September 2021 - 389-users - Fedora Mailing-Lists

by Michael Starling

________________________________ From: Michael Starling <mlstarling31(a)hotmail.com> Sent: Thursday, September 23, 2021 10:10 AM To: Mark Reynolds <mreynolds(a)redhat.com>; General discussion list for the 389 Directory server project. <389-users(a)lists.fedoraproject.org> Subject: Re: [389-users] dsidm utility inconsistencies ________________________________ From: Mark Reynolds <mreynolds(a)redhat.com> Sent: Wednesday, September 22, 2021 8:14 PM To: Michael Starling <mlstarling31(a)hotmail.com>; General discussion list for the 389 Directory server project. <389-users(a)lists.fedoraproject.org> Subject: Re: [389-users] dsidm utility inconsistencies On 9/22/21 5:11 PM, Michael Starling wrote: ________________________________ From: Mark Reynolds <mreynolds(a)redhat.com><mailto:mreynolds@redhat.com> Sent: Wednesday, September 22, 2021 3:38 PM To: General discussion list for the 389 Directory server project. <389-users(a)lists.fedoraproject.org><mailto:389-users@lists.fedoraproject.org>; Michael Starling <mlstarling31(a)hotmail.com><mailto:mlstarling31@hotmail.com> Subject: Re: [389-users] dsidm utility inconsistencies On 9/22/21 2:58 PM, Michael Starling wrote: Unless I'm interpreting the man pages, and documentation wrong there seems to be some issues with the dsidm utility. Perhaps I'm doing something wrong? This works. dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account get-by-dn uid=mstarlingt,ou=People,dc=mydomain,dc=com dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com cn: Mike Starling gecos: Mike Starling test account gidNumber: 100 givenName: Mike homeDirectory: /home/mstarlingt loginShell: /bin/ksh mail: mstarling(a)mydomain.com<mailto:mstarling@mydomain.com> objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowExpire: 99999 shadowLastChange: 18857 shadowMax: 33 shadowWarning: 1 sn: Starling uid: mstarlingt uidNumber: 25574 #Password reset works dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account reset_password "uid=mstarlingt,ou=People,dc=mydomain,dc=com" Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com : CONFIRM - Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com : reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com #Unable to lock the account. dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt Error: No such object I consult the help which says to specify the dn dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock -h usage: dsidm instance account lock [-h] [dn] positional arguments: dn The dn to lock optional arguments: -h, --help show this help message and exit dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com Error: search_ext() argument 1 must be str, not None I think this is a known bug (which was fixed). What version of python-lib389 is installed? Thanks Mark. python3-lib389-1.4.3.17-1.module_el8+10764+2b5f8656.noarch is installed Yes this is a old version, and the fix (Issue 4912) was recently made. We will have to do new builds... dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com" Error: search_ext() argument 1 must be str, not None dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b dc=mydomain,dc=com account lock "uid=mstarlingt" I tried changing the base to the People OU where the account lives dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b ou=People,dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com" Error: search_ext() argument 1 must be str, not None dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get Enter uid to retrieve : mstarlingt Error: No object exists given the filter criteria mstarlingt What is in the access log? Here's what I see in the logs. 22/Sep/2021:17:09:28.515626170 -0400] conn=3947 op=2 SRCH base="ou=people,dc=mydomain,dc=com" scope=2 