389-users October 2007

389-users@lists.fedoraproject.org

48 participants
45 discussions

[Fedora-directory-users] linux authentication though ds
by lance raymond 04 Oct '07

04 Oct '07

Afternoon, I have been reading a lot on this and wish to see if I am on the right track. I wish to have all employees login information be stored in DS, and authenticate through him. I have subscribed to the list a few day's ago and the questions are pretty high level, so it does seem that people are using fedora's version, so I guess for starters, is this possible. I already have fedora ds running, added a few people, but I didn't see 2 much on authenticating though DS. Thanks ... lr

2 1

[Fedora-directory-users] nss_ldap cannot authenticate vs FDS
by Peter Santiago 04 Oct '07

04 Oct '07

Hi, I was able to finally configure FDS to sync with ADS with Winsync. Thanks a lot to the members here. Now I ran into another peculiar problem. NSS_LDAP seems not to be able to authenticate or do a successful query against FDS. I used ldapsearch to double check, I was able to do a successful query against FDS. Attached are two files from doing id and ldapsearch. I have enabled debugging. Could someone help explain why ldapsearch can successfully query FDS whereas NSS_LDAP cannot? Maybe there is a need to patch NSS_LDAP? I'm using nss_ldap 253 from fedora 6 package. -- Peter Santiago peters(a)psinergybbs.com My website: www.psinergybbs.com My spamtrap address: r34987y(a)psinergybbs.com ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

3 3

[Fedora-directory-users] problems with post/fedora-ds
by Jeffrey McDonald 03 Oct '07

03 Oct '07

Hi, I'm having some problems with fedora-ds and postfix in a high-rate environment. First, let me say that we are migrating from openldap-1.2.2 to Fedora-DS. The configuration with postfix+openldap has to be migrated to fedora-ds and the postfix+openldap works great in the high-rate environment. I have a relay_recipient_maps and a alias list which both use ldap. However, ldaps connections (and ldap) connections to fedora-DS seem to time out in a high-rate environment. In slow-rate environment were there are a few 10s of emails an hour, things work fine. In the high-rate where you receive 1-5 of emails per second, I am seeing lots of temporary lookup failures. My configuration looks exactly like the POSTFIX Wiki configuration on the directory.fedoraproject.org/wiki page. We did some debugging to take a look at postfix, which attempts to open a connection to the ldap server and does, then it wants to perform multiple lookups per connection but this doesn't work--it seems for some reason that postfix is unable to do more than one lookup per connection. The fedora-DS ends up with many connections from postfix which eventually time-out. Any ideas as to what could be wrong? Thanks, Jeff

1 0

Re: [Fedora-directory-users] fds vs passsync vs AD
by Paolo Barbato 03 Oct '07

03 Oct '07

Dear list, I repost original question on my troubles....anybody has any idea on why I'm facing such a problem ? Regards, Paolo. >Thanks for reply, but I suspect I'm facing a different problem. > >Talking about SSL. > >As far as I understand SSL is used both for passync (AD -> FDS) and >replication agreement (AD <-> FDS). Note two different tasks. > >In first case work cert.db8 certificates. I've installed on both AD >and FDS, my CA certificate and FDS server certificate. Passync works >without a hic. When I change pasword from windows it's exactly set >on FDS. > >Replication agreement is based on cert.db8 on FDS and MS >architecture on AD, I mean that I make use of mmc to install CA and >AD server signed certificate. > >Replication seems also work, since I see that AD and FDS users are >"merged" in one (almost) identical list. So users that were in AD >are created on FDS and viceversa, with (almost) all parameters >setted. > >My problem arise when from a linux machine authenticated on FDS I >issue and passwd change password. Really all seems go right, since >FDS register new password, and also AD tell me that the change has >been committed : > >first event >User Account Changed: > Target Account Name: barbato > Target Domain: TEST > Target Account ID: TEST\barbato > Caller User Name: sync manager > Caller Domain: TEST > Caller Logon ID: (0x0,0x318F76) > Privileges: - > Changed Attributes: > Sam Account Name: - > Display Name: - > User Principal Name: - > Home Directory: - >and after a while a second security event: > >User Account password set: > Target Account Name: barbato > Target Domain: TEST > Target Account ID: TEST\barbato > Caller User Name: sync manager > Caller Domain: TEST > Caller Logon ID: (0x0,0x318F76) > > >But when I try to log on AD with this new password AD tell me that >I'm usinig the wrong one. Note that also the previous doesn't work, >and this confirm that it has been really changed. > >Anybody has faced this ? Some other things to look into ? > >Regards, >Paolo. -- ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

4 5

[Fedora-directory-users] How can you monitor replication?
by Ian Meyer 03 Oct '07

03 Oct '07

Hello, We have a decent sized env. (1 master, 16 slaves in different datacenters across the world) and we're trying to find a way to effectively monitor the status of replication. When was the last update? How many changes were made? How long did it take from start to finish? I know you can get most of this information from the gui, but we need to tie it in to our monitoring application. Is this information stored in a db anywhere? In ldap itself? Any insight would be appreciated. Thanks in advance! - Ian

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2007