389-users May 2014

389-users@lists.fedoraproject.org

34 participants
38 discussions

constraint averlay
by rayane karim 07 May '14

07 May '14

Hi All is constraint overlay implemented on DS like olcConstraintAttribute for attribute syntax checking like regex Regards Rayane

2 1

Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)
by Graham Leggett 05 May '14

05 May '14

Hi all, Some more digging reveals that when an attempt is made for serverb to try and commence replication with serverc, I get the following in the error log: [04/May/2014:17:46:55 +0100] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=Agreement serverc.example.com" (serverc:636)". [04/May/2014:17:47:02 +0100] NSMMReplicationPlugin - agmt="cn=Agreement serverc.example.com" (serverc:636): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [04/May/2014:17:47:02 +0100] NSMMReplicationPlugin - agmt="cn=Agreement serverc.example.com" (serverc:636): Received error -1 (Can't contact LDAP server): for total update operation [04/May/2014:17:47:03 +0100] NSMMReplicationPlugin - agmt="cn=Agreement serverc.example.com" (serverc:636): Warning: unable to send endReplication extended operation (Can't contact LDAP server) [04/May/2014:17:47:04 +0100] NSMMReplicationPlugin - agmt="cn=Agreement serverc.example.com" (serverc:636): Replication bind with SIMPLE auth resumed Unfortunately the error message "Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)" is too vague to be useful because there is no clear and unambiguous indication of *which* server it is unable to connect to and on what port. The "(serverc:636)" would imply that it is trying to connect to "serverc", but "serverc" is the name of the instance, it is not the name of the server, so any attempt to connect to this will fail. The server is called serverc.example.com, and this name appears exclusively in the replication agreement: dn: cn=Agreement serverc.example.com,cn=replica,cn=o\3DFoo\,c\3Dza,cn=mapping tr ee,cn=config objectClass: nsDS5ReplicationAgreement objectClass: top cn: Agreement serverc.example.com description: Replication agreement between serverb.example.com and serverc.example.com nsds5BeginReplicaRefresh: start nsDS5ReplicaBindDN: cn=Replication Manager,cn=config nsDS5ReplicaBindMethod: SIMPLE nsds5replicaChangesSentSinceStartup: nsDS5ReplicaCredentials:: xxx nsDS5ReplicaHost: serverc.example.com nsds5replicaLastInitEnd: 0 nsds5replicaLastInitStart: 20140504164654Z nsds5replicaLastInitStatus: 0 nsds5replicaLastUpdateEnd: 20140504164652Z nsds5replicaLastUpdateStart: 20140504164652Z nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental u pdate started nsDS5ReplicaPort: 636 nsDS5ReplicaRoot: o=Foo,c=ZA nsDS5ReplicaTransportInfo: SSL nsds5replicaUpdateInProgress: FALSE At the same time, ssldump reveals that serverb.example.com and serverc.example.com are successfully speaking to one another, and have a lot to say - data seems to be constantly flowing between them, but not to any successful end. Does any of this behaviour look familiar to anybody? Regards, Graham --

5 29

dsgw not checking passwords during auth
by Ted Strother 05 May '14

05 May '14

I have a web server running dsgw which is pointing at an ldap instance on another server in the config. Searches work fine, actions tht require auth work fine when the password was correct. When an incorrect password is entered it is still accepted, a cookie is created, and as soon as an operation that requires auth is tried it errors out. Incorrect users are still rejected, it is only when a correct user but incorrect password is entered that this behavior is seen. Has anyone seen this before? -- Ted Strother Systems Administrator Senior Information Technology Services University of Michigan-Dearborn 19000 Hubbard Drive, 238 FCN Dearborn, MI 48126

2 3

archive2db: Failed to read backup file set. Either the directory specified doesn't exist, or it exists but doesn't contain a valid backup set, or file permissions prevent the server reading the backup set. error=53 (Invalid request descriptor)
by Graham Leggett 05 May '14