filter="(&(&(objectClass=nsPerson)(objectClass=nsAccount)(objectClass=nsOrgPerson)(objectClass=posixAccount))(|(uid=mstarlingt)(displayName=mstarlingt)(cn=mstarlingt)))" attrs="distinguishedName" So dsidm is pretty opinionated about how it looks for users (which might need to change). It only looks for entries that have all of these objectclasses: nsPerson, nsAccount, nsOrgPerson, posixAccount. What objectclasses are in your user entry? Mark Ahh. That's it. The mstarlingt account was created with an LDIF and does not have the "ns" object classes. I notice when I go to create an account with dsidm I have limited ability to specify attributes. Is the best way to create an account still with an LDIF file? When I create an account with dsidm it has no loginShell. Is there a default template dsidm pulls from that needs to be updated with the other possible user attributes that are set as the default and not covered by the dsidm utility? dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user create --uid="dstest" --cn="Test dsidm" --gidNumber="100" --homeDirectory="/home/dstest" --displayName="Test Account" --uidnumber="25941" --mail="mstarling(a)mydomain.com" --loginShell="/bin/bash" usage: dsidm [-h] [-b BASEDN] [-v] [-D BINDDN] [-w BINDPW] [-W] [-W PWDFILE] [-Z] [-j] instance {account,group,initialise,organizationalunit,posixgroup,user,client_config,role} ... dsidm: error: unrecognized arguments: --uidnumber=25941 --mail=mstarling(a)mydomain.com --loginShell=/bin/bash dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user create -h usage: dsidm instance user create [-h] [--uid [UID]] [--cn [CN]] [--displayName [DISPLAYNAME]] [--uidNumber [UIDNUMBER]] [--gidNumber [GIDNUMBER]] [--homeDirectory [HOMEDIRECTORY]] optional arguments: -h, --help show this help message and exit --uid [UID] Value of uid --cn [CN] Value of cn --displayName [DISPLAYNAME] Value of displayName --uidNumber [UIDNUMBER] Value of uidNumber --gidNumber [GIDNUMBER] Value of gidNumber --homeDirectory [HOMEDIRECTORY] Value of homeDirectory So if I create a user with dsidm and it adds the "ns" object classes I still can't run some of the dsidm commands against that account dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get dstest dn: uid=dstest,ou=People,dc=mydomain,dc=com cn: Test Dsconf displayName: Test Account employeeNumber: 25429 gidNumber: 100 homeDirectory: /home/dstest loginShell: /bin/bash mail: mstarling(a)mydomain.com objectClass: top objectClass: nsPerson objectClass: nsAccount objectClass: nsOrgPerson objectClass: posixAccount uid: dstest uidNumber: 25941 dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock dstest Error: dstest is not a valid DN dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=dstest,ou=People,dc=mydomain,dc=com Error: search_ext() argument 1 must be str, not None dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status uid=dstest,ou=People,dc=mydomain,dc=com Error: search_ext() argument 1 must be str, not None dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status dstest Error: dstest is not a valid DN dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status Enter dn to check : uid=dstest,ou=People,dc=mydomain,dc=com Error: search_ext() argument 1 must be str, not None Thanks, Mark dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com Error: No object exists given the filter criteria uid=mstarlingt,ou=People,dc=mydomain,dc=com dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get Enter uid to retrieve : uid=mstarlingt Error: No object exists given the filter criteria uid=mstarlingt _______________________________________________ 389-users mailing list -- 389-users(a)lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org<mailto:389-users-leave@lists.fedoraproject.org> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje... Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure -- Directory Server Development Team -- Directory Server Development Team

