389-users

389-users@lists.fedoraproject.org

2 participants
6655 discussions

replica RUV communicanting by 389 port
by Ciber Center 03 Jun '26

03 Jun '26

Hello team, I have my replication agreements working on port 636 via LDAPS with SSL/TLS encryption, but I can still see port 389 traffic between consumer and supplier nodes. I suspect that this might be due to RUV traffic between them, as I can see port 389 referenced in my supplier configuration. ObjectClass nsDS5ReplicationAgreement (structural) ObjectClass top (abstract) cn supplier1 cn=consumer1,cn=replica,cn=c\3Des,cn=mapping tree,cn=config nsds50ruv {replica 31 ldap://supplier1.domain.net:389} 588cd5a80000001f0000 69ec217b0359001f0000 nsruvReplicaLastModified {replica 31 ldap://supplier1.domain.net:389} 00000000 Is it possible that RUV communication is going over port 389? If so, is there any way to change this configuration so that RUV traffic uses the secure 636 port instead? Thank you very much in advance for your appreciated help.

2 2

Fwd: retrieving 75K objects each with 77 attributes vs. all attributes
by Bob Green 01 Jun '26

01 Jun '26

On Thu, May 28, 2026 at 1:16 PM Mark Reynolds <mareynol(a)redhat.com> wrote: > > Hi Bob, > > What is in the access log for these searches? I suspect you're doing an > unindexed search (check access log for notes=A or notes=U). There are no notes=A or notes=U access events, just notes=P (paged search) and a smattering of notes=N. > This is not really an ideal way to test the server's performance. One > thing to help with this type of search is to adjust the idscanlimit to > at least 100000 (it might already be set really high) > > # dsconf slapd-YOUR_INSTANCE backend config get | grep > nsslapd-idlistscanlimit > > If it's 4000 (or less than 100k) you can bump it up: > > # dsconf slapd-YOUR_INSTANCE backend config set > --idlistscanlimit=100000 (this does not require a server restart to > take effect) nsslapd-idlistscanlimit is 2147483646. > Otherwise, in this case the only other option is to make sure your entry > cache is large enough to hold all the entries. Note - running > concurrent searches like this is not going to be performant because it > has to process so many results. So I am not surprised the more > concurrent searches you run the slower they all get. Am I correct that nsslapd-cachesize: -1 under dn: cn=userroot,cn=ldbm database,cn=plugins,cn=config will "automatically size" the entry cache? I ask because dsconf INSTANCE backend monitor --suffix dc=example,dc=com reports: currententrycachesize: 2818570021 maxentrycachesize: 2818572288 which is just about at the maximum, though perhaps this will grow in size as needed? Or should I replace -1 with a larger value? I also increased nsslapd-ndn-cache-max-size, dcsonf INSTANCE config replace nsslapd-ndn-cache-max-size after seeing this with dsconf INSTANCE monitor backend: currentnormalizeddncachesize: 20971440 maxnormalizeddncachesize: 20971440 Thank you for the suggestions. Bob

3 4

parentid index mismatch after replica initialization causes one-level search to return no entries
by 박성호 28 May '26

