389-users July 2011

389-users@lists.fedoraproject.org

28 participants
26 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

Re: [389-users] Replication trouble when promoting dedicated Consumer to Multiple master [SOLVED]
by Roland Schwingel 19 Dec '11

19 Dec '11

Hi..... Finally I got it I don't know whether I did it the fully correct way, but it works now. I found that this mysterious replica id 3 was stored in dse.ldif of my server-b: To recap my scenario: server A < ----- server B <-----> server C -----> server D (dedicated Consumer) (multiple Master replica ID:1) (multiple Master replica ID:2) (Dedicated Consumer) I wanted to promote my server D to become a multiple master - but it did not work. What did I do to get it going: 1. Removed all replication agreements to/from server D. 2. Stopped all LDAP services on all servers (I was a little desperate) 3. Found replica id 3 in dse.ldif of server B(?) - nowhere else (why B and not C?) 4. Removed these bogus entries. 5. Restarted all LDAP services on all machines. 6. ldapsearch on server C still revealed the bogus replica id 3 (Where the heck is that cached?). 7. Reinitialized consumer server C from server B and restarted ldap on server C. 8. ldapsearch was clean by then. 9. removed my suffix on server D and removed changelog. 10. recreated suffix on server D and made server D a dedicated consumer 11. on server C created replication agreement to server D 12. initialized server D from server C. 13, Enabled changelog on server D 14. Changed server D to be Multiple Master with replica id 3 15, Created replication aggreement to server C from server D. 16. Worked. Restarted LDAP on server D and C. 17. Still works and replicates to all other machines along the path. 18. I need vacation.... Holy Moly! Roland __________________ Hi Reinhard, Thanks for your reply!! 389-users-bounces(a)lists.fedoraproject.org wrote on 14.07.2011 16:25:10: > From: Reinhard Nappert <rnappert(a)juniper.net> > To: "General discussion list for the 389 Directory server project." > <389-users(a)lists.fedoraproject.org> > Date: 14.07.2011 16:28 > Subject: Re: [389-users] Replication trouble when promoting > dedicated Consumer to Multiple master > Sent by: 389-users-bounces(a)lists.fedoraproject.org > > Do a ldapsearch -b 'nsuniqueid=ffffffff-ffffffff-ffffffff- > ffffffff,dc=mydomain,dc=com' -D <directory manager> -w <password> -s > base objectclass=nstombstone > > This gives you all the configured (history) of replication ids. The > following is the output in my setup. > > dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,o=base > objectClass: top > objectClass: nsTombstone > objectClass: extensibleobject > nsds50ruv: {replicageneration} 4df7a107000000010000 > nsds50ruv: {replica 1 ldap://yale:389} 4df7a396000000010000 4e19ad950000000100 > 00 > nsds50ruv: {replica 3 ldap://norquay:389} 4df7a39d000000030000 4e1605650000000 > 30000 > nsds50ruv: {replica 4 ldap://mustrum:389} 4df7a3a0000000040000 4dfb93650000000 > 40000 > nsds50ruv: {replica 2 ldap://louise:389} 4df7a39a000000020000 4e171a0700000002 > 0000 > o: base > nsruvReplicaLastModified: {replica 1 ldap://yale:389} 00000000 > nsruvReplicaLastModified: {replica 3 ldap://norquay:389} 00000000 > nsruvReplicaLastModified: {replica 4 ldap://mustrum:389} 00000000 > nsruvReplicaLastModified: {replica 2 ldap://louise:389} 00000000 > /\ > | > replication-id > I issued that command on my server Server C. I get the following results: # extended LDIF # # LDAPv3 # base <nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=mydomain,dc=com> with scope baseObject # filter: objectclass=nstombstone # requesting: ALL # # ffffffff-ffffffff-ffffffff-ffffffff, mydomain.com dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff, dc=mydomain,dc=com objectClass: top objectClass: nsTombstone objectClass: extensibleobject nsds50ruv: {replicageneration} 4bf162c6000000010000 nsds50ruv: {replica 2 ldap://server-c.mydomain.com:389} 4cd3fa1e00000002 0000 4e1ef45b000000020000 nsds50ruv: {replica 3 ldap://server-d.mydomain.de:389} nsds50ruv: {replica 1 ldap://server-b.mydomain.de:389} 4bf16732000000010 000 4e1ffa3e000000010000 dc: mydomain nsruvReplicaLastModified: {replica 2 ldap://server-c.mydomain.com:389} 4 e1ef445 nsruvReplicaLastModified: {replica 3 ldap://server-d.mydomain.de:389} 00000000 nsruvReplicaLastModified: {replica 1 ldap://server-b.mydomain.de:389} 4e 1ffa26 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 When I look at it I see that replica id 3 is assigned to my server-d (which should get that replica id). I started over deleted my server-d assigned it replica id 4 but nothing changes. I also cannot get rid of the informations for server-d in that nsuniqueid how can I do that? Thanks, Roland

