April 2011 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

LDAPCon 2011 Call for Papers
by Peter Gietz 08 Aug '11

08 Aug '11

With the usual apologies. The 3rd Edition of the International Conference on LDAP (LDAPCon 2011[1]) will be held on October, 10-11, 2011 in Heidelberg, Germany. A Call For Papers[2] has been raised and the Program Committee asks you to submit abstracts by July 8th. The International Conference on LDAP is a technical forum for IT professionals interested in LDAP and related topics like directory servers, directory management applications, directory integration, identity and access management, and meta directories. It focuses on implementation and integration of LDAP servers and LDAP-enabled client applications. The event will bring together vendors, developers, active and prospective LDAP practitioners to share their experiences about deployment strategies, service operations, interoperability, discuss LDAP usage in new projects and learn about upcoming trends and developments. The 1st LDAPCon[3] was held in September 2007 in Germany, the 2nd LDAPCon[4] was held in September 2009 in Portland, Oregon, USA (Some pictures from LDAPCon 2007 [5] and a nice summary of LDAPCon 2009 [6]) So if you're involved with LDAP in interesting projects and you want to share your experiences, please check the Call For Papers and submit a proposal. Best, Peter [1]: http://www.ldapcon.org [2]: http://www.daasi.de/ldapcon2011/index.php?site=cfp [3]: http://www.guug.de/veranstaltungen/ldapcon2007/index.html [4]: http://www.symas.com/ldapcon2009 [5]: http://www.flickr.com/photos/ludovic_p/sets/72157601937159198/detail/ [6]: http://blogs.sun.com/Ludo/entry/ldapcon_2009_summary -- _______________________________________________________________________ Peter Gietz (CEO) DAASI International GmbH phone: +49 7071 407109-0 Europaplatz 3 Fax: +49 7071 407109-9 D-72074 Tübingen mail: peter.gietz(a)daasi.de Germany Web: www.daasi.de DAASI International GmbH, Tübingen Geschäftsführer Peter Gietz, Amtsgericht Stuttgart HRB 382175 Directory Applications for Advanced Security and Information Management _______________________________________________________________________

1 2

Re: [389-users] get base dn from ldapsearch
by Angel Bosch Mora 15 Jul '11

15 Jul '11

> Maybe I am understanding this wrong but could you not just check in > the config what the search base is set to on the client side? What is > the problem you are trying to solve? > yes, you're right. i can just take a look at ldap.conf but there's several places to look: - debian/ubuntu uses /etc/ldap/ldap.conf - RHEL/CentOS uses /etc/openldap/ldap.conf - custom compilations can use any path. ex: /usr/local/ldap/ldap.conf - windows openldap uses... i don't really know :P so what im trying to do is resolving configured base without knowing anything about the client. for example, this command gives me the server even if i dont know anything about the conf: ldapsearch -d1 -x -LLL "(uid=example)" uid 2>&1 | grep ldap_connect_to_host im just a little bit surprised that i can't find any debuglevel that gives me the BASE abosch

