July 2014 - 389-users - Fedora mailing-lists

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

multi-valued nsAccountLock
by Pierre ROUDIER 10 Jul '15

10 Jul '15

Hi all, RedHat DS's doc states that the nsAccountLock attribute is multi-valued [1]. Some tests with 389ds led me to think it's also true for 389ds. I cannot think of any reason explaining why it would have to be multi-valued. Do you have any idea? Thank you. [1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server…

3 2

changelog
by Denise Cosso 16 Apr '15

16 Apr '15

Hi, How to modify the attribute nsslapd-encryptionalgorithm in Centos? Thanks, Denise Stop Master servers and set nsslapd-encryptionalgorithm. The allowed value is AES or 3DES. dn: cn=changelog5,cn=config [...] nsslapd-encryptionalgorithm: AES --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:34 On 06/04/2013 01:26 PM, Denise Cosso wrote: Hi, Rich CentOS release 6.3 (Final) 389-ds-base-libs-1.2.10.2-20.el6_3.x86_64 389-ds-1.2.2-1.el6.noarch 389-dsgw-1.1.10-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-ds-base-1.2.10.2-20.el6_3.x86_64 As far as replication goes - you will need to use a security layer (SSL, TLS, or GSSAPI) to protect the clear text password on the wire As far as encrypting it in the changelog - not sure Denise --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Cc: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:11 On 06/04/2013 12:39 PM, Denise Cosso wrote: Hi, Description of problem: When a userPassword is changed in a server with changelog, the hashed password is logged and also a cleartext pseudo-attribute version. It looks like this: change:: replace: userPassword userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q== - replace: unhashed#user#password unhashed#user#password: secret12 This unhashed version is used in winsync where the cleartext version of the password must be written to the AD. Now if the DS is involved in replication with another DS, the change will be replayed exactly as it is logged to the other DS replicas, including the cleartext pseudo-attribute password. What platform? What version of 389-ds-base are you using? thanks, Denise -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

2 2

389 GUI/Console
by Gonzalo Fernandez Ordas 03 Mar '15

03 Mar '15

Hi I got 389 running on a remote linux box,and I would like to get use of the Console without the need of exporting the X-Windows whenever I want to make a change as I also would prefer not to keep tweaking the configuration files all the time. is there anyway of doing this through any remote client? Any advise on this matter? Thanks very much

4 11

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

389-console in rhel7
by Pepe Charli 20 Aug '14

20 Aug '14

Is 389-console available for rhel7? Thanks,

2 2

Re: [389-users] 389-users Digest, Vol 110, Issue 27
by Alan Willis 28 Jul '14

28 Jul '14

Using the --silent and --file options with register-ds-admin.pl still presents a prompt for many of the same configuration items included in the supplied inf file, including ConfigDirectory entries and SuiteSpot user and group ids. My inf file contains General, admin, and slapd sections, and is the same one that I use with setup-ds and setup-ds-admin scripts, which are successful with --silent and --file options. I can supply a sample if that helps. thanks! -alan On Mon, Jul 28, 2014 at 1:00 PM, <389-users-request(a)lists.fedoraproject.org> wrote: > > Message: 2 > Date: Sun, 27 Jul 2014 15:35:47 +0000 > From: Jesse Defer <Jesse.Defer(a)asu.edu> > To: General discussion list for the 389 Directory server project. > <389-users(a)lists.fedoraproject.org> > Subject: Re: [389-users] Non-interactive register-ds-admin > Message-ID: > < > 6959588297350547BDA8F69C35F39F1F24975ADC(a)exmbw02.asurite.ad.asu.edu> > Content-Type: text/plain; charset="iso-8859-1" > > You must supply it with both the --silent and --file options to the script > for non-interactive operation. For the .inf file format see > http://directory.fedoraproject.org/wiki/FDS_Setup > > Jesse > -- [image: fist]Alan Willis Systems Administrator | Riot Games Email: alwillis(a)riotgames.com Mobile: 00353 (0) 831794044 For, to speak out once for all, man only plays when in the full meaning of the word he is a man, and *he is only completely a man when he plays*. - J.C. Friedrich von Schiller - Letters upon the Æsthetic Education of Man

