389-users July 2007

389-users@lists.fedoraproject.org

61 participants
59 discussions

[Fedora-directory-users] Usersync Error
by Glenn 27 Jul '07

27 Jul '07

I'm still trying to get Fedora Directory to contact an NT4 server for replication. After I fill out the Windows Sync agreement form and click "Next", the console freezes. If I go to the NT4 machine and stop the User Sync service, the console unfreezes and gives the dreaded "Unable to contact Active Directory server" message. I appear to have SSL set up correctly. An error message appears in the wrapper.log on the NT machine when I stop the User Sync service while FD is trying to make the sync agreement: java.lang.NoSuchMethodError: javax.net.ssl.SSLContext.createSSLEngine() Ljavax/net/ssl/SSLEngine; Is the Windows Sync function known to work with FDS 1.0.3 and NT4? Hoping someone can help. Thanks. -Glenn.

2 1

[Fedora-directory-users] FDS, Kerberos, SASL confusion
by Hintermayer Johannes 26 Jul '07

26 Jul '07

Hi all, currently I'm battling with FDS, Kerberos and SASL to get a working Single-Sign-On setup. At the moment I have a working Kerberos Realm to which I can successfully connect. I also have a working FDS with one user for testing purposes. Saslauthd is also configured and executing testsaslauthd is ok. But now I have problems to convince FDS to authenticate users via Kerberos. I have read http://directory.fedoraproject.org/wiki/Howto:Kerberos and http://www.redhat.com/docs/manuals/dir-server/ag/7.1/ssl.html#1083165 but I don't think it's that simple. At least it's not yet working for me. When I try to bind to FDS via GSSAPI the following error occurs: #klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: bsmith(a)AFB.LAN #ldapsearch -Y GSSAPI -D "uid=bsmith,ou=People,dc=afb,dc=lan" -v ldap_initialize( <DEFAULT> ) SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-1): generic failure: GSSAPI Error: Miscellaneous failure (Permission denied) I have tried several combinations of config files and password entries but none worked. So first of all I'd like to ask a few questions to shed light on a few things: 1. Do I need saslauthd on every client which I want to authenticate via FDS/Kerberos? 2. Do I need a host principal for every client? Here is my current configuration, please correct me if there are some unneeded files (these were built together from several tutorials): /etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = AFB.LAN dns_lookup_realm = false dns_lookup_kdc = false [realms] AFB.LAN = { kdc = vafbkrb01.afb.lan:88 admin_server = vafbkrb01.afb.lan:749 default_domain = afb.lan } [domain_realm] .afb.lan = AFB.LAN afb.lan = AFB.LAN [kdc] profile = /var/kerberos/krb5kdc/kdc.conf [appdefaults] pam = { debug = true ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } /etc/ldap.conf host 172.16.50.2 base dc=afb,dc=lan ssl no tls_cacertdir /etc/openldap/cacerts pam_password md5 SASL_MECH GSSAPI SASL_REALM AFB.LAN use_sasl on sasl_auth_id ldap/vafbds01.afb.lan /etc/sysconfig/saslauthd SOCKETDIR=/var/run/saslauthd MECH=kerberos5 FLAGS= /usr/lib/sasl2/slapd.conf mech_list: plain gssapi digest-md5 cram-md5 external pwcheck_method: saslauthd saslauthd_path: /var/run/saslauthd/mux keytab: /etc/krb5.keytab SASL Mapping: nssaslmapfiltertemplate: (uid=\1) nssaslmapregexstring: $.*$(a)$.*$ /opt/fedora-ds/slapd-vafbds01/start-slapd contains: "export KRB5_KTNAME=/etc/krb5.keytab" The password entry for bsmith in FDS contains: {SASL}bsmith(a)AFB.LAN FDS supports the following SASLMechanisms #ldapsearch -x -D "uid=bsmith,ou=People,dc=afb,dc=lan" -b "" -s base supportedSASLMechanisms # extended LDIF # # LDAPv3 # base <> with scope base # filter: (objectclass=*) # requesting: supportedSASLMechanisms # # dn: supportedSASLMechanisms: EXTERNAL supportedSASLMechanisms: ANONYMOUS supportedSASLMechanisms: DIGEST-MD5 supportedSASLMechanisms: GSSAPI supportedSASLMechanisms: PLAIN supportedSASLMechanisms: LOGIN supportedSASLMechanisms: CRAM-MD5 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 DNS (forward & reverse) as well as NTP settings are correct on all hosts. Are there any obvious mistakes in my configuration or am I on the right track? Thanks in advance! Best regards, Johannes Hintermayer

