_entry_set_tombstone_rdn - Failed to convert DN uid=x1 to RDN
by Felix Engel
Hello,
when init. the consumer (or replicating), I get the following two errors multiple times with different uids on the master (ldap):
[26/Mar/2014:08:19:53 +0100] _entry_set_tombstone_rdn - Failed to convert DN uid=x1 to RDN
[26/Mar/2014:08:19:53 +0100] id2entry - str2entry returned NULL for id 217, string="rdn"
...
Yet in the end:
[26/Mar/2014:08:19:58 +0100] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=test" (ldap3:389)". Sent 432 entries.
The master (ldap) is:
389-admin-console-doc-1.1.8-1.el5
389-ds-console-doc-1.2.6-1.el5
389-admin-console-1.1.8-1.el5
389-adminutil-1.1.15-1.el5
389-ds-1.2.1-1.el5
389-console-1.1.7-3.el5
389-admin-1.1.29-1.el5
389-dsgw-1.1.11-1.el5
389-ds-console-1.2.6-1.el5
389-ds-base-libs-1.2.11.25-1.el5
389-ds-base-1.2.11.25-1.el5
The consumer (ldap3) is:
389-ds-console-doc-1.2.6-1.el5
389-admin-console-1.1.8-1.el5
389-adminutil-1.1.15-1.el5
389-ds-1.2.1-1.el5
389-console-1.1.7-3.el5
389-admin-1.1.29-1.el5
389-dsgw-1.1.11-1.el5
389-ds-console-1.2.6-1.el5
389-ds-base-libs-1.2.11.25-1.el5
389-ds-base-1.2.11.25-1.el5
389-ds-base-libs-1.2.11.15-32.el6_5.x86_64
389-console-1.1.7-1.el6.noarch
389-admin-1.1.35-1.el6.x86_64
389-ds-base-1.2.11.15-32.el6_5.x86_64
389-ds-console-1.2.6-1.el6.noarch
389-adminutil-1.1.19-1.el6.x86_64
How do I fix this and check if the replication did indeed work or which parts might have gone wrong? Maybe this has no impact at all? The data looks ok ...
Thank you,
Felix
10 years
what is the latest stable version of 389 directory server code base
by G, Rajendra Babu (STSD campus)
Dear All,
This is Rajendra and I'm active user/community of 389 directory server.
Could you please suggest me ,what is the latest stable version of 389 Directory server code base which I we can use. It would be great if you can provide the link as well.
Thanks in Advance,
Best Regards,
Rajendra
10 years
certutil.exe is not a valid win32 application
by Isaac Gonzalez
Hi I downloaded and installed the 389-PassSync-1.1.5-i386.msi for my windows server 2003 active directory server. I first had to install a patch (WindowsServer2003-KB942288-v4-x86.exe) to get it to install as it said I didn't have the right service pack installed even though I am running service pack 2. After installing, I couldn't import the DS certificate into it using the certutil.exe application which is included in the 389 program files directory. It says certutil.exe is not a valid win32 application. It also says the same thing about the pk12util.exe, followed with access is denied from the command prompt.
Installing the 64 bit version of the app on my 64 bit domain controllers seems to not have that issue.
10 years, 1 month
multi-master replication setup problem: both suppliers do "not have permission to supply replication updates to the replica"
by Jon Detert
Hi,
I have two 389-ds servers. I want them to do multi-master replication to each other. Beyond these 2, there are no other servers.
I tried to do this via the command-line, following RedHat's guide [2].
However, /var/log/dirsrv/slapd-*/errors says this:
[18/Mar/2014:15:02:10 -0500] NSMMReplicationPlugin - conn=22 op=3 replica="o=infinityhealthcare.com": Unable to acquire replica: error: permission denied
[18/Mar/2014:15:07:02 -0500] NSMMReplicationPlugin - agmt="cn=o-ihccom-to-ds2" (test-ds2:389): Unable to acquire replica: permission denied. The bind dn "uid=replica-manager,cn=config" does not have permission to supply replication updates to the replica. Will retry later.
[18/Mar/2014:15:07:02 -0500] NSMMReplicationPlugin - agmt="cn=dc-ihc-dc-com-to-ds2" (test-ds2:389): Unable to acquire replica: permission denied. The bind dn "uid=replica-manager,cn=config" does not have permission to supply replication updates to the replica. Will retry later.
Any ideas what to do to fix?
In case it helps explain the problem, here is what one of the replication agreements looks like:
dn: cn=dc-ihc-dc-com-to-ds2,cn=replica,cn=dc\3Dinfinityhealthcare\2Cdc\3Dcom,c
n=mapping tree,cn=config
objectClass: top
objectClass: nsDS5ReplicationAgreement
description: agreement to replicate dc=ihc,dc=com tree from ds1 to ds2
cn: dc-ihc-dc-com-to-ds2
nsDS5ReplicaRoot: dc=infinityhealthcare,dc=com
nsDS5ReplicaHost: test-ds2.infinityhealthcare.com
nsDS5ReplicaPort: 389
nsDS5ReplicaBindDN: uid=replica-manager,cn=config
nsDS5ReplicaBindMethod: SIMPLE
nsDS5ReplicatedAttributeList: (objectclass=*) $ EXCLUDE authorityRevocationLis
t accountUnlockTime memberof
nsDS5ReplicaCredentials: {DES}Nz0qsqM5nShesnQPldsB7vYKQXOj2azjan8bTsUWxNM=
nsds5replicareapactive: 0
nsds5replicaLastUpdateStart: 0
nsds5replicaLastUpdateEnd: 0
nsds5replicaChangesSentSinceStartup:
nsds5replicaLastUpdateStatus: 3 Replication error acquiring replica: permissio
n denied
nsds5replicaUpdateInProgress: FALSE
nsds5replicaLastInitStart: 0
nsds5replicaLastInitEnd: 0
and here is the replica on the other server, that this agreement refers to:
dn: cn=replica,cn=dc\3Dinfinityhealthcare\2Cdc\3Dcom,cn=mapping tree,cn=config
objectClass: top
objectClass: nsds5replica
objectClass: extensibleObject
cn: replica
nsDS5ReplicaRoot: dc=infinityhealthcare,dc=com
nsDS5ReplicaId: 7
nsDS5ReplicaType: 3
nsDS5Flags: 1
nsds5ReplicaPurgeDelay: 604800
nsDS5ReplicaBindDN: uid=replica-manager,cn=config
nsState:: BwAAAAAAAACSnChTAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAA==
nsDS5ReplicaName: 8d64c603-aecc11e3-b040c130-71875861
nsds5ReplicaChangeCount: 0
nsds5replicareapactive: 0
[1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Serv...