05 May '14

Hi all, I am now trying to use the bak2db.pl script in an effort to restore a backup as follows, and receive the error below. Can anyone point out what I am doing wrong? (I had to manually hack the bak2db.pl script to change the host to localhost, the script blindly assumes the box is accessible on port 389 when it is not) [root@joey ~]# /usr/lib64/dirsrv/slapd-serverc/bak2db.pl -v -D "cn=Directory Manager" -j /etc/dirsrv/slapd-serverc.secret -a /tmp/replicate/userRoot/ -n userRoot ldap_initialize( ldap://localhost:389 ) add objectclass: top extensibleObject add cn: restore_2014_5_5_15_14_40 add nsInstance: userRoot add nsArchiveDir: /tmp/replicate/userRoot/ add nsDatabaseType: ldbm database adding new entry "cn=restore_2014_5_5_15_14_40, cn=restore, cn=tasks, cn=config" modify complete So far so good. In the logfile: [05/May/2014:15:14:39 +0200] - Beginning restore to 'ldbm database' [05/May/2014:15:14:39 +0200] - Warning: Unable to read dbversion file in /tmp/replicate/userRoot [05/May/2014:15:14:39 +0200] - Bringing userRoot offline... [05/May/2014:15:14:39 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica o=wired,c=za is going offline; disabling replication [05/May/2014:15:14:40 +0200] - Waiting for 4 database threads to stop [05/May/2014:15:14:41 +0200] - All database threads now stopped [05/May/2014:15:14:41 +0200] - Restore: backup directory /tmp/replicate/userRoot does not exist. [05/May/2014:15:14:41 +0200] - archive2db: Failed to read backup file set. Either the directory specified doesn't exist, or it exists but doesn't contain a valid backup set, or file permissions prevent the server reading the backup set. error=53 (Invalid request descriptor) [05/May/2014:15:14:41 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica o=wired,c=za is coming online; enabling replication [05/May/2014:15:14:41 +0200] - Restore finished. Yes, the directory does exist: [root@joey ~]# ls -al /tmp/replicate/userRoot total 239624 drwx------. 2 nobody nobody 4096 May 5 12:08 . drwx------. 4 nobody nobody 4096 May 5 12:08 .. -rw-------. 1 nobody nobody 49 May 5 12:08 DBVERSION -rw-------. 1 nobody nobody 16384 May 5 12:08 aci.db4 -rw-------. 1 nobody nobody 2482176 May 5 12:08 ancestorid.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 associatedDomain.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 certificateUUID.db4 -rw-------. 1 nobody nobody 24117248 May 5 12:08 cn.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 contractClass.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 contractCustomerCounterparty.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 contractRecipientCounterparty.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 contractVendorCounterparty.db4 -rw-------. 1 nobody nobody 22487040 May 5 12:08 entryrdn.db4 -rw-------. 1 nobody nobody 5316608 May 5 12:08 givenName.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 hushkeyAddress.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 hushkeyReference.db4 -rw-------. 1 nobody nobody 159891456 May 5 12:08 id2entry.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 ipHostNumber.db4 -rw-------. 1 nobody nobody 11468800 May 5 12:08 mail.db4 -rw-------. 1 nobody nobody 40960 May 5 12:08 mailAlternateAddress.db4 -rw-------. 1 nobody nobody 24576 May 5 12:08 mailHost.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 memberCertificateIssuerDN.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 memberCertificateSubjectDN.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 nscpEntryDN.db4 -rw-------. 1 nobody nobody 6430720 May 5 12:08 nsuniqueid.db4 -rw-------. 1 nobody nobody 24576 May 5 12:08 numsubordinates.db4 -rw-------. 1 nobody nobody 2473984 May 5 12:08 objectclass.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 owner.db4 -rw-------. 1 nobody nobody 802816 May 5 12:08 parentid.db4 -rw-------. 1 nobody nobody 5308416 May 5 12:08 sn.db4 -rw-------. 1 nobody nobody 16384 May 5 12:08 uid.db4 -rw-------. 1 nobody nobody 4243456 May 5 12:08 uniquemember.db4 Anyone see any reason why this wouldn't work? Regards, Graham --