3 2

[Fedora-directory-users] db2bak Question
by Steve Rigler 26 Jul '07

26 Jul '07

We use Netbackup for our backup environment and I'd like to incorporate "db2bak" into our bpstart_notify script (which is run every time a backup starts). The one thing I've noticed is these messages that appear syslog when db2bak is run: ns-slapd: sql_select option missing ns-slapd: auxpropfunc error no mechanism available Are these messages indicative of a problem? This is on RHEL4 U4 on an AMD64 system using Fedora DS 1.0.4. Thanks, Steve

3 5

RE: [Fedora-directory-users] Configuration Directory Question
by James Deuchar 26 Jul '07

26 Jul '07

Thanks for the swift response - size depends on the success of the project - am tempted to go with external config directory assuming I can get it working...I tried to the procedure I listed below i.e. installed the RPM, ran setup to create a 'dsconfig' instance on port 5555.Then I created a master.inf file for inputing into the ds_newinst.pl script:[General]FullMachineName= server1.jamesd.comSuiteSpotUserID= ldapServerRoot= /opt/fedora-dsConfigDirectoryAdminID= adminConfigDirectoryAdminPwd= blahConfigDirectoryLdapURL= ldap://server1.jamesd.com:5555/o=NetscapeRootAdminDomain= jamesd.com[slapd]ServerPort= 389ServerIdentifier= master01Suffix= dc=jamesd,dc=comRootDN= cn=Directory ManagerRootDNPwd= blahUserExistingMC=1When I ran that it seemed to work - instance called master01 was created and is running.When running the console though, it's not listed - only the Administration Server and 'dsconfig' Directory Server instance. How can I make the master01 instance appear in the admin console and also verify that master01 is using dsconfig to stores is configuration data?Thanks again> Date: Thu, 26 Jul 2007 09:33:37 -0600> From: rmeggins(a)redhat.com> To: fedora-directory-users(a)redhat.com> Subject: Re: [Fedora-directory-users] Configuration Directory Question> > James Deuchar wrote:> > Hi,> >> > I've got a what I thought was a relatively simple DS setup with two > > master DS servers doing master-master replication. In the future > > slaves may be added into the equation.> >> > Initially I installed both servers the same - as standalone DS' each > > with it's own admin server and 'in-house' o=NetscapeRoot configuration > > directory.> >> > Reading some of the Redhat docs on 'Configuration decisions' it talks > > about having the configuration directory in a separate directory > > instance - based on what I've seen from the DS setup script this > > implies supplying those details during the install of the real DS > > instances that will contain the data.> >> > Is my understanding correct? Does this mean I should be installing an > > independent configuration directory on both masters and setup > > replication between them to provide a redundant configuration > > directory alongside the redundant data directories?> For small deployments, you can have your config DS and data DS be the same.> >> > If so is the install procedure reasonable?:> >> > - install fedora RPM on server 1> > - Run setup script to create server 1 config directory> > - Run ds_newinst.pl to create data directory on the same server > > pointing it to the local config directory during setup> > - Repeat on server 2> > - Setup replication on data masters and on config directories> Sure.> >> > Many thanks!> >> > ------------------------------------------------------------------------> > Are you the Quizmaster? Play BrainBattle with a friend now! > > <http://specials.uk.msn.com/brainbattle>> > ------------------------------------------------------------------------> >> > --> > Fedora-directory-users mailing list> > Fedora-directory-users(a)redhat.com> > https://www.redhat.com/mailman/listinfo/fedora-directory-users> > > _________________________________________________________________ Feel like a local wherever you go with BackOfMyHand.com http://www.backofmyhand.com

2 1

[Fedora-directory-users] Configuration Directory Question
by James Deuchar 26 Jul '07

26 Jul '07

Hi,I've got a what I thought was a relatively simple DS setup with two master DS servers doing master-master replication. In the future slaves may be added into the equation.Initially I installed both servers the same - as standalone DS' each with it's own admin server and 'in-house' o=NetscapeRoot configuration directory.Reading some of the Redhat docs on 'Configuration decisions' it talks about having the configuration directory in a separate directory instance - based on what I've seen from the DS setup script this implies supplying those details during the install of the real DS instances that will contain the data.Is my understanding correct? Does this mean I should be installing an independent configuration directory on both masters and setup replication between them to provide a redundant configuration directory alongside the redundant data directories?If so is the install procedure reasonable?: - install fedora RPM on server 1 - Run setup script to create server 1 config directory - Run ds_newinst.pl to create data directory on the same server pointing it to the local config directory during setup - Repeat on server 2 - Setup replication on data masters and on config directoriesMany thanks! _________________________________________________________________ Try Live.com - your fast, personalised homepage with all the things you care about in one place. http://www.live.com/?mkt=en-gb

