Views, Filtered roles and CoS
by Colin Panisset
I have a pretty flat DIT, with all users currently under
ou=people,dc=example,dc=com; these user objects also have posixAccount
attributes, of which loginShell is one.
What I'm trying to achieve is to be able to set a "default" loginShell
to be a restricted shell (/bin/rbash) for developers, but allow that to
be a non-restricted shell on systems which are development hosts.
As an example, on a production host I'd like:
$ ldapsearch -x "(uid=devuser)" uid loginshell
to return:
dn: cn=Dev User,ou=People,dc=example,dc=com
loginShell: /bin/rbash
uid: devuser
while on a development host, I'd like the same search to return
dn: cn=Dev User,ou=People,dc=example,dc=com
loginShell: /bin/bash
uid: devuser
I thought I might be able to achieve this by creating a view called
ou=Developers,dc=example,dc=com and using that as a base DN on the
development boxes, then applying a CoS within the view to override the
loginShell attribute, but then the CoS ends up being applied to the
original entry too.
Is there any way that I could:
- have a CoS apply based on client system attributes, like IP
address/hostname?
- have a CoS which applies to a view that *doesn't* affect the original
object?
- perhaps make use of cosPriority through two different views, so as to
have ou=Development,... and ou=Production,... (but that would be
answered by the previous option anyway)?
Is there some other clever way to achieve what I'd like? I'd really like
to avoid maintaining 2 separate DITs for the same set of users.
-- C.
12 years, 6 months
Failed to convert DN uid=<username> to RDN
by Aleksey Mykhailov
Hello,
I have fresh installed 389 directory server on RHEL6 from EPEL and rmeggins
repo
supplier - an old NetscapeDirectory server 4.12
consumer - 389 directory server Version 1.2.9.9
**consumer userRoot database is Updatable by a 4.x Replica
it works fine , my clients not experience any problems but in logs I see a
lot these messages:
[06/Oct/2011:12:41:59 +0300] _entry_set_tombstone_rdn - Failed to convert DN
uid=<username> to RDN
[06/Oct/2011:12:41:59 +0300] id2entry - str2entry returned NULL for id 1363,
string="rdn"
[06/Oct/2011:12:41:59 +0300] _entry_set_tombstone_rdn - Failed to convert DN
uid=<username> to RDN
[06/Oct/2011:12:41:59 +0300] id2entry - str2entry returned NULL for id 1364,
string="rdn"
I've tried to reinitialize consumer , but this didn't help ..
12 years, 6 months
Odd SSL Issues
by Craig T
Hi,
Setup:
Fedora 15 x64
* 389-admin-1.1.23-1.fc15.x86_64
* 389-admin-console-1.1.8-1.fc15.noarch
* 389-admin-console-doc-1.1.8-1.fc15.noarch
* 389-adminutil-1.1.14-1.fc15.x86_64
* 389-console-1.1.7-1.fc15.noarch
* 389-ds-1.2.2-1.fc15.noarch
* 389-ds-base-1.2.9.10-2.fc15.x86_64
* 389-ds-base-libs-1.2.9.10-2.fc15.x86_64
* 389-ds-console-1.2.6-1.fc15.noarch
* 389-ds-console-doc-1.2.6-1.fc15.noarch
* 389-dsgw-1.1.7-2.fc15.x86_64
Disclaimer:
I'm pretty new to 389 Directory Server so this might be a simple question.
Goal:
I am attempting to install a CA & server certificate, which I have signed by my own openssl CA.
My Steps:
After using the 389 Console to generate my certificate request, I was then able to sign it with my openssl CA and install the cert (plus CA cert) into the 389 Directory Server without issue. I then choose the;
- "Enable SSL for this server" option and selected the security device and server cert "server-crt2".
- I checked the CA cert and it showed that there was no broken links in the certification paths.
Issue:
After restarting Directory Server, I was surprised to see the following error;
-----------------------------------------------------------------------------------------
[04/Oct/2011:17:39:09 +1100] - SSL alert: Security Initialization: Can't find certificate (server-cert2) for family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - security library: bad database.)
[04/Oct/2011:17:39:09 +1100] - SSL alert: Security Initialization: Unable to retrieve private key for cert server-cert2 of family cn=RSA,cn=encryption,cn=config (Netscape Portable Runtime error -8174 - security library: bad database.)
[04/Oct/2011:17:39:09 +1100] - SSL failure: None of the cipher are valid
[04/Oct/2011:17:39:09 +1100] - ERROR: SSL Initialization phase 2 Failed.
-----------------------------------------------------------------------------------------
I feel like I must be missing something pretty obvious, any suggestions?
cya
Craig
12 years, 6 months
passsync - ldap error in queryusername
by Aaron Hagopian
Recently this message started to show up on our windows domain controller in
the passsync log file:
...
09/29/11 14:38:50: Ldap error in QueryUsername
1: Operations error
09/29/11 14:39:54: Ldap error in QueryUsername
1: Operations error
09/29/11 14:42:02: Ldap error in QueryUsername
1: Operations error
09/29/11 14:46:18: Ldap error in QueryUsername
1: Operations error
...
Happen fairly sporadically but password changes from this machine are also
being abandoned while on others no issues. This is our only 2008 domain
controller as the moment but it was working on this machine and another 2008
DC (that was de-commissioned) previously.
Thanks,
Aaron Hagopian
12 years, 6 months
Start TLS request accepted. Server willing to negotiate SSL
by David Hoskinson
While attempting to change a directory password I keep getting this message...
[root@xxx ~]# ldappasswd -x -ZZ -D "cn=directory manager" -w "mypass" uid=se253264,ou=people,dc=xxx,dc=cle=dc=us" -a "oldpass" -s "newpass"
ldap_start_tls: Connect error (-11)
additional info: Start TLS request accepted.Server willing to negotiate SSL.
In researching this I found to add -d1 for additional debugging information and found this probably relevant
TLS: could not load client CA list (file:`',dir:`/etc/openldap/cacerts/cacert.asc').
TLS: error:0200A014:system library:opendir:Not a directory ssl_cert.c:816
TLS: error:140D7002:SSL routines:SSL_add_dir_cert_subjects_to_stack:system lib ssl_cert.c:818
ldap_perror
I do have the following in my /etc/ldap.conf file
ssl yes
tls_cacertdir /etc/openldap/cacerts
TLS_REQCERT allow
pam_password exop
And the cacert.asc does exist in that directory. This is the cacert.asc that was created during setup of this machine using the setupssl.sh script and I copied it to the requested directory. I am not seeing anything additional on the HowtoSSL page and realize that TLS is necessary for the password change function.
Thanks for any help you may have. I am also under the impression I am supposed to copy the cacert.asc to each client machine so they can authenticate against the cert. is this true also?
David Hoskinson | DATATRAK International
Systems Engineer
Mayfield Heights, Ohio, USA
+1.440.443.0082 x 124 (p) | +1.216.280.5457 (m)
david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>
12 years, 6 months
