389-users November 2008

389-users@lists.fedoraproject.org

43 participants
59 discussions

[Fedora-directory-users] DSGW user authorization problem
by Lev Dudko 16 Nov '08

16 Nov '08

Dear Directory server experts, could you help me, please, to solve the problem with DSGW authorization. I have successfully setup FDS on Fedora 9 with setup-ds-admin.pl setup ssl with the help of script from this page: http://www.linuxmail.info/fedora-directory-server-setup-howto-centos-5/ run setup-ds-dsgw Now, the directory server works, administration server works and I can configure everything in DS and Admin server with console fedora-idm-console -a https://localhost:9830 I can point my browser to https://localhost:9830 and use DSGW to search successfully, but I can not do authorization, when I try to authorize as some user (normal user, Directory Manager or admin) I got the error: Authentication Failed Authentication failed because the password you supplied is incorrect. Please click the Retry button and try again. If you have forgotten the password for this entry, a directory administrator must reset the password for you. Of course, I am sure that the password is correct. There are no so much useful information in the log files. The executable /usr/lib64/dirsrv/dsgw-cgi-bin/doauth do this authorization. I have read available documentation rather careful, but did not find the answer. Looks like one of the solution is to use binddnfile directive with special text file, but it looks strange for me that it is impossible to use normal authorization in LDAP with DSGW. Do I missed something during the configuration or forgot to add some special ACL? Lev

1 0

[Fedora-directory-users] Restored dirsrv on another system but now it does not return any entries for queries
by Richard Sharpe 16 Nov '08

16 Nov '08

Hi, I was trying to move our dirsrv to another machine, so I installed Fedora-DS on the new server, backed up the original machine, restored it on the new server, which seemed to go OK. If I do "ldapsearch -x '*'" on the new server, I seem to get the correct results, however, if I do 'getent passwd' I do not get any entries from dirsrv. I grabbed packet captures from doing 'getent passwd' where LDAP points at the original dirsrv server and the new one (boy, I knew that all that work I did on Ethereal would come in handy one day) and the difference is that against the original dirsrv server I get back all the posixAccount (or something) entries, but against the new dirsrv server, I get back zero entries. However, the queries are the same. The log file on the new dirsrv server also says zero entries returned. What have I forgotten? I haven't yet switched on lots of debugging to find out what is wrong on the new server, but I guess that is the next step if no one can think of something obvious I have done wrong. -- Regards, Richard Sharpe

1 1

[Fedora-directory-users] Unable to access server group
by Matt Adams 15 Nov '08

15 Nov '08

Folks: We recently changed the name of our LDAP server. We had a domain name change so ldaphost.subdomain.example.org effectively became ldaphost.new.subdomain.example.org). I changed every instance of subdomain.example.org throughout the Fedora DS configuration files and LDAP tree under o=NetscapeRoot. Everything appears to run okay: the directory server and admin server start up, answer queries and none of the integrated applications have had any trouble with this change. The only problem seems to be that I cannot access either the admin server or directory server through the Fedora management console. The "Server Group" entry under our administrative domain & host is empty (e.g., Administrative Server & Directory Server refuse to show up like they used to). Does anyone have any idea what might be happening here? I cannot find any errors that stand out in the logs. FWIW, we are running 1.0.4. Thanks in advance, Matt -- Matt Adams Development & Network Services Cypress Interactive http://cypressinteractive.com, http://edsuite.com

1 1

[Fedora-directory-users] Personal Address book In FDS
by stupid stupid 14 Nov '08

14 Nov '08

Hello, I am new to FDS and LDAP world. I have installed FDS on a server and would like to use it for Address book lookup. The address book look up is working from different mail clients, but I wanted to know how to allow users to add their own Personal Address book entries to the Fedora DS. Please help. Thanks

1 1

[Fedora-directory-users] surgery on existing directory
by Graham Seaman 14 Nov '08

14 Nov '08

Hi, I have an existing populated directory supporting a live application. The next development version will have some fairly large scale changes - changes to schema, objectClasses, attribute names and attribute values - but I can't lose the actual data we already have. The approach I've been trying is: 1. Use db2ldif to dump the groups and users (the only bit of the data which is 'mine') from the live directory on the live system: /usr/lib/dirsrv/slapd-flame/db2ldif -U -n userRoot -a /opt/backups/original.ldif -s "dc=lse,dc=ac,dc=uk" -s "ou=My Groups" -s "ou=My Users" 2. Edit the ldif file with the changes I need 3. Load the ldif file into a new fedora directory on my development system with ldif2db.pl: /usr/lib/dirsrv/slapd-dam/ldif2db.pl -D "cn=directory manager" -w MYPASS -n userRoot -s "dc=lse,dc=ac,dc=uk" -s "ou=New Groups" -s "ou=New Users" -i /opt/backups/new.ldif ldif2db.pl terminates almost immediately, clearly without having read most of the file. The fedora log shows: [14/Nov/2008:11:35:54 +0000] conn=2 op=1 ADD dn="cn=import_2008_11_14_11_35_55, cn=import, cn=tasks, cn=config" [14/Nov/2008:11:35:54 +0000] conn=2 op=1 RESULT err=0 tag=105 nentries=0 etime=0 If I repeat the operation I get 'operation error'; and if I try to access the directory, it appears to be completely empty. So, two questions: - is this a reasonable way to go about this task, or are there other tools I should use? - any suggestions for debugging? Thanks Graham