28 May '26

Hello 389-ds users, We are investigating a reproducible issue during FreeIPA/IdM replica installation. After initial replication completes, the replica target contains the expected LDAP entries, but one-level searches under cn=masters return no entries. Subtree searches under the same base return the expected entries. On the replica target: ldapsearch -b "cn=masters,cn=ipa,cn=etc,dc=idm,dc=example,dc=com" -s one dn => returns no entries ldapsearch -b "cn=masters,cn=ipa,cn=etc,dc=idm,dc=example,dc=com" -s sub dn => returns the expected master and service entries At the same time, 389-ds logs the following error: Backend 'userRoot': MISMATCH - parentid index has integerOrderingMatch configured, but on-disk data uses lexicographic ordering. This will cause searches to return incorrect or incomplete results. Please reindex the parentid attribute: dsconf <instance> backend index reindex --attr parentid userRoot The issue was reproduced in both cases: 1. Source 389-ds-base 1.4.3.39-23 -> Replica 389-ds-base 1.4.3.39-23 2. Replica 389-ds-base 1.4.3.39-23 -> Replica 389-ds-base 2.8.0-6 The index configuration differs between the original source and the replicas. Source server: parentid index has no nsMatchingRule. Replica servers: parentid index has: nsMatchingRule: integerOrderingMatch Running a userRoot parentid reindex on the replica target restores the one-level search immediately. However, in the FreeIPA installer flow, this happens after ipa-replica-install has already failed. Question: Why does the replica target build or retain parentid on-disk index data using lexicographic ordering when the configured parentid index expects integerOrderingMatch? Is this expected after a total initialization from an older index definition, or should the replica initialization rebuild parentid using the target-side matching rule? Is there a supported way to force or validate parentid index consistency immediately after total initialization and before upper-layer applications rely on one-level searches? Please refer to the final inquiry sent to the FreeIPA users mailing list for additional technical details and follow-up discussion. Thanks, Seongho Park ________________________________ 보낸 사람: Rob Crittenden <rcritten(a)redhat.com> 보낸 날짜: 2026년 5월 28일 목요일 오전 3:55 받는 사람: FreeIPA users list <freeipa-users(a)lists.fedorahosted.org>; Florence Blanc-Renaud <flo(a)redhat.com> 참조: 이철구 <cgulee(a)lgcns.com>; 박성호 <seongho.park(a)lgcns.com> 제목: Re: [Freeipa-users] Re: FreeIPA replica install fails after initial replication: one-level search under cn=masters returns 0 until userRoot reindex [rcritten(a)redhat.com 전자 메일을 받지 않는 경우가 많습니다. https://aka.ms/LearnAboutSenderIdentification ]에서 중요한 이유 알아보기 박성호 via FreeIPA-users wrote: > Hello FreeIPA users, > > Is there anyone who can help with the following? > The same error log was confirmed in both of the below cases. > > *Error Logs From (/var/log/dirsrv/slapd-IDM-EXAMPLE-COM/errors)* > /var/log/dirsrv/slapd-IDM-EXAMPLE-COM/errors:[27/May/2026:11:10:31.315009288 > +0000] - ERR - ldbm_instance_check_index_config - Backend 'userRoot': > MISMATCH - parentid index has integerOrderingMatch configured, but > on-disk data uses lexicographic ordering. This will cause searches to > return incorrect or incomplete results. Please reindex the parentid > attribute: dsconf <instance> backend index reindex --attr parentid userRoot > > * > Source server #1 (389-ds-base-1.4.3.39-23) => Replica server #1 > (389-ds-base-1.4.3.39-23) > * > Replica server #1 (389-ds-base-1.4.3.39-23) => Replica server #2 > (389-ds-base-2.8.0-6) > > > *Our source server information* > [root@xxxx ~]# dsconf "$INST" backend index get userRoot --attr parentid > dn: cn=parentid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config > cn: parentid > nsIndexType: eq > nsSystemIndex: true > objectClass: top > objectClass: nsIndex > > *Our replica server #1 information* > [root@xxxx ~]# dsconf "$INST" backend index get userRoot --attr parentid > dn: cn=parentid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config > cn: parentid > nsIndexType: eq > nsMatchingRule: integerOrderingMatch > nsSystemIndex: true > objectClass: top > objectClass: nsIndex > > *Our replica server #2 information* > [root@xxxx ~]# dsconf "$INST" backend index get userRoot --attr parentid > dn: cn=parentid,cn=index,cn=userRoot,cn=ldbm database,cn=plugins,cn=config > cn: parentid > nsIndexType: eq > nsMatchingRule: integerOrderingMatch > nsSystemIndex: true > objectClass: top > objectClass: nsIndex > > We found a workaround, but we are curious about the underlying reason > why we need to perform a reindex. > > Thanks, > Seongho Park > > ------------------------------------------------------------------------ > *보낸 사람:* 박성호 <seongho.park(a)lgcns.com> > *보낸 날짜:* 2026년 5월 26일 화요일 오후 11:33 > *받는 사람:* Florence Blanc-Renaud <flo(a)redhat.com>; FreeIPA users list > <freeipa-users(a)lists.fedorahosted.org> > *참조:* 이철구 <cgulee(a)lgcns.com> > *제목:* Re: [Freeipa-users] FreeIPA replica install fails after initial > replication: one-level search under cn=masters returns 0 until userRoot > reindex > > Hello Flo! > Thank you for checking