389-users September 2022

389-users@lists.fedoraproject.org

10 participants
13 discussions

dsconf idempotency
by Marco Favero 07 Dec '25

07 Dec '25

Hello, I like to use [dsconf](https://directory.fedoraproject.org/docs/389ds/design/dsadm-dsconf.… to manage my 389ds instances. I like also Ansible to manage the configuration. From Ansible, if I run dsconf command I see some problems of idempotency. For example, if I run the first time in a new fresh installation ``` dsconf -D cn=Directory Manager -w **** ldap://localhost:389 plugin attr-uniq set attribute uniqueness --subtree=c=en --enabled=on --attr-name=uid --across-all-subtrees=off ``` it returns 0 and the output *Successfully changed the cn=attribute uniqueness,cn=plugins,cn=config*. If I re run the same command I will see: *There is nothing to set in the cn=attribute uniqueness,cn=plugins,cn=config plugin entry* and the exit status is 1. Of course I can manage the output in Ansible in order to reclassify as well the task result. But I have to do that in a lot of cases (best effort). Of course I can use some idempotent ldapmodify module, but I like to trust `dsconf`. So I wonder if you could consider the benefit to make `dsconf` more idempotent. For instance, in the above case the exit status could be 0. The same behavior could be adopted in all results of "already exists" output messages when the value to set is equal to the value already present (ie: `dsconf -D cn=Directory Manager -w *** ldap://localhost:389 backend index add ...` returns "already exists" and the exit status 1 if the idex is already defined) If you have any other hints to address this problem could let me know. Thank you very much Kind Regards Marco

4 4

ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0
by Graham Leggett 11 Dec '23

11 Dec '23

Hi all, We have a long standing 389ds master LDAP server that was found to be unable to contact it’s slaves. Most specifically, the slaves show nothing in their logs about any kind of connection, while the master is logging this: [12/Nov/2019:21:39:47.212715697 +0000] - ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0 (Unknown error, host “ldap01:636”) Key is "system error 0 (no error)”, which leaves us stumped. The error is obviously “success”. Has anyone seen this kind of thing before? This is 389ds running on CentOS7 as follows: 389-ds-base-1.3.9.1-10.el7.x86_64 Regards, Graham —

3 9

Crash with SEGV after compacting
by Niklas Schmatloch 12 Jul '23

12 Jul '23

Hi My organisation is using a replicated 389-dirsrv. Lately, it has been crashing each time after compacting. It is replicable on our instances by lowering the compactdb-interval to trigger the compacting: dsconf -D "cn=Directory Manager" ldap://127.0.0.1 -w 'PASSWORD_HERE' backend config set --compactdb-interval 300 This is the log: [03/Aug/2022:16:06:38.552781605 +0200] - NOTICE - checkpoint_threadmain - Compacting DB start: userRoot [03/Aug/2022:16:06:38.752592692 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact userRoot - 8 pages freed [03/Aug/2022:16:06:44.172233009 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact userRoot - 888 pages freed [03/Aug/2022:16:06:44.179315345 +0200] - NOTICE - checkpoint_threadmain - Compacting DB start: changelog [03/Aug/2022:16:13:18.020881527 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact changelog - 458 pages freed dirsrv(a)auth-alpha.service: Main process exited, code=killed, status=11/SEGV dirsrv(a)auth-alpha.service: Failed with result 'signal'. dirsrv(a)auth-alpha.service: Consumed 2d 6h 22min 1.122s CPU time. The first steps are done very quickly, but the step before the 458 pages of the retro-changelog are freed, takes several minutes. In this time the dirsrv writes more than 10 G and reads more than 7 G (according to iotop). After this line is printed the dirsrv crashes within seconds. What I also noticed is, that even though it said it freed a lot of pages the retro-changelog does not seem to change in size. The file `/var/lib/dirsrv/slapd-auth-alpha/db/changelog/id2entry.db` is 7.2 G before and after the compacting. Debian 11.4 389-ds-base/stable,now 1.4.4.11-2 amd64 Does someone have an idea how to debug / fix this? Thanks

4 15

Plugin development licensing
by DUVERT Vincent 09 May '23

09 May '23

Hello, I have a question regarding the licensing of developed 389-ds plugins. The FAQ (https://directory.fedoraproject.org/docs/389ds/FAQ/licensing.html#directory…) indicates that the Directory Server core code is licensed under a GPL + Exception license that allows non-GPL 389-ds plugins to link to 389-ds and to use specific header files. However, the LICENSE file in the current 389-ds-base source does not contain this exception. It was apparently removed by the following commit, when the license was changed to GPLv3+: https://pagure.io/389-ds-base/c/88cae401aee39a19ac6b07c3c36ee8daa07192e7 Does that means that the license exception does not apply to the current version of 389-ds? Regards, Vincent Duvert

