wrote:

Hello, I am trying to get system groups working on 389-ds via the addition of "posixGroup" as a value for a given LDAP group. Numerous posts in the archives, as well as on other forums, seem to indicate that it should be a relatively straightforward affair. Here's what i've tried via the console : 1. Creation of OU "systemgroups" 2. Creation of group "admin" 3. In advanced properties of group "admin", Object Class -> Add value -> posixGroup 4. OK However, this error appears in the log : [02/Jul/2010:09:43:03 +0000] - Entry "cn=admin,ou=systemgroups,dc=domain,dc=net" -- attribute "uidNumber" not allowed I am sure i have just missed something small, like the activation of a plugin, or the integration of a particular schema. I can create users with associated posix data (uid, gid, homedir, etc...), so at least that works. :) Any help, or a push in the correct direction, would be greatly appreciated. Thank you, all. -- Daniel Maher <dma + 389users AT witbe DOT net> -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

On 07/02/2010 11:58 AM, Daniel Maher wrote: > I am trying to get system groups working on 389-ds via the addition of > "posixGroup" as a value for a given LDAP group. > > However, this error appears in the log : > > [02/Jul/2010:09:43:03 +0000] - Entry > "cn=admin,ou=systemgroups,dc=domain,dc=net" -- attribute "uidNumber" not > allowed > Hello, After wiping out my test instance and starting from scratch, it has become clear that the problem is related to the DNA plugin. If i do NOT activate / configure the DNA plugin, then i can manipulate posixGroup-related entries as expected. As soon as the plugin is activated and configured, the error noted above occurs. I followed (and *cough* wrote) this document exactly : http://directory.fedoraproject.org/wiki/Howto:DNA [root@test-dma-36 dirsrv]# /usr/lib64/mozldap/ldapsearch -h localhost -p 389 -s base -b "" "objectclass=*" | grep vendorVersion vendorVersion: 389-Directory/1.2.5 B2010.012.2034 [root@test-dma-36 dirsrv]# cat /etc/redhat-release CentOS release 5.4 (Final) [root@test-dma-36 dirsrv]# uname -s -r -v -i -o Linux 2.6.18-164.15.1.el5 #1 SMP Wed Mar 17 11:30:06 EDT 2010 x86_64 GNU/Linux It would seem that this is either a fault in the configuration of the plugin, or a bug with the plugin itself. Has anybody else experienced similar behaviour?

On 07/02/2010 11:58 AM, Daniel Maher wrote: > I am trying to get system groups working on 389-ds via the addition of > "posixGroup" as a value for a given LDAP group. > > However, this error appears in the log : > > [02/Jul/2010:09:43:03 +0000] - Entry > "cn=admin,ou=systemgroups,dc=domain,dc=net" -- attribute "uidNumber" not > allowed > Hello, After wiping out my test instance and starting from scratch, it has become clear that the problem is related to the DNA plugin. If i do NOT activate / configure the DNA plugin, then i can manipulate posixGroup-related entries as expected. As soon as the plugin is activated and configured, the error noted above occurs. I followed (and *cough* wrote) this document exactly : http://directory.fedoraproject.org/wiki/Howto:DNA [root@test-dma-36 dirsrv]# /usr/lib64/mozldap/ldapsearch -h localhost -p 389 -s base -b "" "objectclass=*" | grep vendorVersion vendorVersion: 389-Directory/1.2.5 B2010.012.2034 [root@test-dma-36 dirsrv]# cat /etc/redhat-release CentOS release 5.4 (Final) [root@test-dma-36 dirsrv]# uname -s -r -v -i -o Linux 2.6.18-164.15.1.el5 #1 SMP Wed Mar 17 11:30:06 EDT 2010 x86_64 GNU/Linux It would seem that this is either a fault in the configuration of the plugin, or a bug with the plugin itself. Has anybody else experienced similar behaviour ?

On 07/06/2010 05:31 PM, Nathan Kinder wrote: >> http://directory.fedoraproject.org/wiki/Howto:DNA >> > The way you have DNA configured will cause it to try to add a > "uidNumber" attribute to a posixGroup entry. You should change the > "dnaFilter" attribute for your "cn=UID numbers" DNA config entry to be > "(objectClass=posixAccount)". > To clarify then, for the uids, instead of this : dnafilter: (|(objectclass=posixAccount)(objectclass=posixGroup)) It should be this : dnafilter: (objectclass=posixAccount) ?

On 07/06/2010 07:04 PM, Nathan Kinder wrote: >> To clarify then, for the uids, instead of this : >> >> dnafilter: (|(objectclass=posixAccount)(objectclass=posixGroup)) >> >> It should be this : >> >> dnafilter: (objectclass=posixAccount) >> >> ? >> >> > Yes, that is correct. The current setting you have causes DNA to add a > "uidNumber" attribute to newly created "posixAccount" and "posixGroup" > entries. You only want DNA to add the "uidNumber" attribute to > "posixAccount" entries. > That makes sense. Somebody may wish to update the Howto on the documentation site. :)

Thanks !