this quickly. > > Are you saying that I need to upgrade the source server's 389-ds version? > I'm not entirely sure yet, but it looks higher than the version you > mentioned. > > - on 8.10: https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.re…<https://access.redhat.com/errata/RHBA-2026:3126> with > 389-ds-base-1.4.3.39-22.module+el8.10.0+24000+b6bfdf3f > > Currently, there are restrictions on checking the contents of > https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.re…<https://access.redhat.com/solutions/7135993>, > so additional verification will be available tomorrow. Below are the > details of the version currently in use. > * > * > *Our source server information* > > * > Rocky Linux 8.8 (Green Obsidian) > * > ipa-server-4.9.13-21.module+el8.10.0+40089+03bf3c1f.x86_64 > * > ipa-client-4.9.13-21.module+el8.10.0+40089+03bf3c1f.x86_64 > * > ipa-server-dns-4.9.13-21.module+el8.10.0+40089+03bf3c1f.noarch > * > ipa-server-trust-ad-4.9.13-21.module+el8.10.0+40089+03bf3c1f.x86_64 > * > 389-ds-base-1.4.3.39-23.module+el8.10.0+40135+69dd2a79.x86_64 > * > 389-ds-base-libs-1.4.3.39-23.module+el8.10.0+40135+69dd2a79.x86_64 > > > *Our replica server #1 information* > > * > Red Hat Enterprise Linux 8.10 (Ootpa) > * > ipa-server-4.9.13-21.module+el8.10.0+23944+84561300.x86_64 > * > ipa-client-4.9.13-21.module+el8.10.0+23944+84561300.x86_64 > * > ipa-server-dns-4.9.13-21.module+el8.10.0+23944+84561300.noarch > * > ipa-server-trust-ad-4.9.13-21.module+el8.10.0+23944+84561300.x86_64 > * > 389-ds-base-1.4.3.39-23.module+el8.10.0+24085+b368a310.x86_64 > * > 389-ds-base-libs-1.4.3.39-23.module+el8.10.0+24085+b368a310.x86_64 > > > *Our replica server #2 information* > > * > Red Hat Enterprise Linux 9.8 (Plow) > * > ipa-server-4.13.1-3.el9_8.2.x86_64 > * > ipa-client-4.13.1-3.el9_8.2.x86_64 > * > ipa-server-dns-4.13.1-3.el9_8.2.noarch > * > package ipa-server-trust-ad is not installed > * > 389-ds-base-2.8.0-6.el9_8.x86_64 > * > 389-ds-base-libs-2.8.0-6.el9_8.x86_64 This is really more a question for the 389-ds team. They sometimes pop in here so someone might answer, but you may want to cross-post this to the 389-users list to be sure they see it. The parentid index is created by 389-ds directly and not by IPA. rob > ------------------------------------------------------------------------ > *보낸 사람:* Florence Blanc-Renaud <flo(a)redhat.com> > *보낸 날짜:* 2026년 5월 26일 화요일 오후 10:04 > *받는 사람:* FreeIPA users list <freeipa-users(a)lists.fedorahosted.org> > *참조:* 이철구 <cgulee(a)lgcns.com>; 박성호 <seongho.park(a)lgcns.com> > *제목:* Re: [Freeipa-users] FreeIPA replica install fails after initial > replication: one-level search under cn=masters returns 0 until userRoot > reindex > > > flo(a)redhat.xn--com-y27lq63fmig 전자 메일을 받지 못하는 경우가 많습니다. 이 문제가 > 중요한 이유 <https://aka.ms/LearnAboutSenderIdentification> > > > Hi, > > This is a known issue with 389-ds, you can get more information at > https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.re…<https://access.redhat.com/solutions/7135993> > > The fixes are available: > - on 8.10: > https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.re…<https://access.redhat.com/errata/RHBA-2026:3126> with 389-ds-base-1.4.3.39-22.module+el8.10.0+24000+b6bfdf3f > - on 9.7: https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.re…<https://access.redhat.com/errata/RHSA-2026:3189> with > 389-ds-base-2.7.0-10.el9_7 > - on 9.8: https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.re…<https://access.redhat.com/errata/RHBA-2026:18956> with > 389-ds-base-2.8.0-6.el9_8 > - on 10.1: > https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.re…<https://access.redhat.com/errata/RHSA-2026:3208> with 389-ds-base-3.1.3-7.el10_1. > - on 10.2: https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Faccess.re…<https://access.redhat.com/errata/RHBA-2026:18575> with > 389-ds-base-3.2.0-6.el10_2 > > HTH, > flo > > On Tue, May 26, 2026 at 12:11 PM 박성호 via FreeIPA-users > <freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org>> wrote: > > Hi FreeIPA users, > > I am investigating a reproducible FreeIPA/IdM replica installation > failure. > > Summary: > After initial replication succeeds during ipa-replica-install, local > LDAP subtree searches under cn=masters work, but one-level searches > under the same DN return zero entries. This causes ipa server-find > --servrole="IPA master", ipa server-role-find --include-master, and > dns_update_system_records during replica installation to fail with: > > no matching entry found > > A full userRoot reindex immediately fixes the issue. > > Environment: > - Existing master: RHEL 8.10, FreeIPA 4.9.x > - New replica test 1: RHEL 8.10, FreeIPA 4.9.x > - New replica test 2: RHEL 9.x, FreeIPA 4.13.x > - Domain: idm.example.com <https://apc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fidm.exampl…<http://idm.example.com/>> > - Realm: IDM.EXAMPLE.COM <https://apc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fidm.exampl…<http://idm.example.com/>> > > The same behavior is reproduced on both RHEL8 and RHEL9 replicas. > > Failure path from ipareplica-install.log: > > ipa-replica-install > -> dns_update_system_records() > -> server_find(servrole='IPA master') > -> server_role_find(role_servrole='IPA master', > status='enabled', include_master=True) > -> servroles._fill_in_absent_masters() > -> ldap2.get_entries() > -> EmptyResult: no matching entry found > > Before reindex, on the new replica: > > ldapsearch -H ldapi://%2Frun%2Fslapd-IDM-EXAMPLE-COM.socket -Y > GSSAPI -LLL \ > -b "cn=masters,cn=ipa,cn=etc,dc=idm,dc=example,dc=com" \ > -s one "(objectClass=*)" dn cn objectClass > > returns no entries. > > But subtree search works: > > ldapsearch -H ldapi://%2Frun%2Fslapd-IDM-EXAMPLE-COM.socket -Y > GSSAPI -LLL \ > -b "cn=masters,cn=ipa,cn=etc,dc=idm,dc=example,dc=com" \ > -s sub "(objectClass=ipaConfigObject)" dn cn objectClass > > returns the expected master and service entries. > > After running: > > dsconf IDM-EXAMPLE-COM backend index reindex --wait userRoot > > the one-level search works, and ipa server-find / ipa > dns-update-system-records work. > > Things already checked: > - This does not appear to be specific to a RHEL8 or RHEL9 replica > target. > - The replicated data appears to exist locally; the issue seems > specific to one-level search/index behavior under cn=masters. > - A full userRoot reindex immediately makes the same one-level > search and FreeIPA commands work. > > Question: > Is this a known 389-ds / FreeIPA replica initialization issue where > the local parent/one-level search index is incomplete immediately > after total init? Is there a supported way to force or verify index > consistency before ipa-replica-install reaches > dns_update_system_records? > > Please let me know if this should be reported to 389-ds instead of > FreeIPA. > > Thanks. > > > 고객의소리열기 > <https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcppm.sing…<https://cppm.singlex.com/public/painpointDirects/C998?mediaSource=EMAIL>> > > ------------------------------------------------------------------------ > 상기 메시지와 첨부화일 내에는 비밀정보가 포함되어 있을 수 있으며, 지 > 정된 수신자에 한하여 조회 및 사용될 수 있습니다. 만약 송신자의 실수 > 로 인하여 상기 메시지를 수신하였다면, 송신자에게 메시지를 반송해 주 > 시고, 원본 메시지와 모든 사본을 폐기해 주시기 바랍니다. > 상기 메시지의 전체 또는 일부에 대해 무단 열람, 사용, 공개, 배포하는 > 것은 금지되어 있습니다.(주)LG CNS. > This message and its attachments may contain confidential > information, and they are intended to be viewed or used by only the > individuals specified in the message. If you have received this > message in an error from the sender, please contact the sender > immediately to notify the error and delete all of the message and > its copies. It is prohibited to view, use, make public and/or > distribute part or whole of this message without written permission. > -- > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > <mailto:freeipa-users@lists.fedorahosted.org> > To unsubscribe send an email to > freeipa-users-leave(a)lists.fedorahosted.org > <mailto:freeipa-users-leave@lists.fedorahosted.org> > Fedora Code of Conduct: > https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fedo…<https://docs.fedoraproject.org/en-US/project/code-of-conduct/> > List Guidelines: https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorapro…<https://fedoraproject.org/wiki/Mailing_list_guidelines> > List Archives: > https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.fed…<https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost…> > Do not reply to spam, report it: > https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fforge.fed…<https://forge.fedoraproject.org/infra/tickets/issues/new> > > > > 고객의소리열기 > <https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcppm.sing…<https://cppm.singlex.com/public/painpointDirects/C998?mediaSource=EMAIL>> > > ------------------------------------------------------------------------ > 상기 메시지와 첨부화일 내에는 비밀정보가 포함되어 있을 수 있으며, 지정된 > 수신자에 한하여 조회 및 사용될 수 있습니다. 만약 송신자의 실수로 인하여 > 상기 메시지를 수신하였다면, 송신자에게 메시지를 반송해 주시고, 원본 메시 > 지와 모든 사본을 폐기해 주시기 바랍니다. > 상기 메시지의 전체 또는 일부에 대해 무단 열람, 사용, 공개, 배포하는 것은 > 금지되어 있습니다.(주)LG CNS. > This message and its attachments may contain confidential information, > and they are intended to be viewed or used by only the individuals > specified in the message. If you have received this message in an error > from the sender, please contact the sender immediately to notify the > error and delete all of the message and its copies. It is prohibited to > view, use, make public and/or distribute part or whole of this message > without written permission. > [고객의소리열기]<https://cppm.singlex.com/public/painpointDirects/C998?mediaSource=EMAIL> ________________________________ 상기 메시지와 첨부화일 내에는 비밀정보가 포함되어 있을 수 있으며, 지정된 수신자에 한하여 조회 및 사용될 수 있습니다. 만약 송신자의 실수로 인하여 상기 메시지를 수신하였다면, 송신자에게 메시지를 반송해 주시고, 원본 메시지와 모든 사본을 폐기해 주시기 바랍니다. 상기 메시지의 전체 또는 일부에 대해 무단 열람, 사용, 공개, 배포하는 것은 금지되어 있습니다.(주)LG CNS. This message and its attachments may contain confidential information, and they are intended to be viewed or used by only the individuals specified in the message. If you have received this message in an error from the sender, please contact the sender immediately to notify the error and delete all of the message and its copies. It is prohibited to view, use, make public and/or distribute part or whole of this message without written permission.

