[Fedora-directory-users] Referential Integrity
by Hartmann, Tim
So After my trials and tribulations with " Referrals for Update
Operations" (thanks again, you guys rock!) hence known as "Tim's
continuing LDAP Saga and Viking Cha-Cha"
I came across "Referential Integrity" in the docs, and boy howdy does it
look useful!
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Creating_Directory_E...
I had a couple of concerns, before I enabled it that I was hoping people
could chime in on!
1) I'd like to have Referential Integrity monitor the memberUid field as
well, but I was unclear in the documentation if when scanning the
directory if it scans ALL the directories hosted by a given server, or
just searches in the directory where the user was deleted?
for example, I have two root suffixes, both of which contain users and
groups , and more often then we'd like user "foo" exists in both...
dc=example,dc=edu
dc=dept,dc=example,dc=edu
if I delete user uid=foo,ou=People,dc=dept,dc=example,dc=edu
would the Referential Integrity plug in know to leave any instance of
"uid=foo" and "memberUid=foo" in the dc=example,dc=edu branch alone?
2) I have 2 Masters (set up to be Multi Masters) and 4 Replica's, There
are a number of warnings about setting this up only on 1 of the Masters
(which shouldn't be a problem), in the case that M1 is configured with
the Referential Integrity plug in, and it goes down for some amount of
time, and a user is deleted, will the plugin "Catch up" once M1 has been
brought back online?
Thanks for the input!
Tim
15 years, 2 months
Re: [Fedora-directory-users] Challenges with Fedora DS
by Premod Dev
Hi Oserome,
Why cant you try as follows,
• Create multiple masters (multi master replication)
• Use a load balancer ( hardware or software ie like linux virtual server) for load balance between these multi master servers.
• Give a common fqdn in SAMBA which should resolve to load balancer and rest will do the load balancer.
Thanks,
Premod
----- Original Message -----
From: "osereme.osobase" <osereme.osobase(a)gtbank.com>
To: fedora-directory-devel(a)redhat.com
Cc: fedora-directory-users(a)redhat.com
Sent: Wednesday, February 4, 2009 11:54:37 PM GMT +05:30 Chennai, Kolkata, Mumbai, New Delhi
Subject: [Fedora-directory-users] Challenges with Fedora DS
Hi,
I currently use Fedora-DS integrated with Samba as my domain controller in an organization with 141 offices. With only one domain controller I am able to authenticate a user population of 5000 users, however as my organization grows I have challenges daily with authentication. Every morning users trying to logon to my Windows domain keep getting errors while siging on and this frequently leads to account lockouts and frustation of users.
After going through your documentation on multiple load balanced FDS server installation I still have all traffic coming to one server on the network. My challenge is setting up FDS in the data centre on multiple servers to authenticate my users while accommodating growth. Is there any suggestion you can offer me or documentation where I can go through setup of a centalized FDS cluster for a large user base?
I will greatly appreciate any help you can proffer.
Regards
Osereme Osobase
Enterprise Infrastructure Support
Technology
GTBank Nigeria - http://www.gtbank.com
-- Fedora-directory-users mailing list Fedora-directory-users(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
15 years, 2 months
[Fedora-directory-users] Do you use WinSync for group sync?
by Rich Megginson
We're currently investigating the group sync feature of Windows Sync,
and we wanted to know how it is deployed. Do you sync groups? What
types of groups? Security or Distribution? Global or Local? Do the
groups have "meaning" in both AD and Fedora DS, or only in one side?
15 years, 2 months
[Fedora-directory-users] Question about Red Hat Directory Source Code
by Chun Tat David Chu
Hi All,
I know that Fedora Directory and Red Hat Directory is essentially same
except that Fedora Directory is usually newer than Red Hat Directory.
My question is I know I can get the source code of Fedora Directory but what
about Red Hat Directory?
I thought Red Hat Directory is also open source, is it possible to look at
Red Hat Directory source?
Thanks in advance!