2 1

Non-interactive register-ds-admin
by Alan Willis 27 Jul '14

27 Jul '14

I'm having a difficult time finding documentation to help me figure out how to run register-ds-admin silently and noninteractively. Alternatively, is there any other way to register admin servers with the configuration directory server? Would setup - DS - admin -u do it? Can anyone give me some pointers? Thanks in advance, -alan

2 1

port 389 listener getting hung up on connection locks?
by Thomas Walker 25 Jul '14

25 Jul '14

Hi, I've recently been trying to hunt down some odd performance problems with our installation of 389 LDAP (currently 1.3.2.19 but been following recent debian unstable). We've been seeing long delays (tens of seconds at times) handling even the simplest new bind()s while the server otherwise has idle worker threads (and other non-idle worker threads servicing existing conenctions). Upon grabbing some userland thread stacks during these "hangs" when no new external connections could be established, I saw what looked to be the thread associated with slapd_daemon() in ldap/servers/slapd/daemon.c hung up in setup_pr_read_pds() walking the list of active connections acquiring connection locks (c->c_mutex) sequentially in the process. I stuck some calls to clock_gettime() around the PR_Lock(c->c_mutex) call or or about ldap/servers/slapd/daemon.c:1690 and warned when we waitied for more than a set duration: [22/Jul/2014:17:37:05 +0000] - setup_pr_read_pds: (fd=192) waited 995.375473 msecs for lock [22/Jul/2014:17:37:08 +0000] - setup_pr_read_pds: (fd=202) waited 3003.548263 msecs for lock [22/Jul/2014:17:37:10 +0000] - setup_pr_read_pds: (fd=181) waited 1997.828897 msecs for lock <up to 20-30 seconds in some extreme cases> It looks like this could hang for up to CONN_TURBO_TIMEOUT_INTERVAL (default 1 second) per thread in turbo (up to 50% of worker pool by default). While stuck there, it isn't calling handle_listeners() to pull new connections off of the well known port. Perhaps handle_listeners() should run off in its own thread, away from this connection maitenance? (or if it must be there, a non-blocking PRP_TryLock() or somesuch?) TIA Thomas

2 9

Retro changelog plugin and ds 1.2.10.14 - modify type missing in changes attribute
by Justin Kinney 23 Jul '14

23 Jul '14

Hello, I'm currently encountering an issue with the retro changelog plugin and the changes attribute that it adds to the changelog db. I have two ldap instances: one working, and one not. In the working instance, I see the following in the changes attribute of the changelog entry: replace: userpassword userpassword: {crypt}...elided... - add: userpassword userpassword: {crypt}...elided... - The same change in the broken ldap instance has the following for the changes attribute: userpassword: {crypt}...elided... - userpassword: {crypt}...elided... - Has anyone seen similar behavior? Any ideas where to look to troubleshoot further? The primary difference between the two instances is that I have yet to configure ldaps on the broken instance, which I'm about to do. Thanks in advance, Justin

1 0

DS SSL cfg
by ghiureai 22 Jul '14

22 Jul '14

Hello List, I would like to know if DS can be cfg for TLS/SSL + CA connections later one or must to be done at installation time ? Isabella -- -

2 1

synchronize 389DS uid with userPrincipalName from Active Directory
by Mihai Carabas 22 Jul '14

22 Jul '14

Hi, We are currently using 389-DS as a LDAP server for our university (University Politehnica from Bucharest). Right now we have about 35000 accounts created into the 389-DS. We need to synchronize all the accounts with an Active Directory server for various purposes (Wifi authentication/e-mail authentication, etc). I've setup the 389-DS / Active Directory replication succesfully but we have a design problem: a very high number of users has the username (uid: field) larger than 20 characters and I can't pass this uid to the ntUserDomainId (which is equivelant with the sAMAccount in AD). Is there any way that I can populate the userPrincipalName with this uid? (which does not have the limit indicated above) Thank you in advance, Mihai