2 1

Views, Filtered roles and CoS
by Colin Panisset 06 Oct '11

06 Oct '11

I have a pretty flat DIT, with all users currently under ou=people,dc=example,dc=com; these user objects also have posixAccount attributes, of which loginShell is one. What I'm trying to achieve is to be able to set a "default" loginShell to be a restricted shell (/bin/rbash) for developers, but allow that to be a non-restricted shell on systems which are development hosts. As an example, on a production host I'd like: $ ldapsearch -x "(uid=devuser)" uid loginshell to return: dn: cn=Dev User,ou=People,dc=example,dc=com loginShell: /bin/rbash uid: devuser while on a development host, I'd like the same search to return dn: cn=Dev User,ou=People,dc=example,dc=com loginShell: /bin/bash uid: devuser I thought I might be able to achieve this by creating a view called ou=Developers,dc=example,dc=com and using that as a base DN on the development boxes, then applying a CoS within the view to override the loginShell attribute, but then the CoS ends up being applied to the original entry too. Is there any way that I could: - have a CoS apply based on client system attributes, like IP address/hostname? - have a CoS which applies to a view that *doesn't* affect the original object? - perhaps make use of cosPriority through two different views, so as to have ou=Development,... and ou=Production,... (but that would be answered by the previous option anyway)? Is there some other clever way to achieve what I'd like? I'd really like to avoid maintaining 2 separate DITs for the same set of users. -- C.

3 6

Centos 6?
by Brett Dikeman 09 Aug '11

09 Aug '11

Greetings, I'm trying to install 389 on Centos 6, following this: http://directory.fedoraproject.org/wiki/Install_Guide#New_Install The guide makes it out to be as simple as "configure EPEL, then execute yum install 389-ds". Instead, the install dies with yum not able to find a dozen or two dependencies, all of them perl, it looks like: -perl(Setup) -perl (Mozilla::LDAP::Utils) -perl(Resource) ...and so on (Dialog, DSMigration, Migration, DSUpdate etc.) I've tried both EPEL release, and EPEL testing. I can't seem to find anyone else complaining about these issues, so I'm guessing I'm missing something. Any suggestions? Thanks! Brett

11 29

LDAPCon 2011 Call for Papers
by Peter Gietz 08 Aug '11

08 Aug '11

With the usual apologies. The 3rd Edition of the International Conference on LDAP (LDAPCon 2011[1]) will be held on October, 10-11, 2011 in Heidelberg, Germany. A Call For Papers[2] has been raised and the Program Committee asks you to submit abstracts by July 8th. The International Conference on LDAP is a technical forum for IT professionals interested in LDAP and related topics like directory servers, directory management applications, directory integration, identity and access management, and meta directories. It focuses on implementation and integration of LDAP servers and LDAP-enabled client applications. The event will bring together vendors, developers, active and prospective LDAP practitioners to share their experiences about deployment strategies, service operations, interoperability, discuss LDAP usage in new projects and learn about upcoming trends and developments. The 1st LDAPCon[3] was held in September 2007 in Germany, the 2nd LDAPCon[4] was held in September 2009 in Portland, Oregon, USA (Some pictures from LDAPCon 2007 [5] and a nice summary of LDAPCon 2009 [6]) So if you're involved with LDAP in interesting projects and you want to share your experiences, please check the Call For Papers and submit a proposal. Best, Peter [1]: http://www.ldapcon.org [2]: http://www.daasi.de/ldapcon2011/index.php?site=cfp [3]: http://www.guug.de/veranstaltungen/ldapcon2007/index.html [4]: http://www.symas.com/ldapcon2009 [5]: http://www.flickr.com/photos/ludovic_p/sets/72157601937159198/detail/ [6]: http://blogs.sun.com/Ludo/entry/ldapcon_2009_summary -- _______________________________________________________________________ Peter Gietz (CEO) DAASI International GmbH phone: +49 7071 407109-0 Europaplatz 3 Fax: +49 7071 407109-9 D-72074 Tübingen mail: peter.gietz(a)daasi.de Germany Web: www.daasi.de DAASI International GmbH, Tübingen Geschäftsführer Peter Gietz, Amtsgericht Stuttgart HRB 382175 Directory Applications for Advanced Security and Information Management _______________________________________________________________________