8 17

Referral errors ....
by Reinhard Nappert 05 May '11

05 May '11

Hi, I have the following setup: I have a 2 multimaster replication setup, where both masters also have a number of shadowing agreements to other consumers. The data gets replicated to all boxes and there are no issues. When I try to perform an update on the slaves, it works on all, but one. Meaning, the server sends back err=10, with the referral to one of the masters and the client automatically follows the referrals. Unfortunately, it does not works with one box: When there is an attempt to write to the db, the server returns an error-code 1, with the following message: javax.naming.NamingException: [LDAP: error code 1 - Mapping tree node for o=base is set to return a referral, but no referral is configured for it]; This can also be seen in the access file: [26/Apr/2011:05:35:45 -0300] conn=3418 op=13256 ADD dn="ou=test,o=base" [26/Apr/2011:05:35:45 -0300] conn=3418 op=13256 RESULT err=1 tag=105 nentries=0 etime=0 When I have a look at the configuration, it looks exactly like the others: dn: cn="o=Base",cn=mapping tree,cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree cn: "o=Base" nsslapd-state: referral on update nsslapd-backend: userRoot modifiersName: cn=server,cn=plugins,cn=config modifyTimestamp: 20100721202730Z nsslapd-referral: ldap://master-ld01:389/o=Base nsslapd-referral<ldap://master-ld01:389/o=Basensslapd-referral>: ldap://master-ld02:389/o=Base numSubordinates<ldap://master-ld02:389/o=BasenumSubordinates>: 1 dn: cn=replica,cn="o=Base",cn=mapping tree,cn=config nsDS5ReplicaBindDN: cn=replication,cn=config nsDS5ReplicaRoot: o=Base nsDS5Flags: 0 nsDS5ReplicaType: 2 nsds5ReplicaPurgeDelay: 43200 objectClass: top objectClass: nsDS5Replica cn: replica modifiersName: cn=Multimaster Replication Plugin,cn=plugins,cn=config modifyTimestamp: 20110421052744Z nsDS5ReplicaId: 65535 nsState:: //8AAAAAAADLv69NAAAAAAAAAAAAAAAALSoAAAAAAAAIAAAAAAAAAA== nsDS5ReplicaName: 59480b7e-94fb11df-9df8eeea-774385c0 nsDS5ReplicaReferral: ldap://master-ld01:389/o=Base nsDS5ReplicaReferral<ldap://master-ld01:389/o=BasensDS5ReplicaReferral>: ldap://master-ld02:389/o=Base I was wondering if someone has seen this kind of issue. Everything looks fine to me and I can not explain this behavior. Right now, I can not reproduce this issue. I only see it in this one setup. Thanks, -Reinhard

2 10

Active Directory to 389 Directory Server Sync
by Augustine Ike 27 Apr '11

27 Apr '11

Good Morning All, How is everyone? Hope fine? I install the 389 Directory Server and it works very well. I am trying to update the Users by performing a Unidirectional Sync from Active Directory. After this, I intend syncing passwords too. For now, I can't even get the sync to work. I have followed everything in the DOCS and still no luck. That said, the sync operation says it's successful but then the OU's remain empty. If I add an Entry in The Directory Server and Active Directory, I get an error so I know some things is happening. Any thoughts? Thanks Augstine

3 4

userpasswd not replicating
by Yonathan Dossow 26 Apr '11

26 Apr '11

Hi, I'm using luma to modify users passwords, until 389-ds-base 1.2.6 everything worked ok. but with 1.2.8.2 the updated password isn't propagating to the slaves. However, with 389-console, passwd or even ldapmodify it works ok. auditing the process, I found that luma deletes the userpasswd attibute and adds it again. 389-console and passwd only modifies the attribute. I have 4 ldap servers (1 master, 3 slaves) and 1 AD server. Is this behavior expected in 1.2.8.2? I'm attaching audit logs for luma and passwd, for the master and one slave. thanks -- Yonathan H. Dossow Acun~a Unidad de Servicios de Computacion e Internet Fono: +56 32 2654367 Universidad Tecnica Federico Santa Maria Valparaiso, Chile

2 5

Announcing 389 Directory Server version 1.2.8.2
by Rich Megginson 26 Apr '11

26 Apr '11

The 389 Project team is pleased to announce the release of 389-ds-base-1.2.8.2. This is the first Stable release from the 1.2.8 branch. Since the last Stable release (1.2.7.5) there have been many bug fixes and a couple of new features. Installation yum install --enablerepo=updates-testing 389-ds # or for EPEL yum install --enablerepo=epel-testing 389-ds setup-ds-admin.pl Upgrade yum upgrade --enablerepo=updates-testing 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console # or for EPEL yum upgrade --enablerepo=epel-testing 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console setup-ds-admin.pl -u How to Give Feedback The best way to provide feedback is via the Fedora Update system. Each update is broken down by package and platform. For example, if you are using Fedora 13, and you have successfully installed or upgraded all of the packages, and the console and etc. works, then go to the links below for Fedora 13 and provide feedback. * EL-5 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.2-1.el5 * Fedora 13 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.2-1.fc13 * Fedora 14 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.2-1.fc14 * Fedora 15 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.2-1.fc15 scroll down to the bottom of the page, and click on the Add a comment >> link * select one of the Works for me or Does not work radio buttons, add text, and click on the Add Comment button If you are using a build on another platform, just send us an email to 389-users(a)lists.fedoraproject.org Reporting Bugs If you find a bug, or would like to see a new feature, you can enter it here - https://bugzilla.redhat.com/enter_bug.cgi?product=389 More Information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