2 2

389 DS sync issue with Active Directory
by Darshan B 19 Sep '22

19 Sep '22

Hello Team I have a question on sync between 389 DS and windows active Directoty. I have followed this link to https://documentation.suse.com/sles/15-SP3/html/SLES-all/cha-security-ldap.… for Synchronizing with Microsoft Active Directory(6.11) with 389 DS , I'm able to create the repl-winsync-agmt but while checking its status using sudo dsconf ldap1 repl-winsync-agmt init-status i'm getting below error . Error: [16/Sep/2022:16:25:45.129760205 +051800] - ERR - slapi_ldap_bind - Could not send bind request for id [CN=darshan,CN=Users,DC=training,DC=itadmin,DC=com] authentication mechanism [SIMPLE]: error -1 (Can't contact LDAP server), system error -5950 (File not found.), network error 107 (Transport endpoint is not connected, host "192.168.56.106:389") I'm able to do ldapsearch on Active directory but repl-winsync-agmt init-status command is giving the network error. ldapseach command: ldapsearch -x -h 192.168.56.106 -p 389 -b "CN=Users,dc=training,dc=itadmin,dc=com" -D "CN=darshan,CN=Users,DC=training,DC=itadmin,DC=com" -w "Test@123" dn repl-winsync-agmt create command used: sudo dsconf -D "cn=ldap1-infra1" -w "#CEEadmin123" ldap1 repl-winsync-agmt create --suffix "dc=openstack,dc=org" --host 192.168.56.106 --port 389 --conn-protocol LDAPS --bind-dn "CN=darshan,CN=Users,DC=training,DC=itadmin,DC=com" --bind-passwd "Test@123" --win-subtree "CN=Users,DC=training,DC=itadmin,DC=com" --ds-subtree "dc=openstack,dc=org" --one-way-sync fromWindows --sync-users=on --sync-groups=on --move-action delete --win-domain "trainingitadmin.com" adsync_agreement Let me know what should be done to resolve this network error

3 2

Procedure to change the AD used to sync users
by Mihai Carabas 17 Sep '22

17 Sep '22

Hello, We are planning to decommision our current PDC AD (Windows 2012R2). This AD is also used to sync users from our 389ds instance to this AD. What would be the correct procedure to update the WinSync agreement? Just update the hostname and run a full sync? Thank you, Mihai Carabas

3 12

Automated replication management
by tdarby＠arizona.edu 09 Sep '22

09 Sep '22

I've been working with the official docker container and have succeeded in scripting a complete install and configuration of our LDAP instance(s). Now, I'd like to go further and automate the addition and removal of a multi-master instance. Has anyone already succeeded in doing this? Currently, we have two EC2 instances in AWS that have a multi-master replication agreement. I'd like to be able to run a script that: 1. Brings up a new EC2/389ds container instance 2. Adds this to the existing multi-master replication agreements 3. When this is finished replicating, remove one of the current instances from the replication agreements I can do part 1, but I'm concerned about making parts 2 and 3 bullet-proof.

1 0

Re: How to have more than 1 directory manager account?
by Pierre Rogier 09 Sep '22

09 Sep '22

Hi Pierre, One solution is to add an user then add an aci in dn=example,dn=com to allow this user to add entries. Something like: aci: (targetattr = "*")(version 3.0; aci "user access for xxx script; allow( all) userdn="ldap:///uid=someone,ou=people,dc=exmaple,dc=people";) For more details, see the aci documentation: https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/h… . Regards, Pierre Rogier On Fri, Sep 9, 2022 at 3:52 PM Pierre Girard <pierre.girard(a)gerad.ca> wrote: > Hello, > > I looked around and so far I didn’t find information on > how to add an additional directory manager account. > > > > Or maybe there’s a way to create an account that can add > entries to dn=example,dn=com, since that would be more limited. > > The goal is to have an account that will be different for scripts that > we’ll be writing to add information in the server. > > > > Any guide on how to do that? > > > > Thanks. > > > > > > > _______________________________________________ > 389-users mailing list -- 389-users(a)lists.fedoraproject.org > To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject… > Do not reply to spam, report it: > https://pagure.io/fedora-infrastructure/new_issue > -- -- 389 Directory Server Development Team

1 0

How to have more than 1 directory manager account?
by Pierre Girard 09 Sep '22

09 Sep '22

Hello, I looked around and so far I didn't find information on how to add an additional directory manager account. Or maybe there's a way to create an account that can add entries to dn=example,dn=com, since that would be more limited. The goal is to have an account that will be different for scripts that we'll be writing to add information in the server. Any guide on how to do that? Thanks.

1 0

Limiting Direcory Manager access
by Alberto Crescente 05 Sep '22

05 Sep '22

Hello, the compromision of the direcory manager user gives full access over directory server. Is it possible to limit Directory Manager user acccess from localhost only? Best regards, Alberto Crescente.

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2022