- David
15 years, 2 months
[Fedora-directory-users] [OT?] tls_checkpeer yes problems
by John A. Sullivan III
Hello, all. This may be a bit off-topic as it is primarily an ldap
client issue but I am having a bear of a time getting my test centos
clients to access fds. The problem is tls_checkpeer. I do want it set
to yes but this breaks access. It is as if the directory server's cert
cannot be validated against the CA cert. Here are the pertinent
settings from my centos client ldap.conf (as you can see, I've tried
many combinations):
uri ldap://ldap.mycompany.com/
#host ldap.mycompany.com
#ssl on
ssl start_tls
#tls_cacertdir /etc/pki/tls/certs
tls_cacertfile /etc/pki/tls/certs/SSICA.pem
pam_password md5
tls_checkpeer yes
tls_ciphers TLSv1
An strace shows that the SSICA.pem file is opened. Apparently, this is
a problem in Ubuntu because of a change to gnutls. However, I can
confirm the combination of uri ldap://, ssl start_tls, and tls_certfile
rather than tls_certdir work on Ubuntu. My problem is redhat style
systems.
Our test bed is CentOS 5.2. Does anyone have this working on newer
redhat based systems? If so, with what configuration? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
15 years, 2 months
[Fedora-directory-users] Challenges with Fedora DS
by osereme.osobase
Hi,
I currently use Fedora-DS integrated with Samba as my domain controller in an organization with 141 offices. With only one domain controller I am able to authenticate a user population of 5000 users, however as my organization grows I have challenges daily with authentication. Every morning users trying to logon to my Windows domain keep getting errors while siging on and this frequently leads to account lockouts and frustation of users.
After going through your documentation on multiple load balanced FDS server installation I still have all traffic coming to one server on the network. My challenge is setting up FDS in the data centre on multiple servers to authenticate my users while accommodating growth. Is there any suggestion you can offer me or documentation where I can go through setup of a centalized FDS cluster for a large user base?
I will greatly appreciate any help you can proffer.
Regards
Osereme Osobase
Enterprise Infrastructure Support
Technology
GTBank Nigeria - http://www.gtbank.com
15 years, 2 months
[Fedora-directory-users] mail aliases in directory
by Jan-Frode Myklebust
I'm in the process of migrating to keeping all users and
mail aliases in a directory server. For people-objects we use the
object classes 'top', 'person' and 'mailRecipient', but I'm a bit
confused as to how to store pure email aliases that are not
connected to specific accounts.
I think we'll want to store these in a separate ou (ou=aliases),
but what's the correct set of object classes to use ? 'mailRecipient'
gives me all the attributes, but isn't structural. I found the
ldapSubEntry structural class that seems fitting (gives me structure,
and nothing else), but from reading the deployment guide that seems
to not be what we want.. (doesn't show up in normal searches).
# dn: mail=test(a)example.com,ou=aliases,o=example.com,o=ISP,o=mydomain,c=NO
# changetype: add
# objectClass: ldapSubEntry
# objectClass: top
# objectClass: mailRecipient
# mail: test(a)example.com
# mailForwardingAddress: test(a)sometherdomain.net
Any hints to what class should be used here instead of ldapSubEntry?
-jf
15 years, 2 months
RE: [Fedora-directory-users] Updating Consumer replica fails referralto the master from the console.
by Howard Chu
> Date: Mon, 2 Feb 2009 13:26:18 -0800
> From: "Chavez, James R."<james.chavez(a)sanmina-sci.com>
> Hi Rich,
> Thank you for your previous response..The answer was actually embedded
> within your statement I believe.
>
> "This is a problem in general with some older clients that do not know
> how to properly follow LDAPv3 referrals"
>
> I used the mozldap ldapmodify tool and it worked to update entries that
> I point at the consumer. I would have never guessed the openldap tool
> would not follow LDAPv3 referrals. Maybe a switch I missed or something.
> Thanks again for your suggestion.
The automatic referral chasing code in OpenLDAP's command line tools was
deprecated years ago. It's a security vulnerability: most of the time it will
hand your username and plaintext password to any arbitrary server without any
warning.
Referrals are a gross flaw in the design of LDAP and should not be used.
Distributed servers should use chaining to hide this detail from clients.
Clients are not in any position to know whether or to what degree to trust the
referred server, or what authentication domain or credentials are relevant on
the referred server. Only the server admin knows these details; putting these
decisions at the client is wrong.
--
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
15 years, 2 months