1 0

master stops responding when slave cannot be updated
by brandon 26 Apr '11

26 Apr '11

Okay, I don't know if this is the designed behaviour or not, but we have a single master server with one slave, and we shutdown the slave to rebuild it, but did not remove the replication agreement. The master server stopped responding to queries after a period of time, and did not start servicing queries again until the slave came back online and it was able to complete its replication (read-only queries, nothing that should require changes). Is this the designed behaviour? Running 389-ds-base-1.2.7.5-1 on the Master 389-ds-base-1.3.3-1 on the Slave On the master, there are a bunch of log messages about the Replication Manager getting TCP connection reset by pee, Consumer failed to replay change, and DSA is unwilling to perform. These were expected, since the slave was down. If it would help, I can digup those entries. Thanks, -Brandon

2 3

Replication error acquiring replica: permission denied error code 3
by 馬小布 26 Apr '11

26 Apr '11

Hi , all : I'm attempting to get single-master replication working but am stuck with this cryptic "error code 3". Are there detailed descriptions of the error codes somewhere? I followed the directions on this page to a T, but it seems something is still missing: http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Adminis…<http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Managing_Replicatio…> <http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Managing_Replicatio…> Thanks in advance... <http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Managing_Replicatio…>

1 1

Error using db2ldif to backup NetscapeRoot
by Diego Woitasen 25 Apr '11

25 Apr '11

Hi, I'm using db2ldiff to backup all my databases (139). It works fine for all databases but NetscapeRoot.The ldiff is written but there is an weird output when I run the command: /opt/dirsrv/lib/dirsrv/slapd-mreldc03/db2ldif -n NetscapeRoot -a /tmp/xx Exported ldif file: /tmp/xx ldiffile: /tmp/xx [25/Apr/2011:13:02:12 -0300] ldif2dbm - _get_and_add_parent_rdns: Failed to position at ID 170 [25/Apr/2011:13:02:12 -0300] - ldbm2ldif: Failed to get dn of ID 170 [25/Apr/2011:13:02:12 -0300] ldif2dbm - _get_and_add_parent_rdns: Failed to position at ID 170 [25/Apr/2011:13:02:12 -0300] - ldbm2ldif: Failed to get dn of ID 171 [25/Apr/2011:13:02:12 -0300] ldif2dbm - _get_and_add_parent_rdns: Failed to position at ID 170 [25/Apr/2011:13:02:12 -0300] - ldbm2ldif: Failed to get dn of ID 172 [25/Apr/2011:13:02:12 -0300] ldif2dbm - _get_and_add_parent_rdns: Failed to position at ID 170 . . . . [25/Apr/2011:13:11:28 -0300] - ldbm2ldif: Failed to get dn of ID 337 [25/Apr/2011:13:11:28 -0300] ldif2dbm - _get_and_add_parent_rdns: Failed to position at ID 294 [25/Apr/2011:13:11:28 -0300] - ldbm2ldif: Failed to get dn of ID 325 [25/Apr/2011:13:11:28 -0300] ldif2dbm - _get_and_add_parent_rdns: Failed to position at ID 294 [25/Apr/2011:13:11:28 -0300] - ldbm2ldif: Failed to get dn of ID 353 [25/Apr/2011:13:11:28 -0300] ldif2dbm - _get_and_add_parent_rdns: Failed to position at ID 294 [25/Apr/2011:13:11:28 -0300] - ldbm2ldif: Failed to get dn of ID 353 [25/Apr/2011:13:11:28 -0300] - export NetscapeRoot: Processed 267 entries (100%). [25/Apr/2011:13:11:28 -0300] - All database threads now stopped Shall I worry about that lines? Regards, Diego -- Diego Woitasen

