389-users January 2023

389-users@lists.fedoraproject.org

2 participants
8 discussions

dsconf idempotency
by Marco Favero 07 Dec '25

07 Dec '25

Hello, I like to use [dsconf](https://directory.fedoraproject.org/docs/389ds/design/dsadm-dsconf.… to manage my 389ds instances. I like also Ansible to manage the configuration. From Ansible, if I run dsconf command I see some problems of idempotency. For example, if I run the first time in a new fresh installation ``` dsconf -D cn=Directory Manager -w **** ldap://localhost:389 plugin attr-uniq set attribute uniqueness --subtree=c=en --enabled=on --attr-name=uid --across-all-subtrees=off ``` it returns 0 and the output *Successfully changed the cn=attribute uniqueness,cn=plugins,cn=config*. If I re run the same command I will see: *There is nothing to set in the cn=attribute uniqueness,cn=plugins,cn=config plugin entry* and the exit status is 1. Of course I can manage the output in Ansible in order to reclassify as well the task result. But I have to do that in a lot of cases (best effort). Of course I can use some idempotent ldapmodify module, but I like to trust `dsconf`. So I wonder if you could consider the benefit to make `dsconf` more idempotent. For instance, in the above case the exit status could be 0. The same behavior could be adopted in all results of "already exists" output messages when the value to set is equal to the value already present (ie: `dsconf -D cn=Directory Manager -w *** ldap://localhost:389 backend index add ...` returns "already exists" and the exit status 1 if the idex is already defined) If you have any other hints to address this problem could let me know. Thank you very much Kind Regards Marco

4 4

ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0
by Graham Leggett 11 Dec '23

11 Dec '23

Hi all, We have a long standing 389ds master LDAP server that was found to be unable to contact it’s slaves. Most specifically, the slaves show nothing in their logs about any kind of connection, while the master is logging this: [12/Nov/2019:21:39:47.212715697 +0000] - ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0 (Unknown error, host “ldap01:636”) Key is "system error 0 (no error)”, which leaves us stumped. The error is obviously “success”. Has anyone seen this kind of thing before? This is 389ds running on CentOS7 as follows: 389-ds-base-1.3.9.1-10.el7.x86_64 Regards, Graham —

3 9

Crash with SEGV after compacting
by Niklas Schmatloch 12 Jul '23

12 Jul '23

Hi My organisation is using a replicated 389-dirsrv. Lately, it has been crashing each time after compacting. It is replicable on our instances by lowering the compactdb-interval to trigger the compacting: dsconf -D "cn=Directory Manager" ldap://127.0.0.1 -w 'PASSWORD_HERE' backend config set --compactdb-interval 300 This is the log: [03/Aug/2022:16:06:38.552781605 +0200] - NOTICE - checkpoint_threadmain - Compacting DB start: userRoot [03/Aug/2022:16:06:38.752592692 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact userRoot - 8 pages freed [03/Aug/2022:16:06:44.172233009 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact userRoot - 888 pages freed [03/Aug/2022:16:06:44.179315345 +0200] - NOTICE - checkpoint_threadmain - Compacting DB start: changelog [03/Aug/2022:16:13:18.020881527 +0200] - NOTICE - bdb_db_compact_one_db - compactdb: compact changelog - 458 pages freed dirsrv(a)auth-alpha.service: Main process exited, code=killed, status=11/SEGV dirsrv(a)auth-alpha.service: Failed with result 'signal'. dirsrv(a)auth-alpha.service: Consumed 2d 6h 22min 1.122s CPU time. The first steps are done very quickly, but the step before the 458 pages of the retro-changelog are freed, takes several minutes. In this time the dirsrv writes more than 10 G and reads more than 7 G (according to iotop). After this line is printed the dirsrv crashes within seconds. What I also noticed is, that even though it said it freed a lot of pages the retro-changelog does not seem to change in size. The file `/var/lib/dirsrv/slapd-auth-alpha/db/changelog/id2entry.db` is 7.2 G before and after the compacting. Debian 11.4 389-ds-base/stable,now 1.4.4.11-2 amd64 Does someone have an idea how to debug / fix this? Thanks