2 years, 6 months

1
0
0 / 0

Re: dsidm utility inconsistencies

by Mark Reynolds

On 9/22/21 5:11 PM, Michael Starling wrote: > > > ------------------------------------------------------------------------ > *From:* Mark Reynolds <mreynolds(a)redhat.com> > *Sent:* Wednesday, September 22, 2021 3:38 PM > *To:* General discussion list for the 389 Directory server project. > <389-users(a)lists.fedoraproject.org>; Michael Starling > <mlstarling31(a)hotmail.com> > *Subject:* Re: [389-users] dsidm utility inconsistencies > > > On 9/22/21 2:58 PM, Michael Starling wrote: >> >> Unless I'm interpreting the man pages, and documentation wrong there >> seems to be some issues with the dsidm utility. Perhaps I'm doing >> something wrong? >> >> >> This works. >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com account get-by-dn >> uid=mstarlingt,ou=People,dc=mydomain,dc=com >> >> dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com >> >> cn: Mike Starling >> >> gecos: Mike Starling test account >> >> gidNumber: 100 >> >> givenName: Mike >> >> homeDirectory: /home/mstarlingt >> >> loginShell: /bin/ksh >> >> mail: mstarling(a)mydomain.com <mailto:mstarling@mydomain.com> >> >> objectClass: person >> >> objectClass: organizationalPerson >> >> objectClass: inetOrgPerson >> >> objectClass: posixAccount >> >> objectClass: top >> >> objectClass: shadowAccount >> >> shadowExpire: 99999 >> >> shadowLastChange: 18857 >> >> shadowMax: 33 >> >> shadowWarning: 1 >> >> sn: Starling >> >> uid: mstarlingt >> >> uidNumber: 25574 >> >> >> #Password reset works >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com account reset_password >> "uid=mstarlingt,ou=People,dc=mydomain,dc=com" >> >> Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com : >> >> CONFIRM - Enter new password for >> uid=mstarlingt,ou=People,dc=mydomain,dc=com : >> >> reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com >> >> >> >> #Unable to lock the account. >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com account lock uid=mstarlingt >> >> *Error: No such object * >> >> * >> * >> >> *I consult the help which says to specify the dn* >> >> * >> * >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com account lock -h >> >> usage: dsidm instance account lock [-h] [dn] >> >> positional arguments: >> >> dnThe dn to lock >> >> optional arguments: >> >> -h, --helpshow this help message and exit >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com account lock >> uid=mstarlingt,ou=People,dc=mydomain,dc=com >> >> Error: search_ext() argument 1 must be str, not None >> > I think this is a known bug (which was fixed). What version of > python-lib389 is installed? > > > Thanks Mark. > > > python3-lib389-1.4.3.17-1.module_el8+10764+2b5f8656.noarch is installed Yes this is a old version, and the fix (Issue 4912) was recently made. We will have to do new builds... >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com account lock >> "uid=mstarlingt,ou=People,dc=mydomain,dc=com" >> >> Error: search_ext() argument 1 must be str, not None >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b >> dc=mydomain,dc=com account lock "uid=mstarlingt" >> >> >> I tried changing the base to the People OU where the account lives >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> ou=People,dc=mydomain,dc=com account lock >> "uid=mstarlingt,ou=People,dc=mydomain,dc=com" >> >> Error: search_ext() argument 1 must be str, not None >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com user get >> >> Enter uid to retrieve : mstarlingt >> >> Error: No object exists given the filter criteria mstarlingt >> > What is in the access log? > > > > Here's what I see in the logs. > > > 22/Sep/2021:17:09:28.515626170 -0400] conn=3947 op=2 SRCH > base="ou=people,dc=mydomain,dc=com" scope=2 > filter="(&(&(objectClass=nsPerson)(objectClass=nsAccount)(objectClass=nsOrgPerson)(objectClass=posixAccount))(|(uid=mstarlingt)(displayName=mstarlingt)(cn=mstarlingt)))" > attrs="distinguishedName" So dsidm is pretty opinionated about how it looks for users (which might need to change). It only looks for entries that have all of these objectclasses: nsPerson, nsAccount, nsOrgPerson, posixAccount. What objectclasses are in your user entry? Mark > > Thanks, > > Mark > >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com user get >> >> Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com >> >> Error: No object exists given the filter criteria >> uid=mstarlingt,ou=People,dc=mydomain,dc=com >> >> >> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b >> dc=mydomain,dc=com user get >> >> Enter uid to retrieve : uid=mstarlingt >> >> Error: No object exists given the filter criteria uid=mstarlingt >> >> >> >> >> _______________________________________________ >> 389-users mailing list --389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org> >> To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org <mailto:389-users-leave@lists.fedoraproject.org> >> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/> >> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines> >> List Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fe... <https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...> >> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure> > -- > Directory Server Development Team -- Directory Server Development Team