2 2

retrieving 75K objects each with 77 attributes vs. all attributes
by Bob Green 28 May '26

28 May '26

I've been fiddling with various 389ds tuning parameters to see if I can improve performance running 389-ds-2.7.0~git144.f597a91d8-150700.3.13.1.x86_64 on SLES15sp7 on a modestly specced KVM guest with 16GB of RAM and 2 "Intel Core Processor (Haswell, no TSX)". I believe performance is bottlenecked by my CPUs. I'm wondering if someone can confirm that an ldapsearch filter (objectclass=computer) that retrieves 75682 objects with 870191 attributes counting dn: in just under a minute is considered reasonable? If instead I request the 77 attributes I want to retrieve for each object, rather than "attrs=ALL", the same query filter will take ~85 seconds. I'm guessing the increased time is due to the overhead incurred by 389ds to selectively pick out those attributes, and that this is expected? I was wondering if there exists any computer sizing recommendations that might help me determine what hardware I should install 389ds on? As mentioned, I believe my 389ds instance is CPU bound, when I run the same query above in parallel, every additional query seems to add roughly 30 seconds to the amount of time the queries will take to finish. e.g. single query finishes in 60 seconds, 2 in parallel 90 seconds, 4 in parallel ~150 seconds, 10 concurrent queries will take ~330 seconds for all to complete. sar/mpstat on the 389ds instance shows that as I increase the number of concurrent queries cpu %usr utilization on the 389ds increases while %sys drops. expected I'm guessing... I'm trying to rule out whether I have inadequate indexing or whether some other tunable might improve concurrent queries of what is an admittedly large query, and hoping the community might be able to validate that yes, your query is large, if you insist on running this on 389ds you should plan on having 389ds run on significant hardware resources. Thank you for your time, Bob

2 1

Docker, dscontainer, and production version(s)
by Morgan Jones 18 May '26

18 May '26

Hello, I could use a little advice before I go down too many more rabbit holes: We are looking to run 389 in Docker and we prefer a stable version that will be supported for a while. We have a large user base and and value stability over new features. Is there a maintained docker image for, ideally, 389 versions 2.6 or 2.7? I'm open to 2.8 or 3.0 but worry they are a bit too bleeding edge for use in a large-ish environment. 2.4 worked well for us when we last tested but looks to now but deprecated. I'm happy to diy but from my testing and reading 2.6 and 2.7 dscontainer, at least in Alma Linux 9 as the base Docker image, seem to be buggy: the config directory is not correctly populated in the data directory. I am game for diy'ing a 2.8 or 3.0 Docker image if the consensus is that they are production ready but does dscontainer work in them and do you have a suggestion for what Docker operating system base image to use? I see 3.0, and maybe 2.8, can be enabled through copr in Alma 9 but don't want to get *too* exotic for production use. thank you! -morgan

1 0

Cannot change nsslapd-db-max-locks
by Orion Poplawski 13 May '26

13 May '26

On one of our EL9 IPA servers I'm unable to change nsslapd-db-max-locks ldapsearch returns: # database, monitor, ldbm database, plugins, config dn: cn=database,cn=monitor,cn=ldbm database,cn=plugins,cn=config nsslapd-db-current-locks: 96 nsslapd-db-max-locks: 179 dsconf config get returns: nsslapd-db-locks: 50018 I've restarted many times. Changed the value a couple of times. What's up? 389-ds-base-2.7.0-12.el9_7.x86_64 -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

3 5

version 3.1 : ERR - attrcrypt_ciphe
by Ghiurea, Isabella 11 May '26

11 May '26

After installing new Certs on version 389-ds-base-libs-3.1.3-7.el10_1.x86_64 , I am seeing the following ERR in errolog when restarting the ldap. [08/May/2026:12:47:19.286692556 -0700] - INFO - dbmdb_make_env - MDB environment created with max database instances=512. [08/May/2026:12:47:19.287568735 -0700] - ERR - attrcrypt_cipher_init - Failed to retrieve key for cipher AES (2) [08/May/2026:12:47:19.287866902 -0700] - ERR - attrcrypt_cipher_init - Failed to retrieve key for cipher 3DES (2) [08/May/2026:12:47:19.288083818 -0700] - ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. And here are my entries for encryption in dse.ldif : dn: cn=encrypted attribute keys,cn=userroot,cn=ldbm database,cn=plugins,cn=con fig objectClass: top objectClass: extensibleObject cn: encrypted attribute keys creatorsName: cn=ldbm database,cn=plugins,cn=config modifiersName: cn=ldbm database,cn=plugins,cn=config createTimestamp: 20260128,........ modifyTimestamp: 20260128........ numSubordinates: 2 dn: cn=encrypted attributes,cn=userroot,cn=ldbm database,cn=plugins,cn=config objectClass: top objectClass: extensibleObject cn: encrypted attributes creatorsName: cn=ldbm database,cn=plugins,cn=config modifiersName: cn=ldbm database,cn=plugins,cn=config createTimestamp: 202601282.... modifyTimestamp: 20260128.... What else must be change to eliminate the errors. thank you !