2 4

LDAP Authenticated User Unable to Overwrite a File
by Paul Whitney 21 Jul '14

21 Jul '14

I am having an issue where and LDAP authenticated user cannot overwrite or remove a file on the LDAP-client system even though the permission are set to 777. However, the user is able to create a new file (file is owned by that user) and can be removed by that user. Is there some limitation on actions on a file owned by different user but permissions set to 777 (rwxrwxrwx)? I have checked to make sure no special attributes are enabled on the file (lsattr). Thanks Paul M. Whitney E-mail: paul.whitney(a)mac.com Cell: 410.493.9448 Sent from my browser.

1 1

service desk account can no longer modify passwords
by Elizabeth Jones 21 Jul '14

21 Jul '14

We have a service desk account that I created in our LDAP that has the ability to add/delete/modify all our user accounts. Except that now that we have password policy in place, it can no longer modify our user account passwords. I have confirmed that the password changes that it is doing conform to our password policy, but every time it comes back with constraint violation. But I can do anything with password changes as directory manager. One thing that I haven't confirmed is whether the accounts that they are trying to change are accounts that have expired. So does anyone know if an account has locked, can only directory manager change the password at that point? Or does anyone know what attributes I would need to have on my servicedesk account to allow it to change these passwords now? I don't want to give them directory manager if I can avoid it but I need to find some way to let them override password policy! thanks, EJ

1 0

Questions about 389 Directory Server
by Cary Lee Dailey 17 Jul '14

17 Jul '14

We are conducting research on different options for an LDAP related project we are working on. I have been asked to find answers to the following questions about 389: - max number of users/groups it can support - Integration with Oracle 11g? - Integration with OAM? - Current clients who use this. If anyone could help me out that would be great. Appreciate the info. Thanks, -- *Cary Lee Dailey, PMP®* *Business Analyst * Office 703-917-8188, ext. 112 Cell 703-220-7256 carylee.dailey@arrayinfotech [image: cid:image009.jpg@01CDE763.B9372570] <http://www.arrayinfotech.com/> 7474 Greenway Center Drive, Suite 600 Greenbelt, MD 20770 [image: Facebook_icon.jpg]Like ARRAY <http://www.facebook.com/pages/Array-Information-Technology/196357113747649?…> | [image: Twitter_icon.jpg] Follow ARRAY <https://twitter.com/ArrayInfoTech> | [image: Linkedln_icon.jpg] Join ARRAY <http://www.linkedin.com/company/array-information-technology-inc>

1 0

memberof plugin not working as expected
by Alberto Viana 16 Jul '14

16 Jul '14

Hi, 389-Directory/1.3.2.13 B2014.141.1513 I recently updated my server to 1.3.2.13 and the "memberof" plugin is not working as expected, it's not updating my user "memberOf" attribute whe I put a user in a group. How can I debug it? I tried to set my nsslapd-errorlog-level to 65536 but could not find any useful information. Thanks Alberto Viana

4 11

password policy
by Elizabeth Jones 16 Jul '14

16 Jul '14

We seem to have something odd going on with our password policy. I configured global password policy on our LDAPs so that all accounts under our userRoot subtree expire, then under the subtrees that contain our service accounts I configured to never expire. But I just noticed that the accounts under those subtrees actually have expiration date attributes. I went into one of the accounts and set the password policy explicitly on that account, but the attribute still shows that it is going to expire two days from now. So I'm waiting to see what happens in two days - will the password policy that I set for the subtree/user work, or will it expire because the attribute is set to make it expire. I'm kind of confused as to why it would even have that attribute set when the subtree is set to never expire. EJ