3 9

Multimaster Replication problem
by 馬小布 25 Apr '11

25 Apr '11

Hi, all : I have two 389 directory server and then want to config the multimater replication . I googled for some information and found this website: http://www.directory.fedora.redhat.com/wiki/Howto:WalkthroughMultimasterSSL I refer to that, but not successful , I think maybe it is the following problem: test@test ~: cat tmp.ldif dn: cn=replication manager,cn=config changetype: add objectclass: top objectclass: person cn: Replication Manager sn: Manager userPassword: PASSWORD test@test ~: ldapmodify -x -D "cn=Directory Manager" -w xxx -f tmp.ldif add new entry "cn=replication manager,cn=config" I don't see the user being successfully added... it is ok ? by the way , is there need to create that account to config the replication ? Thanks in advance.....

1 0

how to sync 389 Directory servers
by 馬小布 25 Apr '11

25 Apr '11

Hi, all : I have two 389 directory servers on different servers , how can I sync the datas on them ? like master/slave replication ? Thanks...

2 1

389 ds packages for EL6?
by Rupert Kolb 21 Apr '11

21 Apr '11

Hi, are there rpm packages to install 386 Directory Server at EL6? (I found packages for EL5 only) Thanks Rupert Kolb

4 5

RHEL6?
by Steven Jones 21 Apr '11

21 Apr '11

Hi, What packages/rpms/debs are needed to build a 389 master with a master to master replication and Microsoft AD password sync capability and on what OS? I suppose Im asking what would be a recommended or "the best" OS platform to base FDS on? ;] I need to support a few hundred users, I need business/enterprise class stability so Im assuming Fedora isnt it, (I cant see how it would meet a businesses need for many years of stability? it development is way to fast I suspect?) I would be happy with RHEL6, Debian6 or Centos X or Ubuntu X as 4 obvious possibilities given I have experience enough on the first two of these in particular. regards Steven

2 1

Unable to query anything in DB after import
by brandon 19 Apr '11

19 Apr '11

So I am a little at a loss here, perhaps somebody out there has some insight I am missing (likely obvious, knowing my luck). I have a 389-ds 1.1.3-5 (redhat epel RPM) / i386 directory server, I ran db2ldif to export the data. Then on a new host running 389-ds-1.2.1-1 / x86_64, I ran ldif2db and imported the data. I can see the entries when I browse it from 389-console, and if I run db2ldif all of the data is there, but if I do an ldapsearch query, it returns no results, which is not how it should be. The command: ldapsearch -D dn.. -W -x -H ldap://newhost uid This search returns zero results, and no errors. If I point it against the old server where the data came from, it returns 366 results. Thoughts? -Brandon

2 1

Announcing 389 Directory Server version 1.2.8.2 Testing
by Rich Megginson 18 Apr '11

18 Apr '11

The 389 Project team is pleased to announce the release of 389-ds-base-1.2.8.2. This release has fixes for bugs found in 1.2.8 testing and bugs from earlier releases. Installation yum install --enablerepo=updates-testing 389-ds # or for EPEL yum install --enablerepo=epel-testing 389-ds setup-ds-admin.pl Upgrade yum upgrade --enablerepo=updates-testing 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console # or for EPEL yum upgrade --enablerepo=epel-testing 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console setup-ds-admin.pl -u How to Give Feedback The best way to provide feedback is via the Fedora Update system. Each update is broken down by package and platform. For example, if you are using Fedora 13, and you have successfully installed or upgraded all of the packages, and the console and etc. works, then go to the links below for Fedora 13 and provide feedback. * EL-5 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.2-1.el5 * Fedora 13 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.2-1.fc13 * Fedora 14 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.2-1.fc14 * Fedora 15 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.2-1.fc15 scroll down to the bottom of the page, and click on the Add a comment >> link * select one of the Works for me or Does not work radio buttons, add text, and click on the Add Comment button If you are using a build on another platform, just send us an email to 389-users(a)lists.fedoraproject.org Reporting Bugs If you find a bug, or would like to see a new feature, you can enter it here - https://bugzilla.redhat.com/enter_bug.cgi?product=389 More Information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