3 4

Backend Database(s)
by Sean Weldon 08 May '26

08 May '26

Hello All, I'm in the process of building a 389 instance on RHEL that has multiple backend suffixes (15+). When building a new 3.0.x instance, 389 no longer creates a separate backend database (on file system), and puts them all in one database (1 data.mdb file). Is there a way to keep this separate per backend suffix (C=US, C=CA)? Documentation makes it seem like --be-name would have this effect, but it doesn't (still 1 data.mdb file), at least not that I can get to work. Best

2 1

Currently maintained versions of 389ds ??
by Dave Botsch 30 Apr '26

30 Apr '26

What are the currently maintained versions of 389ds? Presumably the 3.x series and *something* in the 2.x series ? thanks -- ******************************** David William Botsch Programmer/Analyst @CornellCNF botsch(a)cnf.cornell.edu ********************************

2 3

Announcing 389 Directory Server 3.2.1 (F45/Rawhide)
by Mark Reynolds 30 Apr '26

30 Apr '26

389 Directory Server 3.2.1 The 389 Directory Server team is proud to announce 389-ds-base version 3.2.1. Fedora packages are available on Fedora 45 (rawhide): https://koji.fedoraproject.org/koji/taskinfo?taskID=144971802 <https://koji.fedoraproject.org/koji/taskinfo?taskID=144971802> - Koji The new packages and versions are: * 389-ds-base-3.2.1 Source tarballs are available for download at GitHub Releases page <https://github.com/389ds/389-ds-base/releases/tag/389-ds-base-3.2.1> * https://github.com/389ds/389-ds-base/releases/download/389-ds-base-3.2.1/38… <https://github.com/389ds/389-ds-base/releases/download/389-ds-base-3.2.1/38…> Highlights in 3.2.1 * Enhancements o Issue 7307 <https://github.com/389ds/389-ds-base/issues/7307> - RFE - Expose work queue and worker utilization metrics o Issue 7300 <https://github.com/389ds/389-ds-base/issues/7300> - RFE - Add OS-level thread names to all server threads o Issue 7281 <https://github.com/389ds/389-ds-base/issues/7281> - RFE - CLI - add support to managing additional encryption module o Issue 6951 <https://github.com/389ds/389-ds-base/issues/6951> - RFE - Dynamic Certificates Refresh * Security fixes o Update dependency uuid to v14 o Update Rust crate openssl to v0.10.78 o Security fix for CVE-2025-14905 o Bump lodash from 4.17.21 to 4.17.23 in /src/cockpit/389-console (#7203) * Bug fixes Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your DNF repositories. To install the server use |dnf install 389-ds-base| To install the Cockpit UI plugin use |dnf install cockpit-389-ds| After rpm install completes, run |dscreate interactive| For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms. See Install Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup. See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments here: * 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… * 389ds discussion channel: https://github.com/389ds/389-ds-base/discussions If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base Changelog between 389-ds-base-3.2.0 and 389-ds-base-3.2.1: * Bump version to 3.2.1 * Issue 6942 - Crash in |slapi_sdn_get_ndn()| (#7318) * Issue 6753 - Porting ticket 48312 test * Issue 6753 - Port ticket 48270 test * Issue 7431 - password policy - passwordBadWords is ignored in local policies * Update dependency uuid to v14 [SECURITY] (#7456) * Issue 7440 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured (#7441) * Update Rust crate openssl to v0.10.78 [SECURITY] (#7455) * Update cockpit-389-ds-npm (major) (#7448) * Update rust-dependencies to v1 (major) (#7449) * Issue 7426 - logconv.py is out of sync with server-emitted note codes (#7427) * Migrate config .github/renovate.json (#7450) * Issue 7437 - LeakSanitizer: memory leaks in CoS cache error paths (#7438) * Issue 7365 - Add integration with Renovate (#7439) * Issue 7412 - Report thread pool saturation on per-operation access log RESULT lines (#7413) * Issue 7417 - UI - global password policy syntax settings missing passwordMaxRepeats * Issue 7420 - Inconsistencies in the password policy log messages (#7421) * Issue 7389 - Fix CONFIG_CHARRAY crash (#7415) * Issue 7375 - CI - Fix flaky dsconf_tasks_test watch output (#7410) * Issue 3555 - UI - Fix audit issue with npm - brace-expansion (#7411) * Issue 7088 - Change log level for “Can’t locate CSN” error message * Issue 7423 - cleanup pblock after freeing pre/post entries * Issue 7418 - Use-after-free in deferred memberof (#7419) * Issue 7407 - dbscan -k option display entries