1 0

bak2db script: how do you use it?
by Graham Leggett 05 May '14

05 May '14

Hi all, I am now trying to make the initial replication happen manually through the restoration of a backup. This is also turning out to be strangely difficult. After backing up servera I have the following directory on serverc: [root@serverc ~]# ls -al /tmp/replicate/ total 16 drwx------. 4 nobody nobody 4096 May 5 12:08 . drwxrwxrwt. 6 root root 4096 May 5 13:30 .. drwx------. 2 nobody nobody 4096 May 5 12:08 NetscapeRoot drwx------. 2 nobody nobody 4096 May 5 12:08 userRoot I want to restore the contents of userRoot to serverc, which looks like this: [root@serverc ~]# ls -al /var/lib/dirsrv/slapd-serverc/db/ total 20604 drwxrwx---. 3 nobody nobody 4096 May 5 13:31 . drwxrwx---. 5 nobody nobody 4096 May 5 13:30 .. -rw-------. 1 nobody nobody 49 May 5 13:31 DBVERSION -rw-------. 1 nobody nobody 24576 May 5 13:31 __db.001 -rw-------. 1 nobody nobody 1736704 May 5 13:37 __db.002 -rw-------. 1 nobody nobody 10002432 May 5 13:31 __db.003 -rw-------. 1 nobody nobody 1081344 May 5 13:37 __db.004 -rw-------. 1 nobody nobody 8134656 May 5 13:31 __db.005 -rw-------. 1 nobody nobody 90112 May 5 13:31 __db.006 -rw-------. 1 nobody nobody 10485760 May 5 13:31 log.0000000001 drwx------. 2 nobody nobody 4096 May 5 13:30 userRoot I try and import the backup like so: [root@serverc ~]# /usr/lib64/dirsrv/slapd-serverc/bak2db /tmp/replicate/ -n userRoot [05/May/2014:13:49:53 +0200] 389-Directory/1.2.11.15 - debug level: backend (524288) [05/May/2014:13:49:53 +0200] - Warning: Unable to read dbversion file in /tmp/replicate [05/May/2014:13:49:53 +0200] - Restore: backup directory /tmp/replicate does not contain a complete backup [05/May/2014:13:49:53 +0200] - archive2db: Failed to read backup file set. Either the directory specified doesn't exist, or it exists but doesn't contain a valid backup set, or file permissions prevent the server reading the backup set. error=53 (Invalid request descriptor) No luck. Let's guess again: [root@serverc ~]# /usr/lib64/dirsrv/slapd-serverc/bak2db /tmp/replicate/userRoot/ -n userRoot Lots of encouraging looking output, but the server is now completely empty - the root DSE is gone. Looking at serverc, we see the userRoot directory has been ignored and we now have a totally different directory structure: [root@joey ~]# ls -al /var/lib/dirsrv/slapd-joey/db/ total 260252 drwxrwx---. 3 nobody nobody 4096 May 5 13:43 . drwxrwx---. 5 nobody nobody 4096 May 5 13:30 .. -rw-------. 1 nobody nobody 49 May 5 13:43 DBVERSION -rw-------. 1 nobody nobody 24576 May 5 13:43 __db.001 -rw-------. 1 nobody nobody 1736704 May 5 13:44 __db.002 -rw-------. 1 nobody nobody 10002432 May 5 13:44 __db.003 -rw-------. 1 nobody nobody 1081344 May 5 13:44 __db.004 -rw-------. 1 nobody nobody 8134656 May 5 13:44 __db.005 -rw-------. 1 nobody nobody 90112 May 5 13:44 __db.006 -rw-------. 1 nobody nobody 16384 May 5 13:41 aci.db4 -rw-------. 1 nobody nobody 2482176 May 5 13:41 ancestorid.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 associatedDomain.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 certificateUUID.db4 -rw-------. 1 nobody nobody 24117248 May 5 13:41 cn.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 contractClass.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 contractCustomerCounterparty.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 contractRecipientCounterparty.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 contractVendorCounterparty.db4 -rw-------. 1 nobody nobody 22487040 May 5 13:41 entryrdn.db4 -rw-------. 1 nobody nobody 5316608 May 5 13:41 givenName.db4 -rw-------. 1 nobody nobody 159891456 May 5 13:41 id2entry.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 ipHostNumber.db4 -rw-------. 1 nobody nobody 10485760 May 5 13:44 log.0000000001 -rw-------. 1 nobody nobody 11468800 May 5 13:41 mail.db4 -rw-------. 1 nobody nobody 40960 May 5 13:41 mailAlternateAddress.db4 -rw-------. 1 nobody nobody 24576 May 5 13:41 mailHost.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 memberCertificateIssuerDN.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 memberCertificateSubjectDN.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 nscpEntryDN.db4 -rw-------. 1 nobody nobody 6430720 May 5 13:41 nsuniqueid.db4 -rw-------. 1 nobody nobody 24576 May 5 13:41 numsubordinates.db4 -rw-------. 1 nobody nobody 2473984 May 5 13:41 objectclass.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 owner.db4 -rw-------. 1 nobody nobody 802816 May 5 13:41 parentid.db4 -rw-------. 1 nobody nobody 5308416 May 5 13:41 sn.db4 -rw-------. 1 nobody nobody 16384 May 5 13:41 uid.db4 -rw-------. 1 nobody nobody 4243456 May 5 13:41 uniquemember.db4 What is the secret to the bak2db? What command line should I use that is compatible with the server? How do you convince bak2db to restore into the userRoot directory instead of just dumping everything in the root of the directory, to be ignored by the server? Anyone used bak2db before? Regards, Graham --