1 0

help in creating Groups
by perl pra 15 Apr '11

15 Apr '11

Hi Gurus, I am brand new to 389-ds, I have installed 389-ds yesterday. I am able to create OU and User. Now i have Queries on the following. 1) Hwo to say dirsrv that 'sn' of user should be used to login.(loginattribute) 2) Hwo to create groups in 389-ds under a OU. 3) Hwo to assign users to a group. 4) Hwo to assign email address to a user. Please help me with the above queries. Thanks, Siva

1 0

PassSync btw ADS and 389DS
by Ashay 14 Apr '11

14 Apr '11

Dear All, I am facing an issue while installing a 389-passsync msi utility on a Windows 2003 ADS (i386) server so that I can reset the passwords of users from ADS to the 389-directory service. I downloaded the utility from http://port389.org 's download link. The same software is installed on a different ADS server in the same forest which successfully resets the password on 389 DS. The problem is when i install and configure the ADS, the SSL gets configured properly(successfully verified the .crt certificate file and attempting Ldp.exe connection to 389DS) but when I reset the password of any user, the ADS doesnt make a connection attempt to 389DS (checked using tcpdump). Thus the password on 389DS is not resetted. On investigating I found that the passhook.dat file is not created on ADS even after repeated attempts of re-installation of 389-passsync msi utility. The passsync.log file shows that the services is successfully started and running. Can anyone throw some light as to what may be going wrong here? Let me know in case require anymore information.. Thanks, Regards, Ashay. -- Minute Quote: ########################################################################### Nietzsche says that we will live the same life, over and over again. God -- I'll have to sit through the Ice Capades again. -- Woody Allen, "Hannah and Her Sisters" ###########################################################################

1 1

Replica and Windows Sync
by jean-Noël Chardron 13 Apr '11

13 Apr '11

Hello, In a first time I configured the synchronisation between one AD and one 389DS. it is working fine. Now, I would like to mount a new one 389DS that will be a replica read-only of the first : I read this doc : http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html/Adminis… http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/7.1/html/Adminis… From this picture I want something more simple like : Consumer read-only (replica)<-----> Supplier Read-Write <----Sync---> Windows AD I don't see how I can configure the replication on the Supplier The supplier sync with AD a database that contains user and group of the AD The supplier has one more database with Unix user and group (I can enable replica on this database and it is working (it is a single master) , I got the replication of this database on the consumer) The problem is for the first database (AD) that is a dedicated consumer for the Windows AD. I dont see how configure as a single master to do the replication to the consumer. Support or explanation will help me Thanks, -- Jean-Noel Chardron

3 7

Re: [389-users] Error in Replication
by Kamal Batra 12 Apr '11

12 Apr '11

Hi, I have successfully installed the 389DS and able to do ldapsearch the users on my ldap server. I would like to integrate the 389DS to my bluecoat box to authenticate users via LDAP. On my bluecoat box I am also able to browse the my 389DS Ldap server. While doing the user authentication on my browser, I am not able to authenticate and my logs in 389DS show as [12/Apr/2011:14:49:32 +051800] conn=8 op=4 SRCH base="ou=Delhi,ou=Response,dc=response,dc=com" scope=2 filter="(cn=gpillai2101)" attrs="1.1" [12/Apr/2011:14:49:32 +051800] conn=8 op=4 RESULT err=0 tag=101 nentries=0 etime=0 Can anybody help me in resolving this issue, so that I can authenticate the users in Internet Explorer to Bluecoat which is in turn using 389DS as Ldap server for authentication. Regards Kamal Batra

1 0

New Windows Active Directory Sync to 389 Directory Server
by Augustine Ike 12 Apr '11