that do not match the specified key * Issue 7404 - fix latest compiler warnings * Issue 4148 - Add unit tests for CSN clock error handling (#7330) * Issue 7227 - CI - Fix flaky dynamic certificates test crash (#7382) * Issue 7119 - CI - Fix flaky test_dna_shared_config_replication (#7385) * Issue 7394 - UI - Manual typing of ports can leave out digits (#7395) * Issue 7396 - Testimony failure in monitor_test.py (#7397) * Issue 6753 - Port ticket 48170 test (#7387) * Issue 6753 - Port ticket 48265 test (#7388) * Issue 7277 - UI - Fix Japanese translation errors errors in Cockpit UI (#7386) * Issue 7389 - Allow to ignore criticality flags for specific controls (#7390) * Issue 7353 - CI - Fix checks for plugins/accpol_test.py::test_glinact_nsact * Issue 7360 - Expose stats from deferred memberof (#7361) * Issue 7327 - dsctl healthcheck DSMOLE0001 inaccurate recommendations with multiple backends (#7328) * Issue 7370 - Runtime LSan/TSan injection for pytest (#7371) * Issue 7378 - Make sure suffix entry always gets assigned ID 1 * Issue 7380 - Internal op with negative wtime and large optime (#7381) * Issue 7375 - CI - Fix clu/dsconf_tasks_test (#7376) * Issue 7362 - UI - Some FormSelect onChange parameters are reversed * Issue 7368 - UI - global password policy page is missing passwordmintokenlength * Issue 7366 - Memory leaks in syncrepl plugin during persistent search operations (#7367) * Issue 7053 - Add tests for duplicate member operations (#7345) * Issue 6724 - Log fine grained details of operation timing (#7350) * Issue 3658 - UI/CLI - show progress of db tasks * Issue 7284 - CI - Fix test_grace_limit_section after pwpolicy validation fix (#7357) * Issue 7271 - Add test for retrocl trimming shutdown crash (#7356) * Issue 3555 - UI - Fix audit issue with npm - flatted, picomatch (#7364) * Issue 7358 - NSACLPlugin - acl_access_allowed - Missing aclpb 1 (#7359) * Issue 7126 - WARN - keys2idl - received NULL idl from index_read_ext_allids (#7127) * Issue 7337 - UI - refactor all error handling to use getApiErrorMessge * Issue 1704 - DNA plugin creates invalid shared config entry with port 0 (#7352) * Issue 7348 - CI - Fix failing dsconf security CLI add cert test (#7349) * Issue 7322 - Reject adding a replication agreement that points to itself * Issue 7333 - Fail open condition in ACL (#7334) * Issue 7312 - UI - Database Maximum Size cannot be easily set by typing (#7313) * Issue 7342 - CI - repl config regression (#7343) * Issue 7346 - DS does not handle escape char in bind user (#7347) * Issue 6753 - Remove ticket 48013 test (#7344) * Issue 6753 - Port ticket 48005 test (#7340) * Issue 7339 - Return the exact DN during export * Issue 6753 - Port ticket 47976 test * Issue 7331 - UI - Improve suffix import LDIF table * Issue 7325 - UI - new error parser missing import * Issue 7325 - UI - create an error parser for cockpit spawn errors * Issue 7319 - Action menu for certificates remains in empty certificate list (#7320) * Issue 6753 - Port ticket 47980 and 47981 tests (#7323) * Issue 7265 - CI - fix retro changelog maxage validation test * Issue 7093 - A password policy can be created even when an identical policy already exists (#7283) * Issue 7316 - UI - update npm module immutable * Issue 7314 - UI - Add progress steppers to Security, Database, and Replication tabs * Issue 7281 - UI - Add encryption module management * Issue 7302 - dblib bdb2mdb fails on F43 -> F43 upgrade (#7303) * Issue 7296 - Introduce time limits for GH Actions (#7297) * Issue 7307 - RFE - Expose work queue and worker utilization metrics (#7308) * Issue 7300 - RFE - Add OS-level thread names to all server threads (#7301) * Issue 7271 - Add new plugin pre-close function check to plugin_invoke_plugin_pb * Issue 7304 - retrocl should not cache DN * Issue 7265 - Add dse modify callback to validate retrocl trimming settings * Issue 3555 - UI - Fix audit issue with npm - ajv, minimatch (#7298) * Issue 7291 - Crash when configuring a replica with an incorrect nsds5ReplicaRoot (#7292) * Issue 7271 - implement a pre-close plugin function * Issue 7061 - Test for improved error message * Issue 7281 - RFE - CLI - add support to managing additional encryption modules * Issue 7265 - changelog maxage validation is not strict enough * Issue 6220 - Add Packit configuration (#6221) * Issue 7284 - Creating local password policy succeeds with incorrect passwordInHistory value (#7285) * Issue 7277 - UI - Fix Japanese translation for “Successfully updated group” in Cockpit UI (#7278) * Issue 7267 - MDB_BAD_VALSIZE error when updating index (#7268) * Security fix for CVE-2025-14905 * Issue 7246 - correct formatting of ‘Gen as CSN’ in dsctl get-nsstate output (#7247) * Issue 7275 - UI - Improve password policy field validation in Cockpit UI (#7276) * Issue 7279 - UI - Fix typo in export certificate dialog (#7280) * Issue 7273 - In a chaining environment binding as remote user causes an invalid error in the logs * Issue 7271 - plugins that create threads need to update active thread count * Issue 5853 - Update concread to 0.5.10 * Issue 6753 - Port ticket 49039 test * Issue 7236 - Fix GSSAPI tests (#7237) * Issue 7223 - Remove integerOrderingMatch requirement for parentid (#7264) * Issue 6758 - Fix Enable Replication dropdown not opening (#7262) * Issue 7243 - UI - add support for hot certificates * Issue 7066/7052 - allow password history to be set to zero and remove history * Issue 3134 - Fix build break (#7260) * Issue 7223 - Use lexicographical order for ancestorid (#7256) * Issue 7213 - (2nd) MDB_BAD_VALSIZE error while handling VLV (#7258) * Issue 7184 - (2nd) argparse.HelpFormatter _format_actions_usage() is deprecated (#7257) * Issue 6951 - Dynamic Certificas Refresh - CI tests (#7238) * Issue 7252 - PQC - Need to iterate on SECOidTag instead of using OID (#7254) * Issue 7250 - CLI - dsctl db2index needs some hardening with MBD * Issue 7248 - CLI - attribute uniqueness - fix usage for exclude subtree option * Issue 7231 - Sync repl tests fail in FIPS mode due to non FIPS compliant crypto (#7232) * Issue 7241 - Drop dateutil (#7242) * Issue 7233 - test_produce_division_by_zero fails with IsADirectoryError in conftest.py (#7234) * Issue 7221 - CI tests - fix some flaky tests * Issue 3555 - UI - Fix audit issue with npm - @isaacs/brace-expansion (#7228) * Issue 7230 - Regression in healtcheck NssCheck (#7235) * Issue 7223 - Add dsctl index-check command for offline index repair * Issue 7223 - Detect and log index ordering mismatch during backend startup * Issue 7223 - Add upgrade function to remove ancestorid index config entry * Issue 7223 - Add upgrade function to remove nsIndexIDListScanLimit from parentid * Issue 7223 - Revert index scan limits for system indexes * Issue 7121 - (2nd) LeakSanitizer: various leaks during replication (#7212) * Issue 7178 - Bundled jemalloc fails to build with GCC 15 (#7216) * Issue 7224 - CI Test - Simplify test_reserve_descriptor_validation (#7225) * Issue 6951 - Dynamic Certificate refresh phase 4 - Update lib389 and dsconf (#7171) * Issue 7076 - Fix revert_cache() never called in modrdn (#7220) * Issue 6810 - Fix PAM PTA test (#7219) * Issue 6753 - Port ticket 48896 test * Issue 7194 - Repl Log Analysis - Add CSN propagation details (#7195) * Issue 6753 - Port ticket 47781 test (#7210) * Issue 7213 - MDB_BAD_VALSIZE error while handling VLV (#7214) * Issue 7027 - (2nd) 389-ds-base OpenScanHub Leaks Detected (#7211) * Issue 7206 - Should log whether TLS key is PQC or not (#7207) * Issue 7096 - (2nd) During replication online total init the function idl_id_is_in_idlist is not scaling with large database (#7205) * Issue 7201 - Syscall overhead in LMDB import writer thread (#7204) * Issue 6947 - Revise time skew check in healthcheck tool - add tests (#7208) * Issue 7184 - argparse.HelpFormatter _format_actions_usage() is deprecated * Issue 7014 - memberOf - ignored deferred updates with LMDB * Issue 7198 - Web console doesn’t show sub-suffix when parent-suffix points to an entry (#7202) * Bump lodash from 4.17.21 to 4.17.23 in /src/cockpit/389-console (#7203) * Issue 7170 - Support of PQC keys (#7188) * Issue 7189 - DSBLE0007 generates incorrect remediation commands for scan limits * Issue 7196 - DynamicCertificates returns empty DER (#7197) * Issue 6758 - Use OUIA selectors for WebUI plugin tests (#7182) * Issue 7169 - Fix automember_plugin CI test failures (#7181) * Issue 7152 - ns-slapd fails to shutdown when deferred memberof update is in progress (#7187) * Issue 6753 - Port ticket 548 test (#7101) * Issue 7172 - (2nd) Index ordering mismatch after upgrade (#7180) * Issue 7172 - Index ordering mismatch after upgrade (#7173) * Issue 7108 - Fix shutdown crash in entry cache destruction (#7163) * Issue 7118 - Revise paged result search locking * Issue 7096 - During replication online total init the function idl_id_is_in_idlist is not scaling with large database (#7145) -- Identity Management Development Team

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users