389-users November 2005

389-users@lists.fedoraproject.org

49 participants
71 discussions

[Fedora-directory-users] How can I create a User ID alias?
by Darren Fulton 08 Nov '05

08 Nov '05

I have an in production application at our office (Web Calendar) that I am migrating to LDAP authentication using FDS from application internal authentication. Some of the users in the old program have user id's of $firstname and they don't work because everyone in the ldap server was setup as $firstinitial$lasthname. I have not been sucessful at changing the User ID's in the application from $firstname to $firstinitial$lastname. Question: Is there a way that I can make aliases in FDS such that User ID james equals User ID jjones? If so, how can I do it? Thank you. Darren

4 5

[Fedora-directory-users] make an attribute default to object class?
by speedy zinc 07 Nov '05

07 Nov '05

Ok, I have this weird idea that I want to make a new attribute an allowed attribute of an existing objectclass and all its sub-classes, but without modifying the definition of the existing class, only thru extension. For example, if I define a new attribute called "myWhackyAttr", and I want to make it part of an allowed attribute of nsRoleDefinition (or nsSimpleRoleDefinition), so that the attribute is available to all sub-classes. To do that, I can change the definition of nsRoleDefinition in 00core.ldif, which everyone would say "stop right there, you shouldn't do that". The other way is, I can create an aux objectclass with that attribute, and everytime I create a new role, I have to make sure that I add that object class to the new entry. That's tedious, and might forget it. Is there a third way to enforce that? thanks for any hint. sz __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

3 3

[Fedora-directory-users] real world example of nested roles?
by speedy zinc 07 Nov '05

07 Nov '05

Could anyone give a real world example of how a nested role is used, and how useful it is? thanks a lot. sz __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

1 0

[Fedora-directory-users] numerical prefix of schema file
by speedy zinc 07 Nov '05

07 Nov '05

Hi, I see each schema file is prefixed with a numerical value, such as: 00core.ldif 50ns-wcal.ldif 51ns-calendar.ldif 60pam-plugin.ldif 99user.ldif so what does the numerical prefix mean? I just know that if I change the schema from the console, it ends up in 99user.ldif. But what about the others? Is it for loading orders, or something else? If I add my own schema files, which value do I use for the prefix? thanks sz __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

[Fedora-directory-users] role of uxwdog?
by speedy zinc 06 Nov '05

06 Nov '05

What is the role of this watch dog? It would seem more useful if the watch dog can watch over the slapd process (and restart it if it dies), but it does not. So what is it doing? Seems like it's watching over the ns-httpd instead. rgds sz __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

6 9

[Fedora-directory-users] what's wrong with this ACI?
by speedy zinc 04 Nov '05

04 Nov '05

I've created two user entries under People: Test User: uid=testuser Jane Doe : uid=JDoe Here's what I'm trying to achieve with access control: - Turn off anon access to the entry Test User - Allow full access to Test User on Test User - Allow (read, search, compare) to JDoe on Test User, and no other users - Allow full access to "cn=Directory Manager" on Test User. - Anon access is still allowed on other entries So, here is the list of ACIs (besides the inherited ones) that I've created on the entry Test User: (targetattr = "*") (version 3.0;acl "self";allow (all)(userdn = "ldap:///uid=testuser,ou=People, dc=dummy,dc=com");) (targetattr != "userPassword") (version 3.0;acl "No anonymous access";deny (all)(userdn = "ldap:///anyone");) (targetattr = "*") (target = "ldap:///uid=testuser,ou=People, dc=dummy,dc=com") (version 3.0;acl "Allow JDoe";allow (read,compare,search)(userdn = "ldap:///uid=JDoe,ou=People, dc=dummy,dc=com");) With the ACIs above, it seems that the "No anonymous access" is taking precendence over the other two. Even the "Test User" does not have access to its own data, and JDoe certainly does not either. The only user who has access is the Directory Manager. How do I achieve my goals with ACI? thanks a lot. sz. __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

3 3

[Fedora-directory-users] Extending AD replication
by Daniel Shackelford 03 Nov '05

03 Nov '05

Hello All. I have successfully setup Directory Server on FC4 and am replicating/syncing with our Active Directory Domain. No problems there. What I would like to know is if there is a way to replicate more attributes of the users. We use the employeeID attribute in AD, and I would like to replicate that to DS. Anybody know if there is a way to configure what attributes are replicated? Obviously in a DS =>DS replication environment, all attributes will be replicated, but what about AD? -- Daniel Shackelford Systems Administrator Technology Services Spring Arbor University 517 750-6648

1 0

[Fedora-directory-users] AD sync
by Darjo Gregoric 03 Nov '05

03 Nov '05

Hi, I have a problem with AD sync. I have established synchronization without SSL and works fine, but when I use SSL, connection is not established and I receive error: Simple bind failed, LDAP sdk error 81 (Can't contact LDAP server), Netscape Portable Runtime error -8179 (Peer's Certificate issuer is not recognized.) AD machine name is suzy. I have exported CA and imported it on Directory server. Certutil -L -d . gives: CA certificate CTu,u,u suzy CT,, Server-Cert u,u,u Did i miss something? Is there any HOW TO for this type of configuration? Regards Darjo

2 2

[Fedora-directory-users] pass thru authentication
by Derek T. Yarnell 03 Nov '05

03 Nov '05

Does the Fedora DS or RHDS support pass thru authentication via SASL? For example, openldap can use --enable-spasswd at compile time to allow simple binds be accepted at the LDAP level and then authenticated with SASL (saslauthd in this example) to kerberos underneath and accept the bind. I need to have kerberos around for AFS but would like to be able to just use the LDAP directory as a way to authenticate clients that are not kerberized. -- --- Derek T. Yarnell University of Maryland Institute for Advanced Computer Studies derek(a)umiacs.umd.edu

2 1

RE: [Fedora-directory-users] Fedora Management Console 7.0
by Tay, Gary 01 Nov '05

01 Nov '05

Google LAM, LDAP Account Manager Gary -----Original Message----- From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Anthony Gabila Sent: Monday, October 31, 2005 10:56 AM To: fedora-directory-users(a)redhat.com Subject: [Fedora-directory-users] Fedora Management Console 7.0 Hi, Not quite sure how to solve this problem, I'm trying to add a user via Fedora Management Console, but I am not able to log in to my Win2k Pro machine using that username. I manage to get around this problem by entering the command "smbpasswd -a testuser" I was wondering if I could skip this extra step by doing all these in the Management Console app? agabila

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2005