Announcing 389 Directory Server 1.4.4.0
by Mark Reynolds
389 Directory Server 1.4.4.0
The 389 Directory Server team is proud to announce 389-ds-base version
1.4.4.0
Fedora packages are available on Rawhide (Fedora 33).
https://koji.fedoraproject.org/koji/taskinfo?taskID=43472534
<https://koji.fedoraproject.org/koji/taskinfo?taskID=43472534>
The new packages and versions are:
* 389-ds-base-1.4.4.0-1
Source tarballs are available for download at Download
389-ds-base Source
<https://releases.pagure.org/389-ds-base/389-ds-base-1.4.4.0.tar.bz2>
Highlights in 1.4.4.0
* Bug fixes
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use *dnf install 389-ds-base*
To install the Cockpit UI plugin use *dnf install cockpit-389-ds*
After rpm install completes, run *dscreate interactive*
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source <https://www.port389.org/docs/389ds/development/source.html>
for information about source tarballs and SCM (git) access.
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
If you find a bug, or would like to see a new feature, file it in our
Pagure project: https://pagure.io/389-ds-base
* Bump version to 1.4.4.0
* Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
* Issue 50931 - RFE AD filter rewriter for ObjectCategory
* Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
* Issue 50980 - RFE extend usability for
slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
* Issue 51008 - dbhome in containers
* Issue 50875 - Refactor passwordUserAttributes’s and
passwordBadWords’s code
* Issue 51014 - slapi_pal.c possible static buffer overflow
* Issue 50545 - remove dbmon “incr” option from arg parser
* Issue 50545 - Port dbmon.sh to dsconf
* Issue 51005 - AttributeUniqueness plugin’s DN parameter should not
have a default value
* Issue 49731 - Fix additional issues with setting db home directory
by default
* Issue 50337 - Replace exec() with setattr()
* Issue 50905 - intermittent SSL hang with rhds
* Issue 50952 - SSCA lacks basicConstraint:CA
* Issue 50640 - Database links: get_monitor() takes 1 positional
argument but 2 were given
* Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates
the value
--
389 Directory Server Development Team
4 years, 2 months
Quickstart documentation: SSSD setup needs "memberOf" plugin enabled
by Johannes Kastl
Hi guys,
the quickstart documentation (which is a very nice piece of documentation) does
setup the memberOf plugin.
http://www.port389.org/docs/389ds/howto/quickstart.html
However the SSSD part does not mention that you need to have that plugin enabled
on the server, otherwise you will not get a working login. At least, I could not
get this to work without the plugin.
"dsidm localhost client_config sssd.conf server_admins"
This creates a sssd.conf that contains the following ldap filter:
> ldap_access_filter = (memberOf=cn=server_admins,ou=groups,dc=example,dc=org)
I have opened a PR against the wiki mentioning this in the SSSD part.
https://github.com/marcus2376/389wiki/pull/33
Kind Regards,
Johannes
--
Johannes Kastl
Linux Consultant & Trainer
Tel.: +49 (0) 151 2372 5802
Mail: kastl(a)b1-systems.de
B1 Systems GmbH
Osterfeldstraße 7 / 85088 Vohburg
http://www.b1-systems.de
GF: Ralph Dehner
Unternehmenssitz: Vohburg / AG: Ingolstadt,HRB 3537
4 years, 2 months
New Instance errors
by Nick Bright
Greetings,
I've performed a fresh CentOS 8 installation within VMWare, updated the
OS fully, installed 389-ds through yum by: yum module install
389-directory-server:stable/default
This installed the server, along with the cockpit module. I then used
the cockpit module to create an instance. No matter what, every time, it
reports "Failed to create instance", but if I refresh the page, the
instance is visible in the drop down along with error "This server
instance is running, but we can not connect to it. Check LDAPI is
properly configured on this instance."
Then I did some research on the LDAPI error, I tried a number of methods
from those search results to enable LDAPI, but all failed with various
errors; all essentially being "authentication failed".
I tried again by removing all instances and starting over from the
command line, using "dscreate interactive" to create an instance. This
also failed with "Not authorized".