2 1

[Fedora-directory-users] Windows Sync NT4 Search Base?
by Glenn 25 Jul '07

25 Jul '07

I finally can communicate with the ldap service on my NT4 test machine, although without SSL. Now I need to know what search base to use. dc=mydomain,dc=edu doesn't work, and I have a feeling it is something unique to Windows NT rather than something unique to my installation. Anyone got a clue? Thanks. -Glenn. # ldapsearch -v -H ldap://nt4testbox.mydomain.edu -D "uid=admin,ou=system" - b "dc=mydomain,dc=edu" ldap_initialize( ldap://nt4testbox.mydomain.edu ) ldap_sasl_interactive_bind_s: No such attribute (16)

2 2

[Fedora-directory-users] Problem with Massive Replication Agreements
by Fernando Muñoz 25 Jul '07

25 Jul '07

Hi all, I have a distributed Directory Service on 25 servers with FDS 1.0.4. The replication configuration it's some complex: - One HUB server with 26 Databases(26 enabled Replicas)-> 25 HUB-Replicas with 24 replication agreements and one Multimaster-Replica with 26 replication agreements. Total replication agreements in this server it's 626 replication agreements. - 25 Supplier (on our database) with Hub server and consummers (for others databases) of Hub server. When i try to configure (automatically by script) this 626 replication agreements (on HUB server) i show this errorlog(/opt/fedora-ds/slapd-prueba/logs/errors) for each new replication agreement after 250 replication agreements aprox.: [22/Jul/2007:20:55:52 +0200] NSMMReplicationPlugin - agmt="cn=prueba1-prueba2" (prueba1:636): Unable to create protocol thread; NSPR error - -5974, Insufficient system resources. Exist some FDS limitation about massive replication agreements? or some FDS performance settings (maximun entries, caché,look-through limit, size limit, file descriptors,connection management...)? How can i solved this problem? thanks,

4 5

[Fedora-directory-users] NT4 Sync Hassle
by Glenn 24 Jul '07

24 Jul '07

I can't seem to contact my NT4 server to create a sync agreement with Fedora DS. I tried ldapsearch and it just hangs: # ldapsearch -v -H ldaps://nt4testbox.mydomain.edu -D "uid=admin,ou=system" - w password -b "dc=mydomain,dc=edu" ldap_initialize( ldaps://nt4testbox.mydomain.edu ) On the NT server, the wrapper.log reports: java.lang.NoSuchMethodError: javax.net.ssl.SSLContext.createSSLEngine() Ljavax/net/ssl/SSLEngine; It shows a lot of additional stuff with the same time stamp, ending with: org.apache.mina.util.BaseThreadPool$Worker.run(BaseThreadPool.java:279) Any idea what is wrong or how I can narrow it down? Thanks. -Glenn.

1 0

[Fedora-directory-users] FDS / HR synchronization
by Robert Ludvik 24 Jul '07

24 Jul '07

Hi Where should I start to read/look for if I'd like to achieve that user data in FDS (username and passwd for domain logon, email address, group membership (based on some employee data) ...) is synchronized with data of our HR application, which stores data in SQL (Oracle)? HR application and database are outsourced, FDS is at our company. For example, when a new employee comes and his data in entered in HR application, generated username, password, email address ... should be somehow synchronized to FDS. And, when some employee leave our company, his account in FDS becomes inactive. One way is to export date from SQL to CSV, use csv2ldif and import this LDIF to FDS. This can be done manually (or maybe even automated in some strange way). Is there a more elegant way? Thanks Robert Ludvik

2 1

[Fedora-directory-users] Performance
by Vampire D 23 Jul '07

23 Jul '07

As I understand it, OpenLDAP doesn't perform all that well under a high load. How does FDS perform in comparison to other LDAP implmentations like OpenLDAP and Sun? -- "Do the actors on Unsolved Mysteries ever get arrested because they look just like the criminal they are playing?" Christopher

11 25

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2007