1 0

Replication hell - picking apart info/warning/error messages
by Graham Leggett 05 May '14

05 May '14

Hi all, I am into my second day of hell trying to get server C to replicate to servers B and A in a multimaster replication setup. For reasons unknown it appears getting servers A and B to be blown away completely by the contents of (initially empty) server C is trivial in the extreme, cue two three hour outages and restores from backup. I cannot for the life of me get this to work the other way around. After running the scripts to deploy server C from scratch, and adding the replication agreement to server A, I get the following in server C's log below. I have a number of questions: - "Replica has a different generation ID than the local data." - what does this mean? Is it simply information to be ignored, a warning to be heeded (if so, how?), or an error (if so, what action must be taken?). - "ERROR bulk import abandoned". I am assuming this means that the replication failed, but it gives no indication as to *why* it failed. Anyone know of a way to coax a reason out of 389ds? - "NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica". Again, is this purely for information, is this a warning, is this an error, what should I do in response to this? All I want to do is make serverc have the same data as servera. Does anyone have a clear and concise set of instructions for how this is to be achieved safely? [04/May/2014:15:50:17 +0200] NSMMReplicationPlugin - agmt="cn=Agreement servera.example.com" (servera:636): Replica has a different generation ID than the local data. [04/May/2014:15:50:21 +0200] NSMMReplicationPlugin - agmt="cn=Agreement serverb.example.com" (serverb:636): Replica has a different generation ID than the local data. [04/May/2014:15:51:36 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica o=Foo,c=za is going offline; disabling replication [04/May/2014:15:51:36 +0200] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database [04/May/2014:15:51:40 +0200] - ERROR bulk import abandoned [04/May/2014:15:51:40 +0200] - import userRoot: Aborting all Import threads... [04/May/2014:15:51:45 +0200] - import userRoot: Import threads aborted. [04/May/2014:15:51:45 +0200] - import userRoot: Closing files... [04/May/2014:15:51:45 +0200] - libdb: userRoot/aci.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/cn.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/parentid.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/mailAlternateAddress.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/objectclass.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/entryrdn.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/givenName.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/uniquemember.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/nsuniqueid.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/mailHost.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/mail.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/id2entry.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/sn.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - libdb: userRoot/uid.db4: unable to flush: No such file or directory [04/May/2014:15:51:45 +0200] - import userRoot: Import failed. [04/May/2014:15:51:45 +0200] - process_bulk_import_op: NULL target sdn [04/May/2014:15:51:49 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=Foo,c=ZA: LDAP error - 1 [04/May/2014:15:51:53 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=Foo,c=ZA: LDAP error - 1 [04/May/2014:15:51:57 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=Foo,c=ZA: LDAP error - 1 Regards, Graham --