1 0

Server crash after some paged search
by carne_de_passaro 15 Jul '14

15 Jul '14

Hi all, I have a customer which have installed 389-ds-base-1.2.11.15-32.el6_5.x86_64 on his server. This server is acting as a HUB, cascading replications from the master to the slave servers. The issue is the fact of this server dies some times during a day. I look to the error log and see messages like this "pagedresults_parse_control_value: invalid cookie: -1" nothing relevant before it, and after it, I see that message when the server was started up. In my research on the internet, I've found this bug [1], which was already corrected. So my question right now is: Which version, exactly, this bug was corrected? In the webpage, it's say version 1.2.11, but how can I know if the version I'm using have this bug corrected? Thanks in advance. [1] https://fedorahosted.org/389/changeset/b2ee65dd6c4af4f2cab515406a6f7fd9f1dc…

2 2

new to 389DS - have Q's
by ghiureai 15 Jul '14

15 Jul '14

Hi Gurus, I'm new to 389 DS reading the RH DS docbefore start implementing, have Q's trying tohave system with high performance cfg Q1: Bellow in black is from RH DS documentation, I was expecting just creating the indexes in GUI DS console should be suficient , is this the correct, still need to run the manually script? Q2: What are operations to maintain the indexes are any updates statistics, reorg rebuild need to be run to maintainthe high performance in DS? Q3: Access controls what 's average of user rules do you ususually have per db or user. are there any maintenance jobs to perform, I believe the more AC rules you have you have the chance to affect login performance , is this correct? -- ----------------------------------------------------------- 9.3. Applying New Indexes to Existing Databases New indexes are not added to existing databases automatically. They must be added manually, and Directory Server has two methods for applying new indexes to an existing database: running the |db2index.pl| script or running a |cn=index,cn=tasks| task. Isabella A. Ghiurea Isabella.Ghiurea(a)nrc-cnrc.gc.ca Canadian Astronomy Data Centre |http://www.nrc-cnrc.gc.ca/eng/services/hia/data-centre.html National Research Council of Canada, Herzberg Institute of Astrophysics 5071 West Saanich Road, Victoria BC V9E 2E7, Canada Phone: 250 363-3446 fax: 250 363-0045

2 1

LDAP host standby solution
by ghiureai 14 Jul '14

14 Jul '14

Hi LDAPUSERS, I would like a design cfg suggestionfor implementing a hot standby LDAP solution, would multimmaster configuration be sufficient? I need some cfg which will switch the clients instantaneous to a second master , transparent to clients, no downtime and "0" loss of transactions. Thank you Isabella --

4 4

389 LDAP training
by ghiureai 14 Jul '14

14 Jul '14

Hi LDAP Users. I'm new to LDAP world, I'm coming from a DBA backgroundand looking for advise in getting some very decent good quality LDAP /389DS or open LDAP training from a professional IT vendor . Would you please make some suggestion, I would prefer west coast N. America. Isabella --

3 3

TLS replication
by Elizabeth Jones 13 Jul '14

13 Jul '14

Have a question on TLS replication with 4 LDAP servers. Each of the 4 LDAP servers has its own CA cert (each with a unique nickname and serial number). If I install just one of the CA certs onto the master and then initialize one of its consumers, its fine. But if I install a second CA cert on the master and try to initialize either of the consumers, replication fails to both with error Can't Contact LDAP server, Error Code -1 I am really confused. Can I not have multiple CAs installed on my master? thanks, EJ

1 1

389 windows console
by Ryan Ferguson 11 Jul '14

11 Jul '14

When using the 389 windows console version 1.1.6 "Posix Group" is not displayed and we cannot view group members to add and remove from the group. However when using the linux console the "Posix Group" tab is available. Is this a known issue and is there a workaround to have it display the tab? -- <http://www.ifactorconsulting.com/products/ifactor-mobile/> <http://www.ifactorconsulting.com/> <https://twitter.com/ifactor> <http://www.linkedin.com/company/125694?trk=tyah> <http://www.youtube.com/ifactorvideos> <http://visitor.r20.constantcontact.com/d.jsp?llr=dlwcnrcab&p=oi&m=110224325…>