1 2

Delete object on Consumer
by Jim Tyrrell 04 Aug '11

04 Aug '11

Hi, We have a setup with multiple masters which are replicating down to 389 Directory Server consumers via 2 hubs, but have a consistency issue. It appears a few objects were deleted and re-added to the masters but the object was not deleted from the 389 consumers. We now have 1 object on the masters and 2 objects on the consumers which causes problems for the mail servers. If we delete the object from the master we are still left with one object on the slaves. The slaves currently have a few duplicate objects like this: dn: cn=mx::10, cn=somedomain.co.uk, ou=dns, o=acmesystems.com cn: mx::10 mailtransport: nexthop:[mailserver.ourdomain.com] dnspreference: 10 dnstype: MX dn: nsuniqueid=7edfa581-1dd211b2-8014f995-55bd0000+cn=mx::10,cn=somedomain.co.uk, ou=dns,o=acmesystems.com cn: mx::10 mailtransport: nexthop:[mailserver.ourdomain.com] dnspreference: 10 dnstype: MX The object showing nsuniqueid is the valid one that exists on the master. Is there a way to remove the 2nd object from the consumer without re-initialising? I have seen this before on a single consumer so we re-initialised it, but its a much bigger problem to re-initialise all of the consumers. It would be ideal if there is a way to manually delete an object direct on a consumer? Thanks. Jim.

4 14

autoenrollment proxy and dogtag 9 ? Where can I find AEP source code ?
by Alexander Jung 03 Aug '11

03 Aug '11

Hello, I try to use the autoenrollment proxy with the most recent dogtag. Unfourtunately it seems that its been a while since somebody touched that code and the aep does not support the port seperation in the more recent dogtag versions (since 1.2). I'd like to update the source, but I could not download it from the fedora-cvs server as described in http://directory.fedoraproject.org/wiki/Auto_Enroll_Build (Server not responding) Where can I download the most recent aep source code ? yours, Alexander Jung

2 3

Change name of server, admin-server no longer works
by Techie 01 Aug '11

01 Aug '11

Hello, We were required to change the hostname of our LDAP server running 389-DS. Since that time the LDAP server runs fine but the admin server does not authenticate login any longer, meaning i cannot log into the admin server. What do I need to do to fix the admin server and change all references from the old host name to the new host name. Thanks Jimmy

3 6

Howto setup the 389 server to be its own client (caution n00b!)
by Bill Crowell 28 Jul '11

28 Jul '11

All, I've successfully installed 389 and configured it on my Linode server with FC15. I'm impressed at how well it installs compared to LDAP. I'm able to access it using a notebook running FC using the 389 admin tool. Again, nice. What I'm searching for is how to make the directory server also the application server and have the users added to the directory show up on the same virtual machine. Admittedly, I'm a bit spoiled by Apple's OpenDirectory and having users created on the same machine as the directory. As my firm expands, we will have more replicants and additional servers holding application data. For now, just one server. I presume there is a setting to tell this server to authenticate back to its own 389 server instead of simply the default shadow passwords? TIA Bill Bill Crowell, President Pavuk Systems 318 Queens Road Suite 6 Charlotte, NC 28204 Office +1 704.248.0024 Mobile +1 704.607.6077 Skype pavuk.com

2 1

Re: [389-users] 389-DSGW and userPassword / sambaNTPassword / sambaLMPassword synchronization
by Rich Megginson 28 Jul '11

28 Jul '11

On 07/05/2011 07:02 AM, Alexandr Popov wrote: > Hello! > > I've got a directory server and DSGW running. > > Mail server, openvpn server and samba share use ldap authentication > against this directory server. Users change their passwords in DSGW. > > The mailserver and openvpn use SSHA hash in "userpassword" field, but > samba uses NT hash and LM hash in "sambantpassword" and > "sambalmpassword" fields accordingly. > > How can I make "userpassword" , "sambantpassword" and > "sambalmpassword" fields change synchronously when users change their > passwords in DSGW? > > As I can understand, there is no already written 389-DS-plugin for > synchronizing these fields. > Moreover, it seems to me that such issues as mine are often solved on > the ldap clients: > http://web.archiveorange.com/archive/v/I3m7YImbRJ3Dj9WoXlCz > Am I right? > > So should I change domodify.c > <http://git.fedorahosted.org/git?p=389/dsgw.git;a=blob;f=domodify.c;h=5a3719…> > which is responsible for password change in DSGW? Does it seem to be > useful for Community? > > Looking forward to your prompt repy. Patches welcome. Or you could use IPA instead - IPA provides a plugin that keeps all of your passwords in sync - userPassword, and Samba and Kerberos passwords. > > Best regards, > Alex Popov.

4 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2011