2 years, 6 months

2
1
0 / 0

Re: dsidm utility inconsistencies

by Mark Reynolds

On 9/22/21 2:58 PM, Michael Starling wrote: > > Unless I'm interpreting the man pages, and documentation wrong there > seems to be some issues with the dsidm utility. Perhaps I'm doing > something wrong? > > > This works. > > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com account get-by-dn > uid=mstarlingt,ou=People,dc=mydomain,dc=com > > dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com > > cn: Mike Starling > > gecos: Mike Starling test account > > gidNumber: 100 > > givenName: Mike > > homeDirectory: /home/mstarlingt > > loginShell: /bin/ksh > > mail: mstarling(a)mydomain.com > > objectClass: person > > objectClass: organizationalPerson > > objectClass: inetOrgPerson > > objectClass: posixAccount > > objectClass: top > > objectClass: shadowAccount > > shadowExpire: 99999 > > shadowLastChange: 18857 > > shadowMax: 33 > > shadowWarning: 1 > > sn: Starling > > uid: mstarlingt > > uidNumber: 25574 > > > #Password reset works > > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com account reset_password > "uid=mstarlingt,ou=People,dc=mydomain,dc=com" > > Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com : > > CONFIRM - Enter new password for > uid=mstarlingt,ou=People,dc=mydomain,dc=com : > > reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com > > > > #Unable to lock the account. > > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com account lock uid=mstarlingt > > *Error: No such object* > > * > * > > *I consult the help which says to specify the dn* > > * > * > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com account lock -h > > usage: dsidm instance account lock [-h] [dn] > > positional arguments: > > dnThe dn to lock > > optional arguments: > > -h, --helpshow this help message and exit > > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com account lock > uid=mstarlingt,ou=People,dc=mydomain,dc=com > > Error: search_ext() argument 1 must be str, not None > I think this is a known bug (which was fixed). What version of python-lib389 is installed? > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com account lock > "uid=mstarlingt,ou=People,dc=mydomain,dc=com" > > Error: search_ext() argument 1 must be str, not None > > > dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b > dc=mydomain,dc=com account lock "uid=mstarlingt" > > > I tried changing the base to the People OU where the account lives > > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > ou=People,dc=mydomain,dc=com account lock > "uid=mstarlingt,ou=People,dc=mydomain,dc=com" > > Error: search_ext() argument 1 must be str, not None > > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com user get > > Enter uid to retrieve : mstarlingt > > Error: No object exists given the filter criteria mstarlingt > What is in the access log? Thanks, Mark > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com user get > > Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com > > Error: No object exists given the filter criteria > uid=mstarlingt,ou=People,dc=mydomain,dc=com > > > dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b > dc=mydomain,dc=com user get > > Enter uid to retrieve : uid=mstarlingt > > Error: No object exists given the filter criteria uid=mstarlingt > > > > > _______________________________________________ > 389-users mailing list -- 389-users(a)lists.fedoraproject.org > To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje... > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure -- Directory Server Development Team

2 years, 6 months

2
1
0 / 0

dsidm utility inconsistencies

by Michael Starling

Unless I'm interpreting the man pages, and documentation wrong there seems to be some issues with the dsidm utility. Perhaps I'm doing something wrong? This works. dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account get-by-dn uid=mstarlingt,ou=People,dc=mydomain,dc=com dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com cn: Mike Starling gecos: Mike Starling test account gidNumber: 100 givenName: Mike homeDirectory: /home/mstarlingt loginShell: /bin/ksh mail: mstarling(a)mydomain.com objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount shadowExpire: 99999 shadowLastChange: 18857 shadowMax: 33 shadowWarning: 1 sn: Starling uid: mstarlingt uidNumber: 25574 #Password reset works dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account reset_password "uid=mstarlingt,ou=People,dc=mydomain,dc=com" Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com : CONFIRM - Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com : reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com #Unable to lock the account. dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt Error: No such object I consult the help which says to specify the dn dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock -h usage: dsidm instance account lock [-h] [dn] positional arguments: dn The dn to lock optional arguments: -h, --help show this help message and exit dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com Error: search_ext() argument 1 must be str, not None dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com" Error: search_ext() argument 1 must be str, not None dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b dc=mydomain,dc=com account lock "uid=mstarlingt" I tried changing the base to the People OU where the account lives dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b ou=People,dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com" Error: search_ext() argument 1 must be str, not None dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get Enter uid to retrieve : mstarlingt Error: No object exists given the filter criteria mstarlingt dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com Error: No object exists given the filter criteria uid=mstarlingt,ou=People,dc=mydomain,dc=com dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get Enter uid to retrieve : uid=mstarlingt Error: No object exists given the filter criteria uid=mstarlingt