[2] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Serv...
Thanks,
--
Jon Detert
Sr. Systems Administrator
Infinity Healthcare
Milwaukee, Wisconsin
414-290-6759
10 years, 1 month
Upgraded 389-admin rpms and now I can't start dirsrv-admin
by Groten, Ryan
Just upgraded my packages from:
389-ds-console-1.2.6-1.el5
389-console-1.1.7-1.el5
389-ds-console-doc-1.2.6-1.el5
389-admin-console-1.1.8-1.el5
389-admin-console-doc-1.1.8-1.el5
389-ds-base-1.2.9.9-1.el5
389-dsgw-1.1.7-2.el5
389-adminutil-1.1.14-1.el5
389-admin-1.1.23-1.el5
389-ds-base-libs-1.2.9.9-1.el5
To:
389-ds-console-1.2.6-1.el5
389-console-1.1.7-3.el5
389-ds-console-doc-1.2.6-1.el5
389-adminutil-1.1.19-1.el5
389-admin-console-1.1.8-1.el5
389-admin-1.1.29-1.el5
389-admin-console-doc-1.1.8-1.el5
389-dsgw-1.1.11-1.el5
389-ds-base-1.2.11.25-1.el5
389-ds-base-libs-1.2.11.25-1.el5
+perl-NetAddr-IP.x86_64 0:4.027-5.el5
+perl-Socket6.x86_64 0:0.19-3.fc6
After that I ran "setup-ds-admin.pl -u". Now I'm having problems starting dirsrv-admin:
# service dirsrv-admin start
Starting dirsrv-admin:
httpd.worker: Syntax error on line 136 of /etc/dirsrv/admin-serv/httpd.conf: Cannot load /usr/lib64/dirsrv/modules/mod_admserv.so into server: /usr/lib64/libadminutil.so.0: undefined symbol: ldap_explode
Server failed to start !!! Please check errors log for problems
[FAILED]
# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 5.9 (Tikanga)
I checked any error logs I could think of but found nothing.
Thanks in advance for the help!
Ryan
________________________________
This communication, including any attached documentation, is intended only for the person or entity to which it is addressed, and may contain confidential, personal and/or privileged information. Any unauthorized disclosure, copying, or taking action on the contents is strictly prohibited. If you have received this message in error, please contact us immediately so we may correct our records. Please then delete or destroy the original transmission and any subsequent reply.
10 years, 1 month
Sun One 5.2 to 389 DS
by Dustin Rice
Hello there, I wanted to see if anyone else out there has gone through a
migration/upgrade from Sun One Directory 5.2 server to 389 DS?
I'm currently working on doing just that at my organization and I've
been running into a few snags. Ideally we'd want to setup a 389 consumer
replica attached to our Sun One master. Over time we replace the Sun One
replicas with 389 replicas until eventually all servers are 389 DS.
Anywho, I do have a 389 DS consumer replica that appears to be
replicating from our Sun One master, however I'm seeing a number of LDAP
error 53 (server was unwilling) errors. When I upped the log level it
looks like the master is trying to do an ldapadd when it should be doing
an ldapmodify. So that's where I'm slightly stuck now, if anyone out
there has any ideas.
Thanks!
--
=====================================
Dustin Rice
UNIX System Administrator - CIS
Portland State University
=====================================
10 years, 1 month
389 Management Console - How add server to list?
by Parasit Hendersson
Hi,
We have four servers in our "cluster", one master and three slaves.
Everything works fine with one way replication. Problem is in "389
Management Console", in tab "Servers and Applications" are only 3
servers (master and 2 slaves), how add to this list third slave??
Best Regards
Parasit Hendersson
10 years, 1 month
Possible memory leak in proxy auth control
by Chris Chatfield
Hi,
I've been running some load tests against version 389-ds-base-1.2.11.15-30.el6_5.x86_64 on Centos 6.5. When looking at the vmsize of the ns-slapd process it appears to grow linearly, rather than reaching a plateau. After some modifications to the load test it appears that the memory usage is flat if we remove the portion that performs the proxied authentication control. I'd estimate that the size of the leak is 282 bytes per operation.
Is this a known issue? Is there any extra logging or configuration that would allow me to help pinpoint the problem further?
Thanks for your help,
Chris
10 years, 1 month
UserPassword + SambaNTPassword
by Nehal J Wani
When users login into a ldap configured machine, and type passwd to
change their password, only the attribute userPassword gets changed,
how do I enforce updation of sambaNTPassword also?
--
Nehal J Wani
10 years, 1 month
Changing default group object in 389-console
by Groten, Ryan
When adding a group from the 389-console, it creates a groupOfUniqueNames object. I'm curious if it's possible to change it so that by default only a posixGroup object is created and/or the group icon is displayed for posixGroup type objects instead.
Thanks,
Ryan
10 years, 1 month
