works."(tm) as it's making me blind, crazy, old and cranky. Ric
>
> Maybe you could start by tell folks what you need/want? I think your
> request is way to general. I know you are blind, crazy, and cranky...but
> stop and think for a moment.
Just a really good tried and true website reference for setting up ldap.
I've googled, went to various sites which all are a bit different from
each other, in procedure, and none has resulted in a working ldap
server. Even after trying to mentally diff them and come up with
something in the middle. Ergo, my appeal is to someone/anyone that has
used a webpage reference that works, step by step, I'd dearly love to
have it. I'm trying to use openldap. I thought sendmail was difficult.
It's a cakewalk compared to ldap/openldap. :) Ric
----
LDAP is an erector set and what you build is entirely up to you. There
is no one way, there aren't just 10 ways to use it but rather it is
entirely up to you, the admin to use it in any way you see fit and it is
only the RFC's that prescribe what it must do for compliance that it
seeks to serve.
That said, you are probably best off going to the Administrator's Guide
on OpenLDAP's own website for starting out...
http://www.openldap.org/doc/admin23/ (note the admin23 refers to
OpenLDAP 2.3.x which is I believe the version you are looking at on a
current Fedora)
Craig
8:16 a.m.
Brian Millett wrote:
I have a file of names, phone numbers, etc. that has the following
format
that is used at my work:
Name|Email|Ext.|Home #|Cellular #|Pager|Title
sample data:
Baker, Steve B.|sbb|15|314-215-4141|314-591-8181|| Director of Technology
Bowland, Chris|cyb|33|314-835-1216||314-663-3132|Java Developer
I wrote a perl script to parse this and put it into a valid ldif format:
Thanks for your script, which I shall study.
But one problem with setting up an address book in this way
is that there seems to be no standard LDAP format for addresses,
and an email client probably will not understand a particular format.
For example, I use kmail, which claims to understand LDAP.
But if you export your kmail (or kaddressbook) list in LDIF format
it is more of less useless for putting on an openldap server.
As far as I can see, the only reasonably general format for this is vCard
(which is more or less what kmail uses)
but there doesn't seem to be any standard way
of translating vCard to LDAP (or LDIF) format.
It's amazing to me that there is not a standard way
of putting an address book on an openldap server
which can be understood by all email clients
since this seems to be the major use of openldap.
But I am far from expert in this subject;
perhaps I have misunderstood the situation?
--
Timothy Murphy
e-mail (<80k only): tim /at/ birdsnest.maths.tcd.ie
tel: +353-86-2336090, +353-1-2842366
s-mail: School of Mathematics, Trinity College, Dublin 2, Ireland
5961
days inactive
5963
days old
51 comments
11 participants
participants (11)
-
Brian Millett -
Chris -
Craig White -
Craig White -
Ed Greshko -
Les Mikesell -
Max -
Patrick Lists -
Ric Moore -
Tim -
Timothy Murphy