4 15

Plugin development licensing
by DUVERT Vincent 09 May '23

09 May '23

Hello, I have a question regarding the licensing of developed 389-ds plugins. The FAQ (https://directory.fedoraproject.org/docs/389ds/FAQ/licensing.html#directory…) indicates that the Directory Server core code is licensed under a GPL + Exception license that allows non-GPL 389-ds plugins to link to 389-ds and to use specific header files. However, the LICENSE file in the current 389-ds-base source does not contain this exception. It was apparently removed by the following commit, when the license was changed to GPLv3+: https://pagure.io/389-ds-base/c/88cae401aee39a19ac6b07c3c36ee8daa07192e7 Does that means that the license exception does not apply to the current version of 389-ds? Regards, Vincent Duvert

2 2

Announcing 389 Directory Server 2.1.7
by Mark Reynolds 23 Jan '23

23 Jan '23

389 Directory Server 2.1.7 The 389 Directory Server team is proud to announce 389-ds-base version 2.1.7 Fedora packages are available on Fedora 36 https://koji.fedoraproject.org/koji/taskinfo?taskID=96589528 <https://koji.fedoraproject.org/koji/taskinfo?taskID=96589528> https://bodhi.fedoraproject.org/updates/FEDORA-2023-89f10e5c31 <https://bodhi.fedoraproject.org/updates/FEDORA-2023-89f10e5c31> - Bodhi The new packages and versions are: * 389-ds-base-2.1.7-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.1.7.tar.gz> Highlights in 2.1.7 * Bug fixes & enhancements Installation and Upgrade See Download <https://directory.fedoraproject.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://directory.fedoraproject.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://directory.fedoraproject.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base * Bump version to 2.1.7 * Issue 5607, 5351, 5611 - UI/CLI - fix various issues * Issue 5608 - UI - need to replace some “const” with “let” * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584) * Issue 5602 - UI - browser crash when trying to modify read-only variable * Issue 5581 - UI - Support cockpit dark theme * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592) * Fix latest npm audit failures * Issue 5599 - CI - webui tests randomly fail * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries * Issue 5526 - RFE - Improve saslauthd migration options (#5528) * Issue 5588 - Fix CI tests * Issue 5585 - lib389 password policy DN handling is incorrect (#5587) * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth * Issue 5236 - UI add specialized group edit modal * Issue 5278 - CLI - dsidm asks for the old password on password reset * Issue 5531 - CI - use universal_lines in capture_output * Issue 5505 - Fix compiler warning (#5506) * Issue 3615 - CLI - prevent virtual attribute indexing * Issue 5413 - Allow mutliple MemberOf fixup tasks with different bases/filters * Issue 5561 - Nightly tests are failing * Issue 5521 - RFE - split pass through auth cli * Issue 5521 - BUG - Pam PTA multiple issues * Issue 5544 - Increase default task TTL * Issue 5541 - Fix typo in |lib389.cli_conf.backend._get_backend| (#5542) * Issue 5539 - Make logger’s parameter name unified (#5540) * Issue 5534 - Fix a rebase typo (#5537) * Issue 5534 - Add copyright text to the repository files -- Directory Server Development Team

1 0

Announcing 389 Directory Server 2.2.6
by Mark Reynolds 23 Jan '23

23 Jan '23

389 Directory Server 2.2.6 The 389 Directory Server team is proud to announce 389-ds-base version 2.2.6 Fedora packages are available on Fedora 37 https://koji.fedoraproject.org/koji/taskinfo?taskID=96571111 <https://koji.fedoraproject.org/koji/taskinfo?taskID=96571111> https://bodhi.fedoraproject.org/updates/FEDORA-2023-6b79d79829 <https://bodhi.fedoraproject.org/updates/FEDORA-2023-6b79d79829> - Bohdi The new packages and versions are: * 389-ds-base-2.2.6-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.2.6.tar.gz> Highlights in 2.2.6 * Enhancements, and Bug fixes Installation and Upgrade See Download <https://directory.fedoraproject.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://directory.fedoraproject.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://directory.fedoraproject.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base * Bump version to 2.2.6 * Issue 5607, 5351, 5611 - UI/CLI - fix various issues * Issue 5608 - UI - need to replace some “const” with “let” * Issue 3604 - UI - Create a private key/CSR with dsconf/Cockpit (#5584) * Issue 5602 - UI - browser crash when trying to modify read-only variable * Issue 5581 - UI - Support cockpit dark theme * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592) * Fix latest npm audit failures * Issue 5599 - CI - webui tests randomly fail * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries * Issue 5526 - RFE - Improve saslauthd migration options (#5528) * Issue 5588 - Fix CI tests * Issue 5585 - lib389 password policy DN handling is incorrect (#5587) * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth -- Directory Server Development Team