2 4

Version differences 1.2.11.29 vs 1.3.x
by Groten, Ryan 10 Jul '14

10 Jul '14

I'm a little confused about the different versions of 389 that are available. I followed the documentation on the Downloads page and I see the newest version of ds-base available is 1.2.11.29-1.el6 (for RHEL6), but I also see a bunch of 1.3.x versions on the main page (including release builds?). Is there a difference? Thanks, Ryan

3 3

Announcing 389 Directory Server version 1.3.2.19
by Noriko Hosoi 09 Jul '14

09 Jul '14

389 Directory Server 1.3.2.19 The 389 Directory Server team is proud to announce 389-ds-base version 1.3.2.19. Fedora packages are available from the Fedora 20 Testing and Rawhide repositories. The new packages and versions are: * 389-ds-base-1.3.2.19-1 A source tarball is available for download at http://port389.org/sources/389-ds-base-1.3.2.19.tar.bz2 Highlights in 1.3.2.19 * Various bugs were fixed. Installation and Upgrade See Download <http://directory.fedoraproject.org/wiki/Download> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://directory.fedoraproject.org/wiki/Install_Guide> for more information about the initial installation, setup, and upgrade See Source <http://directory.fedoraproject.org/wiki/Source> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://admin.fedoraproject.org/mailman/listinfo/389-users If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 1.3.2.16 * Ticket 346 - Slow ldapmodify operation time for large quantities of multi-valued attribute values * Ticket 47446 - logconv.pl memory continually grows * Ticket 47538 - RFE: repl-monitor.pl plain text output, cmdline config options * Ticket 47541 - Replication of the schema may overwrite consumer 'attributetypes' even if consumer definition is a superset * Ticket 47640 - Fix coverity issues - part 3 * Ticket 47670 - Aci warnings in error log * Ticket 47676 - Replication of the schema fails 'master branch' -> 1.2.11 or 1.3.1 * Ticket 47704 - invalid sizelimits in aci group evaluation * Ticket 47707 - 389 DS Server crashes and dies while handles paged searches from clients * Ticket 47713 - Logconv.pl with an empty access log gives lots of errors * Ticket 47720 - Normalization from old DN format to New DN format doesnt handel condition properly when there is space in a suffix after the seperator operator. * Ticket 47721 - Schema Replication Issue * Ticket 47722 - Fixed filter not correctly identified * Ticket 47722 - rsearch filter error on any search filter * Ticket 47732 - ds logs many "SLAPI_PLUGIN_BE_TXN_POST_DELETE_FN plugin returned error" messages * Ticket 47733 - ds logs many "Operation error fetching Null DN" messages * Ticket 47734 - Change made in resolving ticket #346 fails on Debian SPARC64 * Ticket 47735 - e_uniqueid fails to set if an entry is a conflict entry * Ticket 47740 - Coverity Fixes (Mark - part 1) * Ticket 47740 - Coverity issue in 1.3.3 * Ticket 47740 - Crash caused by changes to certmap.c * Ticket 47740 - Fix coverity erorrs - Part 4 * Ticket 47740 - Fix coverity issues - Part 5 * Ticket 47740 - Fix coverity issues(part 7) * Ticket 47740 - Fix coverity issues: null deferences - Part 6 * Ticket 47740 - Fix sync plugin resource leaks * Ticket 47743 - Memory leak with proxy auth control * Ticket 47748 - Simultaneous adding a user and binding as the user could fail in the password policy check * Ticket 47750 - Creating a glue fails if one above level is a conflict or missing * Ticket 47759 - Crash in replication when server is under write load * Ticket 47763 - winsync plugin modify is broken * Ticket 47764 - Problem with deletion while replicated * Ticket 47766 - Tombstone purging can crash the server if the backend is stopped/disabled * Ticket 47767 - Nested tombstones become orphaned after purge * Ticket 47770 - #481 breaks possibility to reassemble memberuid list * Ticket 47771 - Move parentsdn initialization to avoid crash * Ticket 47772 - empty modify returns LDAP_INVALID_DN_SYNTAX * Ticket 47773 - mem leak in do_bind when there is an error * Ticket 47774 - mem leak in do_search - rawbase not freed upon certain errors * Ticket 47779 - Need to lock server list when removing list * Ticket 47779 - Part of DNA shared configuration is deleted after server restart * Ticket 47779 - Potential deadlock after startup if a dna configuration change is made * Ticket 47780 - Some VLV search request causes memory leaks * Ticket 47782 - Parent numbordinate count can be incorrectly updated if an error occurs * Ticket 47787 - A replicated MOD fails (Unwilling to perform) if it targets a tombstone * Ticket 47792 - database plugins need a way to call betxn plugins * Ticket 47793 - Server crashes if uniqueMember is invalid syntax and memberOf plugin is enabled. * Ticket 47804 - db2bak.pl error with changelogdb * Ticket 47806 - Failed deletion of aci: no such attribute * Ticket 47808 - If be_txn plugin fails in ldbm_back_add, adding entry is double freed. * Ticket 47809 - find a way to remove replication plugin errors messages "changelog iteration code returned a dummy entry with csn %s, skipping ..." * Ticket 47813 - managed entry plugin fails to update member pointer on modrdn operation * Ticket 47815 - Add operations rejected by betxn plugins remain in cache * Ticket 47817 - The error result text message should be obtained just prior to sending result * Ticket 47821 - deref plugin cannot handle complex acis * Ticket 47831 - server restart wipes out index config if there is a default index * Ticket 47839 - 389-ds production segfault: __memcpy_sse2_unaligned... Retrieved from "http://directory.fedoraproject.org/wiki/Releases/1.3.2.19"

