[Fedora-directory-users] User password change which syntax checking
by Ross Johnson
I have FDS 1.1.1 running with password policy and syntax checking
working for user passwords via the console, but I haven't been able to
get ldappasswd (from mozldap-tools package) to pay attention to those
password constraints that I know work via the console. That is,
ldappasswd succeeds even when given passwords that fail in the console.
Is this what I should expect to see?
AFAICS from looking at source code, manual pages etc, ldappasswd passes
the plaintext password to the server to be encrypted and if that's the
case then I'm assuming that password checks should be working. I
understand that password checks can't be done if the userPassword
attribute is modified directly, e.g. by ldapmodify.
I get the feeling I'm missing something very basic, so any clarification
would be greatly appreciated.
--
Ross Johnson
Unix Specialist, IT Infrastructure
Insolvency and Trustee Service Australia
Ph: +61 2 6270 3483
Fax: +61 2 6270 3413
Important: This transmission is intended only for the use of the addressee and may contain confidential or legally privileged information. If you are not the intended recipient, you are notified that any use or dissemination of this communication is strictly prohibited. If you have received this transmission in error, please notify immediately by telephone and delete all copies of this transmission, together with any attachments.
15 years, 7 months
[Fedora-directory-users] FDS 1.1.2?
by John Dickinson
Hi
I am looking to build FDS from source and noticed that the source page
on the wiki lists FDS 1.1.2 but I can not see it in the news or on the
announce list. Is it the current release so should I stick with 1.1.1?
If it is the current release can anyone give me any pointers on
getting the console built. It seems to be missing the fedora-idm-
console tarball - or is that just not needed now?
Thanks
John
15 years, 7 months
Re: [Fedora-directory-users] User privileges
by Dharmin Mandalia
Hi Joerg
Thanks.. will soon try what you've suggested.
Regards
Dharmin
Re: [Fedora-directory-users] User privileges
Joerg Antweiler
Tue, 16 Sep 2008 03:46:58 -0700
Hi Dharmin,
you might want to work with aci's. One way to achieve what you want : define
your admin users in a meaningful ou :
your admin ou :
dn: ou=myadmins,o=some-root-suffix
ou:myadmins
objectClass: top
objectClass: organizationalunit
one of your admins :
dn: uid=Serviceadmin,ou=myadmins, o=some-root-suffix
givenName: Serviceadmin
sn: Serviceadmin
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
uid: Serviceadmin
cn: Serviceadmin
userPassword: some-password
define one corresponding aci for every ou
dn: ou=myorganizationalunit,o=some-root-suffix
aci: (targetattr = "*") (target =
"ldap:///ou=myorganizationalunit,o=some-root-suffix";) (version 3.0;acl
"Admin for myou Access ACI";allow (all)(userdn =
"ldap:///uid=Serviceadmin,ou=myadmins, o=some-root-suffix");)
ou: myorganizationalunit
objectClass: top
objectClass: organizationalunit
Finetune security in terms of
which attributes can be accessed, modified etc. ( targetattr )
allowed operations ( in my example, all operations are allowed )
Hope it gives you an idea,
Regards,
Joerg
2008/9/10 Dharmin Mandalia <[EMAIL PROTECTED]>
> Hello
>
> On our Directory Server, we have different OU's for each department, under
> which we have dept users. Is it possible to allow each department
admin's to
> add/delete/edit user/group/other entries for their own department OU
ONLY ,
> over Directory console, so basically one admin from each department have
> full access/rights over user/group/other entries under their dept OU, over
> Dir Console.
>
> If you know how above can be done, please tell me....
>
> Appreciate your reply.
>
> Regards
> Dharmin
>
>
>
> fedora-directory-users(a)redhat.com
>
>
> --
> Fedora-directory-users mailing list
> Fedora-directory-users(a)redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
15 years, 7 months
[Fedora-directory-users] User privileges
by Dharmin Mandalia
Hello
On our Directory Server, we have different OU's for each department,
under which we have dept users. Is it possible to allow each department
admin's to add/delete/edit user/group/other entries for their own
department OU ONLY , over Directory console, so basically one admin
from each department have full access/rights over user/group/other
entries under their dept OU, over Dir Console.
If you know how above can be done, please tell me....
Appreciate your reply.
Regards
Dharmin
fedora-directory-users(a)redhat.com
15 years, 7 months
[Fedora-directory-users] Error creating certificate request
by Orion Poplawski
I'm running fedora-idm-console on my F-9 box connecting to an FDS
install of the latest FDS (compiled from Fedora rawhide sources) on a
CentOS 5.2 machine. I'm trying to create a certificate request.
The DN: CN="ldap.cora.nwra.com", OU="CoRA", O="NWRA", L="Boulder",
ST="Colorado", C="US"
After entering the private key password (step 3 of 4) I get an error:
Unable to convert DN to certificate name.
Ideas?
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301 http://www.cora.nwra.com
15 years, 7 months
[Fedora-directory-users] Strange fonts
by Orion Poplawski
I've got the latest FDS code from rawhide built and installed on CentOS
5.2. If I run fedora-idm-console on the CentOS machine and display on
my F9 machine the fonts are such that the display is almost completely
blank and unreadable. The fonts are fine if I run locally on the F9 box.
Any particular fonts needed to be installed on the EL machine?
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301 http://www.cora.nwra.com
15 years, 7 months
[Fedora-directory-users] installation problems on FC8
by Marcelo N. Halpern
Hello list,
Perhaps someone can point me in the right direction. I just installed ds-1.1 and related packages. I
ran /usr/sbin/setup-ds-admin.pl in 'express' mode, and created the directory server instance. The
process fails at the very end, when the script attempts to register the admin instance.
Basic ldapsearch binding as cn="Directory Manager" also fails. Am I missing something essential, and
if so, what?
This is on Fedora 8/i386 with the following packages:
fedora-ds-console-1.1.1-2.fc6 Mon 15 Sep 2008 03:48:59 PM EDT
fedora-ds-admin-console-1.1.1-2.fc6 Mon 15 Sep 2008 03:48:57 PM EDT
fedora-ds-admin-1.1.6-1.fc8 Mon 15 Sep 2008 03:48:55 PM EDT
fedora-ds-base-1.1.0-1.2.fc8 Mon 15 Sep 2008 03:48:48 PM EDT
[15/Sep/2008:16:12:56 -0400] conn=0 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[15/Sep/2008:16:12:56 -0400] conn=0 op=0 BIND dn="cn=Directory Manager" method=128 version=3
[15/Sep/2008:16:12:56 -0400] conn=0 op=0 RESULT err=49 tag=97 nentries=0 etime=0
[15/Sep/2008:16:12:56 -0400] conn=0 op=1 UNBIND
[15/Sep/2008:16:12:56 -0400] conn=0 op=1 fd=64 closed - U1
[15/Sep/2008:16:13:44 -0400] conn=1 fd=64 slot=64 connection from 127.0.0.1 to 127.0.0.1
[15/Sep/2008:16:13:44 -0400] conn=1 op=0 BIND dn="cn=Directory Manager" method=128 version=3
[15/Sep/2008:16:13:44 -0400] conn=1 op=0 RESULT err=49 tag=97 nentries=0 etime=0
[15/Sep/2008:16:13:44 -0400] conn=1 op=-1 fd=64 closed - B1
Thank you,
nh
--
Marcelo Nicolás Halpern
Systems Administrator
Accoona Corporation
15 years, 7 months
