January 2008 - 389-users - Fedora Mailing-Lists

[Fedora-directory-users] Problem with computer accounts and smbldap-tools

by Gary Martin

I am creating a samba PDC with a FDS passdb backend on Fedora 8. I am having trouble using smbldap tools to integrate and add the computer accounts to the domain. Does any one have a how to for smbldap-tools that picks up where the Howto:Samba wiki leaves off. Thanks.

16 years, 2 months

1
0
0 / 0

[Fedora-directory-users] resource limits for replication manager

by George Holbert

Just curious if anyone knows: Would there ever be a need to extend search resource limits for cn=replication manager,cn=replication,cn=config ? For example, set higher-than-default values for replication manager on any of: nsSizeLimit nsLookThroughLimit nsTimeLimit nsIdleTimeout Or is the replication manager immune to resource limits, like cn=directory manager? Thanks, -- George

16 years, 2 months

2
1
0 / 0

[Fedora-directory-users] Fedora 1.1 source

by kiran madala

Hi, Where can I get the source for FDS 1.1? I am particularly looking at the Windows Sync module _________________________________________________________________ Use fowl language with Chicktionary. Click here to start playing! http://puzzles.sympatico.msn.ca/chicktionary/index.html?icid=htmlsig

16 years, 2 months

2
4
0 / 0

[Fedora-directory-users] fedora-ds 1.1.0 on fedora core 5

by sigid＠JINLab

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Is there any posibilities to install fedora-ds 1.1.0 on fedora core 5? thanks -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFHnUlOqiPNNgPlDu0RAlz/AJ4rOGny1yvJy+s1L7bObQfM4HywbwCgyf7R LVNIWqIPqrLeAJRJad9RR38= =cWFf -----END PGP SIGNATURE-----

16 years, 2 months

2
1
0 / 0

Re: [Fedora-directory-users] ldap commands require "-Y GSSAPI". Fixable with "Identity Mapping" ?

by Howard Chu

> Date: Fri, 25 Jan 2008 12:57:55 -0700 > From: Rich Megginson<rmeggins(a)redhat.com> > Listbox wrote: >> Hi folks, >> >> I have sasl-gssapi installed. But to use any ldap clients like ldapsearch or >> ldapmodify, I must specify "-Y GSSAPI" , else I get a "no mechanism >> available" error. Is this an "Identity Mapping" problem, an ldap.conf >> problem, or is it "as designed"? >> > OpenLDAP ldapsearch, ldapmodify, etc. (/usr/bin/ldapsearch etc.) attempt > to use SASL by default. If you use the -x argument, it will use simple > userDN/password bind. It sounds like, since he went to the effort of installing sasl-gssapi, that he actually wants to use SASL Binds though. When no mechanism is specified, the client library tries to read the supportedSASLMechanisms attribute from the server's rootDSE. If the rootDSE is unreadable (due to ACLs most likely) then you'll get this type of failure. >> My ldap.conf man page says that "SASL_MECH" is a per-user setting in >> .ldaprc, so I worry that my services without a login will not use LDAP >> correctly. >> I read >> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Introduction_to_SASL-SA >> SL_Identity_Mapping.html >> and the next section on "Realms" but the docs don't say if one should >> actually put "cn=gssapi,cn=auth" into the SASL map. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc/ Chief Architect, OpenLDAP http://www.openldap.org/project/

16 years, 2 months

1
0
0 / 0

[Fedora-directory-users] ldap commands require "-Y GSSAPI". Fixable with "Identity Mapping" ?

by Listbox

Hi folks, I have sasl-gssapi installed. But to use any ldap clients like ldapsearch or ldapmodify, I must specify "-Y GSSAPI" , else I get a "no mechanism available" error. Is this an "Identity Mapping" problem, an ldap.conf problem, or is it "as designed"? My ldap.conf man page says that "SASL_MECH" is a per-user setting in .ldaprc, so I worry that my services without a login will not use LDAP correctly. I read http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Introduction_to_SASL-SA SL_Identity_Mapping.html and the next section on "Realms" but the docs don't say if one should actually put "cn=gssapi,cn=auth" into the SASL map. Thanks! *************************** *************************** *************************** [installer@trixter ~]$ ldapsearch -V ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.34 (Nov 2 2007 08:16:21) $ kojibuilder@xenbuilder2.fedora.redhat.com:/builddir/build/BUILD/openldap-2.3 .34/openldap-2.3.34/build-clients/clients/tools (LDAP library: OpenLDAP 20333) SASL/EXTERNAL authentication started ldap_sasl_interactive_bind_s: Unknown authentication method (-6) additional info: SASL(-4): no mechanism available: *************************** *************************** *************************** [installer@trixter ~]$ ldapsearch -V -Y GSSAPI > /dev/null ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.34 (Nov 2 2007 08:16:21) $ kojibuilder@xenbuilder2.fedora.redhat.com:/builddir/build/BUILD/openldap-2.3 .34/openldap-2.3.34/build-clients/clients/tools (LDAP library: OpenLDAP 20333) SASL/GSSAPI authentication started SASL username: installer(a)HYMESRUZICKA.ORG SASL SSF: 56 SASL installing layers