1 0

Leading/trailing spaces in password
by David Kupka 09 Jul '14

09 Jul '14

Hi! I encounter a problem with 389 Directory Server. When the password for Directory Manager contains leading and/or trailing spaces (' ', ASCII code 32) setup-ds.pl ignores them. I'm then able to authenticate with stripped password but not with the original one. Is this behavior intentional or should I file a bug report for that? If it's intentional is it documented somewhere? Thanks in advance! -- David Kupka

2 1

Error with usernames containing periods
by Dave Page 08 Jul '14

08 Jul '14

Hi I'm working on a PoC migration of an OpenLDAP infrastructure to 389. Our existing directory has periods in all of the usernames, e.g. dave.page. However, this seems to cause problems with the org chart interface, which complains with: "." is not allowed in search filters. when clicking on the org chart icon for a user. The same issue is seen when using directory express and clicking the org chart link. How can I resolve this, without changing hundreds of usernames (which is not an option)? The server is running on CentOS 6.5, x86_64 with all updates applied, installed from EPEL: [root@389-ds ~]# rpm -qa |grep 389 389-ds-base-1.2.11.15-33.el6_5.x86_64 389-ds-1.2.2-1.el6.noarch 389-admin-console-doc-1.1.8-1.el6.noarch 389-adminutil-1.1.19-1.el6.x86_64 389-admin-console-1.1.8-1.el6.noarch 389-dsgw-1.1.11-1.el6.x86_64 389-ds-base-libs-1.2.11.15-33.el6_5.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-console-1.1.7-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-admin-1.1.35-1.el6.x86_64 -- Dave Page Blog: http://pgsnake.blogspot.com Twitter: @pgsnake EnterpriseDB UK: http://www.enterprisedb.com The Enterprise PostgreSQL Company

2 5

Current recommended version of 389ds for RHEL7
by Ivanov Andrey (M.) 08 Jul '14

08 Jul '14

Hi, we're going to migrate from CentOS5/389ds v1.2.10.26 to RHEL7/CentOS7. We are running three replicated master 389ds server in a busy production environment (~30000 entries, ~20 requests/sec on each master) with several plugins activated (memberOf, referential integrity, pam passthroughcat, uniqueness, usn) and a lot of custom indexes. What is the current stable recommended version for production on RHEL7? We are compiling the binaries from sources, so we are not limited by the availability of rpms. I see that there are three git branches maintained : 1.2.11, 1.3.1 and 1.3.2, there is also an "official" rpm package 1.3.1 in RHEL7. Does it mean that 1.3.1 is considered as stable version for RHEL7? As I can see, not all the fixes are back-ported from 1.3.2 to 1.3.1 (ex https://fedorahosted.org/389/ticket/47313#comment:20) So is there any reason to use 1.3.2 instead of 1.3.1 or 1.3.2 is still not considered stable enough? Thank you!