3 4

Re: [389-users] Sync from RDBMS to LDAP
by Fong, Trevor 02 May '14

02 May '14

*Bump* Surely we can't be the only ones who want to this? Trev From: Fong, Trevor Sent: April-22-14 3:33 PM To: '389-users(a)lists.fedoraproject.org' Subject: Sync from RDBMS to LDAP Hi Everyone, We are in the process of migrating from an old OpenLDAP service to 389-DS. We currently synchronise users and attributes from an Oracle DB to OpenLDAP service using an aging set of custom scripts and DB triggers. We would like to do something similar for 389-DS but using a commercial-off-the-shelf solution. I was wondering what the good people on this list use or would recommend? Thanks in advance, Trev --------------------------------------------------------- Trevor Fong - Senior Programmer Analyst Identity and Access Management Group University of British Columbia - Information Technology 6356 Agricultural Road, Vancouver, BC, V6T 1Z2, Canada Ph: (604) 827-5247

4 4

cannot find name for group ID
by Enrico Morelli 30 Apr '14

30 Apr '14

Dear all, I'm a new user about 389 DS. I installed it on a RHEL 6 (32bit) server: 89-admin-console-doc-1.1.8-1.el6.noarch 389-ds-1.2.2-1.el6.noarch 389-ds-base-1.2.11.15-32.el6_5.i686 389-ds-base-libs-1.2.11.15-32.el6_5.i686 389-ds-console-1.2.6-1.el6.noarch 389-admin-console-1.1.8-1.el6.noarch 389-dsgw-1.1.11-1.el6.i686 389-admin-1.1.35-1.el6.i686 389-adminutil-1.1.19-1.el6.i686 389-ds-console-doc-1.2.6-1.el6.noarch 389-console-1.1.7-1.el6.noarch I've troubles with groups. I created posix user and group. I'm able to login on the Linux client (SL 6 32bit) but I receive the error: cannot find name for group ID. I had search on google to find a solution, but all the suggestions I've find didn't work for me. This is the sssd.conf on the client, with all attempts to solve the problem ----------------------------------------------- [domain/default] ldap_schema = rfc2307bis ldap_id_use_start_tls = True cache_credentials = True ldap_search_base = dc=mydomain,dc=it #krb5_realm = EXAMPLE.COM #krb5_server = kerberos.example.com id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldaps://myserver ldap_tls_cacertdir = /etc/openldap/cacerts entry_cache_timeout = 600 ldap_network_timeout = 3 #ldap_group_name = uniqueMember ldap_group_object_class = groupofuniquenames [sssd] services = nss, pam config_file_version = 2 domains = default ----------------------------------------------------------------- If I add the member to the group through the management console group->Members->Static Group, switch on the ldap_group_name = uniqueMember parameter on the client, clear cache, restart sssd and type id user I obtain: uid=1001(morelli) gid=1001(uid=morelli,cn=students,ou=Groups,dc=mydoman,dc=it) groups=1001(uid=morelli,cn=students,ou=Groups,dc=mydomain,dc=it) There is a way to solve the problem? Thanks -- ------------------------------------------------------------- Enrico Morelli System Administrator | Programmer | Web Developer CERM - Polo Scientifico Via Sacconi, 6 - 50019 Sesto Fiorentino (FI) - ITALY phone: +39 055 457 4269 fax: +39 055 457 4927 -------------------------------------------------------------

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users May 2014