2 years, 6 months

1
0
0 / 0

attribute passwordMinLength cfg issues/error

by Ghiurea, Isabella

As part of user global policy we need to configure user password min length , see my cfg in dse.ldif , when trying to update a user password to a password with length > 0 seeing the following error:. Result: Constraint violation (19) Additional info: Failed to update password Is there a plugin I need to install or what I am missing from this cfg ? Here is my only changes I have in dse.ldif : nsslapd-pwpolicy-inherit-global: on nsslapd-pwpolicy-local: off passwordTrackUpdateTime: on passwordCheckSyntax: on passwordMinLength: 8 Isabella

2 years, 6 months

2
2
0 / 0

can't get admin console to connect

by Chase Miller

I have done many of 389 ldap server setups. Have a new install, and I can't get for the life of me able to get the admin console to connect to the server. Message i get is [Tue Sep 21 14:55:44.279828 2021] [:notice] [pid 1337:tid 140593598555904] [client xx.xx.xx.xxx:61796] admserv_check_authz(): passing [/admin-serv/authenticate] to the userauth handler Yes, I have read the documentation; i have modified the any suggestions? replace: nsAdminAccessAddresses nsAdminAccessAddresses: 192.168.1.* - replace: nsAdminAccessHosts nsAdminAccessHosts: *

2 years, 7 months

2
1
0 / 0

ns-newpolicy/pl documentation/use case

by Ghiurea, Isabella

Hi List I am searching for some documentation for ns-newpolicy.pl file , as per RH Doc I can use that script to add the attribute : pwdUpdateTime to each uid entry after I already cfg in DS Password TrackUpdateTime and pwdpolicy- inherit -global to 'on'; Thank you Isabella

2 years, 7 months

2
5
0 / 0

Announcing 389 Directory Server 1.4.4.17

by Mark Reynolds

389 Directory Server 1.4.4.17 The 389 Directory Server team is proud to announce 389-ds-base version 1.4.4.17 Fedora packages are available on Fedora 33. Fedora 33: https://koji.fedoraproject.org/koji/taskinfo?taskID=76027095 <https://koji.fedoraproject.org/koji/taskinfo?taskID=76027095> - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2021-1c2247a1ec <https://bodhi.fedoraproject.org/updates/FEDORA-2021-1c2247a1ec> - Bohdi The new packages and versions are: * 389-ds-base-1.4.4.17-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-1.4.4.17.tar.gz> Highlights in 1.4.4.17 * Bug fixes * Cockpit UI migrated to Patternfly 4 (fixed all security vulnerabilities) Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use **dnf install 389-ds-base** To install the Cockpit UI plugin use **dnf install cockpit-389-ds** After rpm install completes, run **dscreate interactive** For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject... <https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...> If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base <https://github.com/389ds/389-ds-base> * Bump version to 1.4.4.17 * Issue 4927 - rebase lib389 and cockpit in 1.4.4 * Issue 4908 - Updated several dsconf –help entries (typos, wrong descriptions, etc.) * Issue 4912 - Account Policy plugin does not set the config entry DN * Issue 4796 - Add support for nsslapd-state to CLI & UI * Issue 4894 - IPA failure in ipa user-del –preserve (#4907) * Issue 4169 - backport lib389 cert list fix * Issue 4912 - dsidm command crashing when account policy plugin is enabled * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks * Issue 4696 - Password hash upgrade on bind (#4840) * Issue 4875 - CLI - Add some verbosity to installer * Issue 4884 - server crashes when dnaInterval attribute is set to zero * Issue 4877 - RFE - EntryUUID to validate UUIDs on fixup (#4878) * Issue 4734 - import of entry with no parent warning (#4735) * Issue 4872 - BUG - entryuuid enabled by default causes replication issues (#4876) * Issue 4763 - Attribute Uniqueness Plugin uses wrong subtree on ModRDN (#4871) * Issue 4851 - Typos in “dsconf pwpolicy set –help” (#4867) * Issue 4736 - lib389 - fix regression in certutil error checking * Issue 4736 - CLI - Errors from certutil are not propagated * Issue 4460 - Fix isLocal and TLS paths discovery (#4850) * Issue 4443 - Internal unindexed searches in syncrepl/retro changelog * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819) * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389 * Issue 4262 - Fix Index out of bound in fractional test (#4828) * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823) * Issue 4656 - remove problematic language from ds-replcheck * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810) * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793) * Issue 4506 - Improve SASL logging * Issue 4093 - Fix MEP test case * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809) * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790) * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799) * Issue 4447 - Crash when the Referential Integrity log is manually edited * Issue 4773 - Add CI test for DNA interval assignment * Issue 4750 - Fix compiler warning in retrocl (#4751)