1 0

Header menu display issue in DSGW
by Dave Page 07 Jul '14

07 Jul '14

Hi, I've just installed 389 on a fresh, fully patched CentOS 6.5 x86_64 box from EPEL and am seeing the attached display issue when accessing the Directory Server Gateway. My client machine is a Mac running OS X 10.9.3, on which I've tested with: Chrome 35.0.1916.153 Firefox 31.0 Safari 7.0.4 I also see the issue on Firefox 24.6.0 running on RHEL 7. Thanks! -- Dave Page Blog: http://pgsnake.blogspot.com Twitter: @pgsnake EnterpriseDB UK: http://www.enterprisedb.com The Enterprise PostgreSQL Company

3 6

1.2.11.30 ETA?
by Michael Gettes 07 Jul '14

07 Jul '14

Kind 389 devs, i am on 1.2.11.29 and for my environment - it’s been great! I have been watching the tickets with respect to 1.2.11.30 and I am curious as to when this release may be available? There are a few items pertaining to my environment which we would so dearly appreciate. 346 would be a HUGE win for us. We are seeing periodic problems which seem to indicate 47773/4 may address as well. I recognize you guys bust your butts and I truly hate asking this question - but please know your work is so appreciated. thank you so much! /mrg

3 9

encryption and self signed certs
by Elizabeth Jones 03 Jul '14

03 Jul '14

I'm suddenly stumped by self-signed certs. I used the setupssl2.sh script to generate my certs and install them into my ldap. I end up with this -- # certutil -L -d . Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CA certificate CTu,u,u Server-Cert u,u,u getent is able to see my ldap accounts and ldapsearch -ZZ returns successfully. But I can't authenticate successfully unless I add TLS_ReqCert allow to my ldap configs on my client. But what is weird is I *know* that this has worked in the past. LDAP server: 389-ds-base-1.2.11.25-1.el6.x86_64 OS 2.6.39-300.26.1.el6uek.x86_64 6.5 (Santiago) Client: OS 2.6.39-300.26.1.el6uek.x86_64 openssl-1.0.1e-16.el6_5.14.x86_64 nscd-2.12-1.80.el6_3.7.x86_64 nss-pam-ldapd-0.7.5-15.el6_3.2.x86_64 nss-3.13.6-2.0.1.el6_3.x86_64 openssh-5.3p1-94.el6.x86_64 When I try to authenticate I get this error message: Jul 3 13:03:03 myserver nslcd[21796]: [495cff] ldap_result() failed: Can't contact LDAP server Googling this it looks like it doesn't trust my CA. But I *KNOW* that this has worked in the past. But we have patched our clients recently and have newer release of openssl. Does anyone have any idea of how I can get past this? thanks, EJ

1 0

1.3.2.16 Release version missing dependencies
by Balaji P 02 Jul '14

02 Jul '14

Hi , I've downloaded the 389 DS source "Release 1.3.2.16" from http://port389.org/sources/389-ds-base-1.3.2.16.tar.bz2. When trying to compile with configure and make options [trying to compile the code in CentOS6.5 final, I've a custom script to build the source], I could see the make fails with missing dependencies. I've checked the previous version of source download [1.3.2.3] which I downloaded much earlier and could see "build.test" directory which has "Makefile" With the present build "1.3.2.16" I'm missing the entire "build.test" directory. I've verified downloading the previous versions and could see the same folder getting missed. Am I missing something? 389 DS missing necessary build dependencies. Could someone advice on this? Thanks, Balaji P

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2014