Surely I am doing something wrong; I can't imagine that the software is
just simply broken right out of the package on a fresh installation.
Any tips or specific documentation links appreciated.
--
--------------- Email Signature
Nick Bright - VICE PRESIDENT OF TECHNOLOGY
P: 888.332.1616 W: valnet.net <https://valnet.net> F: Facebook
<https://www.facebook.com/ValnetISP/>
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the
system manager. This message contains confidential information and is
intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail.
Please notify the sender immediately by e-mail if you have received this
e-mail by mistake and delete this e-mail from your system. If you are
not the intended recipient you are notified that disclosing, copying,
distributing or taking any action in reliance on the contents of this
information is strictly prohibited.
4 years, 2 months
Issues with GSSAPI kerberos authentication - realm undefined?
by Kyle Brantley
I'm trying to move over from OpenLDAP, as it seems that 389-ds is better
supported in the RH family of products.
I've followed the RH docs to configure kerberos[1] as well as checking
to ensure that the auth mechanisms are enabled and I've poked around
with the SASL identity mappings. From what I can tell, all of these are
setup correctly.
However, every single time, the realm isn't populated with the kerberos
realm and instead, only the username is passed. This results in the SASL
mapping that matches the realm (correctly) failing to match:
DEBUG - do_bind - BIND dn="" method=163 version=3
DEBUG - ids_sasl_listmech - sasl library mechs:
GSS-SPNEGO,GSSAPI,DIGEST-MD5,CRAM-MD5,PLAIN,LOGIN,ANONYMOUS
DEBUG - ids_sasl_log - (5): GSSAPI server step 3
DEBUG - ids_sasl_canon_user - (user=kyletest, realm=)
DEBUG - sasl_map_domap - Trying map [Kerberos uid mapping]
DEBUG - sasl_map_check - regex: (.*)(a)(.*)\.(.*), id: kyletest, didn't match
I've trimmed the above to just the more relevant log lines, but it's
very clear that the value for "realm" is en empty string.
What do I need to do in order to have the realm be made visible to the
SASL mapping component? I've searched the docs, both the fedora and the
pagure bug trackers, searched all of the nsslapd-* attributes to see if
I'm missing something, and tried on both centos8 and F31 (same results).
I don't see anything obvious missing here (but I might just not know
where to be looking).
F31 package: 389-ds-base-1.4.2.11-1.fc31.x86_64
CentOS8 package: 389-ds-base-1.4.2.9-1.module_el8+8314+9ac085f5.x86_64
- Kerberos setup:
[root@ldaptest ~]# cat /etc/sysconfig/dirsrv-app
KRB5_KTNAME=/etc/dirsrv/krb5.keytab
[root@ldaptest ~]# kinit -kt /etc/dirsrv/krb5.keytab ldap/$HOSTNAME
[root@ldaptest ~]# klist
Ticket cache: KCM:0:9594
Default principal: ldap/ldaptest.averageurl.com(a)AVERAGEURL.COM
- klist after attempting an ldapwhoami:
[root@ldaptest ~]# klist
Ticket cache: KCM:0:39355
Default principal: kyletest(a)AVERAGEURL.COM
Valid starting Expires Service principal
04/12/2020 10:33:44 04/13/2020 10:33:40
krbtgt/AVERAGEURL.COM(a)AVERAGEURL.COM
04/12/2020 10:33:51 04/13/2020 10:33:40
ldap/ldaptest.averageurl.com(a)AVERAGEURL.COM
- SASL mapping:
nsSaslMapRegexString: \(.*\)(a)\(.*\)\.\(.*\)
nsSaslMapFilterTemplate: (cn=\1)
nsSaslMapBaseDNTemplate: ou=accounts,dc=app,dc=averageurl,dc=com
- Alternative SASL mapping that I'd prefer to use:
nsSaslMapRegexString: \(.*\)(a)AVERAGEURL\.COM
nsSaslMapFilterTemplate: (cn=\1)
nsSaslMapBaseDNTemplate: ou=accounts,dc=app,dc=averageurl,dc=com
Thanks,
--Kyle
[1]
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11...
4 years, 2 months