12 Apr '11

Good Afternoon All, How are you all doing today? Hope fine? I need some help setting up 389 Directory Server Sync. I have setup the server and it works. I have also tested imports from ldif and it works. The server does fine as a stand alone server. The problem is in syncing with Windows Active Directory. I want to update the 389 Directory Server with OU entries from Active Directory. The agreement comes up sucessfully but I don't see anything in the OU in the 389 Directory Server. Based on the documentation, I have not setup SSL because I am under the impression that it is for password sync only. Can some one help me on this. I am going nuts. Thanks Augustine

1 0

Announcing 389 Directory Server version 1.2.8.1 Testing
by Rich Megginson 11 Apr '11

11 Apr '11

The 389 Project team is pleased to announce the release of 389-ds-base-1.2.8.1. This release has fixes for bugs found in 1.2.8 testing and bugs from earlier releases. Installation yum install --enablerepo=updates-testing 389-ds # or for EPEL yum install --enablerepo=epel-testing 389-ds setup-ds-admin.pl Upgrade yum upgrade --enablerepo=updates-testing 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console # or for EPEL yum upgrade --enablerepo=epel-testing 389-ds-base idm-console-framework 389-admin 389-ds-console 389-admin-console setup-ds-admin.pl -u How to Give Feedback The best way to provide feedback is via the Fedora Update system. Each update is broken down by package and platform. For example, if you are using Fedora 13, and you have successfully installed or upgraded all of the packages, and the console and etc. works, then go to the links below for Fedora 13 and provide feedback. * EL-5 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.1-1.el5 * Fedora 13 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.1-1.fc13 * Fedora 14 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.1-1.fc14 * Fedora 15 - https://admin.fedoraproject.org/updates/389-ds-base-1.2.8.1-1.fc15 scroll down to the bottom of the page, and click on the Add a comment >> link * select one of the Works for me or Does not work radio buttons, add text, and click on the Add Comment button If you are using a build on another platform, just send us an email to 389-users(a)lists.fedoraproject.org Reporting Bugs If you find a bug, or would like to see a new feature, you can enter it here - https://bugzilla.redhat.com/enter_bug.cgi?product=389 More Information * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

1 0

StartTLS with F14, 389-console and system-config-authentication
by Bob McKay 08 Apr '11

08 Apr '11

I'm trying to do set up authentication between fedora 14 client and server using ldap passwords. I seem to be having a problem getting the server to accept startTLS. It has all been set up with 389-console and system-config-authentication. In more detail, I set up the client using system-config-authentication, to use LDAP for the user account authentication, TLS to encrypt connections, and LDAP passwords. I set the LDAP server to ldap://<server name>. All this seems to be working OK, on the server (wireshark) I can see the initial ldap handshake on port 389, as expected. The problem seems to start at the next stage. I see a tcp packet to port 389 from the client, protocol LDAP, Info extendedReq(1) LDAP_START_TLS_OID, which I assume is the request packet from the client to start the TLS handshake. I see a TCP ack from the server, but this is immediately followed by a protocol LDAP message from the server to the client, extendedResp(1) (unsupported extended operation). I assume this is a failure message. However the client replies with an SSLv2 Client Hello. There is never an SSL response, On the client, I see in the logs ssd[be[LDAP]]: Could not start TLS encryption. unsupported extended operation which I assume confirms that the attempt to start up TLS failed. In the server dirsrv access log, I see: [08/Apr/2011:16:40:46 +0900] conn=12 fd=64 slot=64 connection from 192.168.1.7 to 192.168.1.192 [08/Apr/2011:16:40:46 +0900] conn=12 op=0 EXT oid="1.3.6.1.4.1.1466.20037" [08/Apr/2011:16:40:46 +0900] conn=12 op=0 RESULT err=2 tag=120 nentries=0 etime=0 [08/Apr/2011:16:40:46 +0900] conn=12 op=-1 fd=64 closed error 71 (Protocol error) - B1 and in the error log (logging verbosity turned up a bit) I see [08/Apr/2011:17:13:22 +0900] - new connection on 64 [08/Apr/2011:17:13:22 +0900] - activity on 64r [08/Apr/2011:17:13:22 +0900] - read activity on 64 [08/Apr/2011:17:13:22 +0900] - conn 16 activity level = 0 [08/Apr/2011:17:13:22 +0900] - listener got signaled [08/Apr/2011:17:13:22 +0900] - flush_ber() wrote 44 bytes to socket 64 [08/Apr/2011:17:13:22 +0900] - activity on 64r [08/Apr/2011:17:13:22 +0900] - read activity on 64 [08/Apr/2011:17:13:22 +0900] - conn=16 received a non-LDAP message (tag 0x80, expected 0x30) [08/Apr/2011:17:13:22 +0900] - conn 16 leaving turbo mode due to 3 [08/Apr/2011:17:13:22 +0900] - listener got signaled All this seems to suggest that either I don't have startTLS built into my installation of 389, or I'm somehow failing to enable it. However I can't see any plugin in yum that would help, and the only place I can see (at least in 389-console) that looks like it could affect this is the Domain name "Secure connection" checkbox. However I've tried toggling this and I see exactly the same behaviour either way (I'm guessing that the checkbox actually enables SSL support on port 636, but the documentation isn't too clear on this). One possibility, that I'm not too sure how to check, is that the (self-signed) CA certificate or the server certificate might be bad. However they look fine on dumping, and both appear to be installed in the server. And hopefully, I would have got rather more informative log messages in this case. I'm not too sure how to test this locally on the server, any pointers on how to do this would be great. Any help anyone can give on this would be _hugely_ appreciated - I am now three days in on what looked like it was supposed to be a straightforward install, with no real progress, and getting further behind on other urgent stuff. Urrgggg. System: Client and server: F14, 2.6.35.11-83.fc14.x86_64 kernel Server: slapd 2.4.23 Client: sssd 64-bit 1.5.4-1.fc14 Best Wishes Bob