1 0

Announcing 389 Directory Server 2.3.2
by Mark Reynolds 23 Jan '23

23 Jan '23

389 Directory Server 2.3.2 The 389 Directory Server team is proud to announce 389-ds-base version 2.3.2 Fedora packages are available on Rawhide (f38) Rawhide: https://koji.fedoraproject.org/koji/taskinfo?taskID=96566979 <https://koji.fedoraproject.org/koji/taskinfo?taskID=96566979> The new packages and versions are: * 389-ds-base-2.3.2-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.3.2.tar.gz> Highlights in 2.3.2 * Enhancements, and Bug fixes Installation and Upgrade See Download <https://directory.fedoraproject.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://directory.fedoraproject.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://directory.fedoraproject.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base * Bump version to 2.3.2 * Issue 5547 - automember plugin improvements * Issue 5607, 5351, 5611 - UI/CLI - fix various issues * Issue 5610 - Build failure on Debian * Issue 5608 - UI - need to replace some “const” with “let” * Issue 5560 - dscreate run by non superuser set defaults requiring superuser privilege (#5579) * Issue 3604 - Create a private key/CSR with dsconf/Cockpit (#5584) * Issue 5605 - Adding a slapi_log_backtrace function in libslapd (#5606) * Issue 5602 - UI - browser crash when trying to modify read-only variable * Issue 5581 - UI - Support cockpit dark theme * Issue 5593 - CLI - dsidm account subtree-status fails with TypeError * Issue 5591 - BUG - Segfault in cl5configtrim with invalid confi (#5592) * Fix latest npm audit failures * Issue 5599 - CI - webui tests randomly fail * Issue 5348 - RFE - CLI - add functionality to do bulk updates to entries * Issue 5588 - Fix CI tests * Issue 5585 - lib389 password policy DN handling is incorrect (#5587) * Issue 5521 - UI - Update plugins for new split PAM and LDAP pass thru auth * Bump json5 from 2.2.1 to 2.2.3 in /src/cockpit/389-console * Issue 5236 - UI add specialized group edit modal * Issue 5550 - dsconf monitor crashes with Error math domain error (#5553) * Issue 5278 - CLI - dsidm asks for the old password on password reset * Issue 5531 - CI - use universal_lines in capture_output * Issue 5425 - CLI - add confirmation arg when deleting backend * Issue 5558 - non-root instance fails to start on creation (#5559) * Issue 5545 - A random crash in import over lmdb (#5546) * Issue 3615 - CLI - prevent virtual attribute indexing * Update specfile and rust crates * Issue 5413 - Allow multiple MemberOf fixup tasks with different bases/filters * Issue 5554 - Add more tests to security_basic_test suite (#5555) * Issue 5561 - Nightly tests are failing * Issue 5521 - RFE - split pass through auth cli * Issue 5521 - BUG - Pam PTA multiple issues * Issue 5544 - Increase default task TTL * Issue 5526 - RFE - Improve saslauthd migration options (#5528) * Issue 5539 - Make logger’s parameter name unified (#5540) * Issue 5541 - Fix typo in lib389.cli_conf.backend._get_backend (#5542) * Issue 3729 - (cont) RFE Extend log of operations statistics in access log (#5538) * Issue 5534 - Fix a rebase typo (#5537) * Issue 5534 - Add copyright text to the repository files -- Directory Server Development Team

1 0

Use dsconf to set nsslapd-lookthroughlimit
by Julian Kippels 11 Jan '23

11 Jan '23

Hi, I am looking for a way to set nsslapd-lookthroughlimit from cn=config,cn=ldbm database,cn=plugins,cn=config using dsconf. So far I have only found the way to stop the server and edit dse.ldif or maybe using ldapmodify. Is there a way to do this using dsconf? Thanks Julian

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users January 2023