[389-users] two guys who bit some more than we could chew...(?)

[Wolf Siedler]

<olof_nord_ at hotmail.com> wrote:
>     we can start, but not logon to the 389-console, and we cant get 
> luma to connect to our server.

My recommendation is to forget about Luma temporarily and get the basic
software (389-DS and its console) going first. 389 Directory Server is a
*very* powerful tool, but like with all advanced tools, you need to plan
for time to learn it. It will be worth it.

To begin I would temporarily disable the local firewall (iptables, I
presume). During installation, a random port number was suggested. This
port may still be blocked by the firewall so that the Java console can
not connect.

Did you manage to start Linux services "dirsrv" *and* "dirsrv-admin"?

Start with running the Java console from the same machine where you
installed 389-DS, not via network.

Also, keep checking directory server logfiles for hints to why
authentication fails. If they don't show even a connection attempt, then
you will need to to eliminate that problem first.
A handy way is the tail command:
tail --lines 100 /var/log/dirsrv/slapd-<...snip...>errors
tail --lines 100 /var/log/dirsrv/slapd-<...snip...>access

During installation of 389-DS, you created a Directory Admin ID. This is
the one you need to use for logging onto the DS console, not the
Directory Manager.

I made the exprience that apparently the Java console does not like one
or more characters in my Directory Admin IP password.
My workaround is to start the console from a terminal window (everything
has to go in one line):
389-console -u {directory_admin_id} -w {directory_admin_id_password} -a
{http://ldap-host.example.com:12345} -l en

Obviously, you will need to replace the terms in curly brackets with the
ones from your installation.
>From personal experience, I strongly recommend writing down each and
every selection you made during 389-DS installation. If not, similar
sounding terms get mixed later very easily.

A very handy trick a nice colleague taught me is to do a silent
installation though a response file - this way you can carefully think
through all selections in advance. The command to install through
response file is:
/usr/sbin/setup-ds-admin.pl -s -f setup.inf

A generic setup.ing file would look like this (remember to adjust server
names, user names, passwords etc.):
===quote===
[General]
FullMachineName= ldap-server.example.com
SuiteSpotUserID= ldap
SuiteSpotGroup= ldap
AdminDomain= example.com
ConfigDirectoryAdminID= {directory_admin_id}
ConfigDirectoryAdminPwd= {directory_admin_id_password}
ConfigDirectoryLdapURL= ldap://ldap-host.example.com:389/o=NetscapeRoot

[slapd]
SlapdConfigForMC= Yes
UseExistingMC= 0
ServerPort= 389
ServerIdentifier= ldap01
Suffix= dc=example2,dc=com
RootDN= cn=Directory Manager
RootDNPwd= {secret_pw}


[admin]
Port= 20126
ServerAdminID= {directory_admin_id}
ServerAdminPwd= {directory_admin_id_password}
===unquote===

Make sure that (Linux) user and group "ldap" exist beforehand.

Oh, and if something goes wrong
/usr/sbin/remove-ds-admin.pl -f -d -y
will completely wipe out your 389-DS installation. Delete afterwards
directory /etc/dirsrv/slapd-<...snip...>.removed and you can start over.

> Our goal is to be able to log into the 389-console and to add some users

This definitely works from the console.

> We would also like to do some more things like sharing folders

Howeve, for this goal you will have to invest more time. 389-DS in iself
can not share folders - it is "just" a directory. You can, however, let
Linux use the LDAP directory for authentication when accessing folders.
In combination with Samba it is also possible to create something like a
fileserver plus domain controller for small networks.

About Luma I an unable to comment as we don't use it.

Regards,
Wolf