2 years, 7 months

1
0
0 / 0

Announcing 389 Directory Server 2.0.10

by Mark Reynolds

389 Directory Server 2.0.10 The 389 Directory Server team is proud to announce 389-ds-base version 2.0.10 Fedora packages are available on Fedora 34 and Rawhide Rawhide: https://koji.fedoraproject.org/koji/taskinfo?taskID=76007874 <https://koji.fedoraproject.org/koji/taskinfo?taskID=76007874> - Koji Fedora 35: https://koji.fedoraproject.org/koji/taskinfo?taskID=76009801 <https://koji.fedoraproject.org/koji/taskinfo?taskID=76009801> - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2021-702e5d17e2 <https://bodhi.fedoraproject.org/updates/FEDORA-2021-702e5d17e2> - Bodhi Fedora 34: https://koji.fedoraproject.org/koji/taskinfo?taskID=76011441 <https://koji.fedoraproject.org/koji/taskinfo?taskID=76011441> - Koji https://bodhi.fedoraproject.org/updates/FEDORA-2021-e763069c23 <https://bodhi.fedoraproject.org/updates/FEDORA-2021-e763069c23> - Bodhi The new packages and versions are: * 389-ds-base-2.0.10-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.0.10.tar.gz> Highlights in 2.0.10 * Bug fixes * Cockpit UI fully migrated to Patternfly 4 Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use **dnf install 389-ds-base** To install the Cockpit UI plugin use **dnf install cockpit-389-ds** After rpm install completes, run **dscreate interactive** For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject... <https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...> If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base <https://github.com/389ds/389-ds-base> * Bump version to 2.0.10 * Issue 4908 - Updated several dsconf –help entries (typos, wrong descriptions, etc.) * Issue 4912 - Account Policy plugin does not set the config entry DN * Issue 4863 - typos in logconv.pl * Issue 4796 - Add support for nsslapd-state to CLI & UI * Issue 4894 - IPA failure in ipa user-del –preserve (#4907) * Issue 4912 - dsidm command crashing when account policy plugin is enabled * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks * Issue 4887 - UI - fix minor regression from camelCase fixup

2 years, 7 months

1
0
0 / 0

Audit entries of Account Policy Plug-In behavior

by Claudionor Raymundo

Hi folks. There is any way to deactivate audit of lastlogintime in audit file, in the directory server with Account Policy Plug-In enabled? My directory server have 190,000+ users, and many of then logs 200 a 300 times a day (emails clients, development tools, etc) and this behavior pollutes the audit log. But i want to maintain Account Policy Plug-In enabled to control inactive users. Thanks for any help you can provide.

2 years, 7 months

2
1
1 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2021