16 years, 2 months

2
1
0 / 0

[Fedora-directory-users] Can't create users, time for complete wipe and re-install?

by Listbox

Hi folks, I'm really stumped by this "Insufficient 'add' privilege" problem. I can create all the "Administrators" I want for the netscaperoot directory, but none of those users can: A) Create new users for my hymesruzicka directory B) Create a new "Directory Administrator" for my hymesruzicka directory C) Grant "'add' privilege" to my existing "Configuration Administrator" my hymesruzicka directory D) Add a user from the netscaperoot users to my hymesruzicka directory "Directory Administrator" group E) Modify or add the existing ACLs for my hymesruzicka directory Is there a way to create a new "Directory Administrator" and other users? If not, and we have to wipe and re-install from scratch, what must we do to ensure that we can create users and administrators for our directory? Thanks!

16 years, 2 months

2
7
0 / 0

[Fedora-directory-users] Issue with Fedora DS Client Setup on HP???/

by Singh Raina, Ajeet

Hello, I have installed Fedora DS Client on RHEL machine. I was trying to setup Client on HP-UX and am able to list all the DS users created through ldapsearch command.but am not able to see any output through nsquery or pwget command .Even the id command is not working/showing any output. Earlier I upgraded my machine from HP-UX 11.00 to 11.11 PA RISC System and downloaded and installed the patches needed and listed in hp website documentation but am finding only a single change in ldap.conf file that's it. I modified the nsswitch.conf as follows: # # /etc/nsswitch.hp_defaults: # # @(#)B.11.11_LR # # An example file that could be copied over to /etc/nsswitch.conf; it # uses NIS (YP) in conjunction with files. # passwd: files ldap group: files ldap hosts: dns networks: files protocols: nis [NOTFOUND=return] files rpc: nis [NOTFOUND=return] files publickey: nis [NOTFOUND=return] files netgroup: nis [NOTFOUND=return] files automount: files nis aliases: files nis services: nis [NOTFOUND=return] files ~ This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.

16 years, 2 months

3
2
0 / 0

[Fedora-directory-users] Certutil procedure Incorrect & not adding Certificates to CA Certs?

by Anthony Giggins

http://www.redhat.com/docs/manuals/dir-server/ag/8.0/certutil-procedure. html This procedure seems to contain errors some errors, mostly only capitalization errors, but none the less they probably should be fixed 10. should be certutil -L -d . -n "CA certificate" -a > cacert.asc ie. NOT Certificate with a Capital C certutil -L -d . -n "CA Certificate" -a > cacert.asc Also 11. has the same problem it should be pk12util -d . -o cacert.pk12 -n "CA certificate" Also The procedure creates 2 Server Certs and no CA Certs can anyone please confirm the correct commands to add the certificates to the CA Certs rather then the Server Certs I'm also getting issues when using the setupssl2.sh script ( http://directory.fedoraproject.org/download/setupssl2.sh ) on the wiki (I am running version Fedora Directory Server 1.1 on Centos 5.1 from the Fedora 6 yum repositories using the procedure http://directory.fedoraproject.org/wiki/Download#Enterprise_Linux_5 ) Regards, Anthony

16 years, 3 months

2
3
0 / 0

[Fedora-directory-users] Authenticate before querying ldap.

by shivaraj.shivanna＠wipro.com

Hi, Our organization has an AD server running which requires you to bind to it first before querying the server. For example commands like ldapsearch -x -h "some ip" "(cn=abcd)" -b "some base" would fail with LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection. but commands like ldapsearch -x -h "some ip" "(cn=abcd)" -b "some base" -D "some user dn" -W would work on entering correct password. How can we replicate this behavior with the fedora directory server ? Regards, Shivraj

16 years, 3 months

5
5
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users January 2008