2 1

Can't adjust error log level - 389 DS 1.2.7.5
by Barry Sitompul 07 Apr '11

07 Apr '11

Hi All, I'm testing DS upgrade from 1.2.5 to 1.2.7.5 on RHEL 5 I'm getting a lot of new error messages in the 1.2.7.5 error log (default logging config). These errors do not appear on the 1.2.5 (default logging config as well) when doing an LDAP search and mod to a user on a certain tree: "NSACLPlugin - acllas__client_match_URL: url [ldap:///ou=something,o=the university of queensland,c=au??sub?(objectclass=*)] scope is subtree but dn [ou=something,o=the university of queensland,c=au] is not a suffix of [uid=modadmin,ou=privileged,o=the university of queensland,c=au]" It's saying that the tree that I am searching is not a suffix of the user DN I use to bind. It looks more like a warning because the operation completed successfully, located the user and modified the attributes. Is this just a new feature that can be turned off? Is there anything else I can do to disable these error messages? I've tried to adjust the error log level from the console as per the RedHat documentation for DS 8.2 but I couldn't find any functions to do so on config tab->error log. I have also added nsslapd-errorlog-level: 256 to the dse.ldif but it didn't do anything. Any help is much appreciated! Thanks, Baz

2 1

map value of ServerAdminID for key as_uid did not map to value...
by Stephen Ingram 07 Apr '11

07 Apr '11

I'm trying to register an ipa v2 directory server with register-ds-admin.pl so that I may use the ds-console to view the directory. As I see that the ipa portion of the directory is meant to be managed by ipa, I don't intend on touching that part of the tree. However, it would be really nice to be able to view the directory configuration and maybe make configuration changes (if allowed) using the 389-ds-console. I found an earlier post about automating this process, but it apparently dealt with only version 1. Running register-ds-admin.pl, I have successfully created an admin server as well as another directory to store the configuration into. However, when I try to register the ipa directory server, I get the error: The map value 'ServerAdminID' for key 'as_uid' did not map to a value in any of the given information files. I see this error referenced in earlier 389-ds bug reports, but it is supposed to have already been fixed. I'm using version 1.2.8-0.3.a3 on Fedora 14. Should I file another bug report? Steve

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2011