2 2

[Fedora-directory-users] I can not write dse.ldif file
by Hugo Etievant 14 Nov '08

14 Nov '08

hello, When I do some updates in the content of the dse.ldif file for an instance (/etc/dirsrv/slapd-instance/), my file is rewrited and restored back to the previous version automatically by FDS without my permission ! How can I ensure durability of my updates for this config file ? regards -- * Hugo Étiévant *

2 1

[Fedora-directory-users] Frequency of sync windows
by Hugo Etievant 13 Nov '08

13 Nov '08

hello, The admin manual say : "Synchronization occurs every five minutes. However, an incremental update can be done manually if there are changes that need synchronized immediately." ( http://www.redhat.com/docs/manuals/dir-server/ag/8.0/ Windows_Sync-Using_Windows_Sync.html ) But my tests show that the synchro of users accounts, passwords and attributes of entries is being in real time between FDS and Active Directory without forcing "receive and send update" action in Fedora IDM Console ! What are the real rules and frequencies of synchronization ? How can we change those parameters ? regards -- * Hugo Étiévant ***

4 4

[Fedora-directory-users] Errors when a full re-sync is initiated in Windows Sync. Could temp. changes in binding-user rights be the cause?
by Erling Ringen Elvsrud 13 Nov '08

13 Nov '08

When right clicking on the win-sync agreement and selecting initiate full re-synchronization I get these errors in /var/log/dirsrv/slapd-xyz/errors: "[10/Nov/2008:08:05:52 +0100] NSMMReplicationPlugin - changelog program - libdb: txn_checkpoint: failed to flush the buffer cache No such file or directory [10/Nov/2008:08:05:53 +0100] NSMMReplicationPlugin - changelog program - libdb: 26fdcb82-912411dd-8d71b7a1-43daa7e9_48e5d6030000ffff0000.db4: unable to flush: No such file or directory [10/Nov/2008:08:05:53 +0100] NSMMReplicationPlugin - changelog program - libdb: txn_checkpoint: failed to flush the buffer cache No such file or directory [10/Nov/2008:08:05:53 +0100] NSMMReplicationPlugin - changelog program - libdb: 26fdcb82-912411dd-8d71b7a1-43daa7e9_48e5d6030000ffff0000.db4: unable to flush: No such file or directory [10/Nov/2008:08:05:53 +0100] NSMMReplicationPlugin - changelog program - libdb: txn_checkpoint: failed to flush the buffer cache No such file or directory" A dialog box also appears with the following text: "An error occured during the consumer initialization The error received by the replica is '12 Total update aborted: Replication agreement for agmnt=xyz can not be updated while the replica is disabled (if the suffix is disabled you must enable it then restart the server for replication to take place).'. To check the initialization status, go to the 'status' tab and click on 'Replication status' in the left pane. The status of the initialization appears in the right pane." Before the problems occured we temporarily disabled "domain admins" rights for the user WIndows Sync uses to bind to AD. While the binding-user only had read acess for the suffix we wanted to sync with we started a full re-sync (with the errors above). The dirsrv was also restarted. We have re-enabled "domain admins" rights for the binding-user but the errors still appear. The directory server is searchable and seems to work exept for syncing. Could it be that the temporary changes in rights for the binding-user could have caused this? Also, is it absolutely needed to have domain admin rights for the binding-user RHDS uses to connect to AD? We do not want to write any changes back to AD and those attributes synced with Windows sync will not be changed anyway. Thanks, Erling

2 3

[Fedora-directory-users] Unable to create certificate request if O=Example, Inc.
by mallapadi niranjan 12 Nov '08

12 Nov '08

Hi all I have Fedora Directory Server installed on F9 box (fedora-ds-base-1.1.3-2.fc9.x86_64). Due to sum bug i guess , i am unable to create the certificate request through Console that is Directory Server->Manager Certificates-> Request -> Request Certificate Manually. In the Server Name:dhcp7-92.example.com Organization: Example, Inc. City/Locality: Raleigh State/Province: North Carolina Country/Region: US United States Click on Show DN and i remove all the double quotes and my DN looks as below CN="dhcp7-92.example.com, O=Example, Inc., L=Raleigh, ST=North Carolina, C=US When i click on Next it says "Unable to convert DN to certificate name So i tried with certutil command. $cd /etc/dirsrv/slapd-dhcp7-92/ $certutil -R -s "C=US, ST=North Carolina, L=Raleigh, O=Example, Inc., CN= dhcp7-92.example.com" -o mycert.req -d . I got the below output certutil -s: improperly formatted name: "C=US, ST=North Carolina, L=Raleigh, O=Example, Inc., CN=dhcp7-92.pnq.redhat.com" Now if i modify it as "certutil -R -s "C=US, ST=North Carolina, L=Raleigh, O=Example, CN=dhcp7-92.pnq.redhat.com" -o mycert.req -d ." it works. The same with the console i.e If Organization title is modified from "Example, Inc. " to "Example" it works. So the space and period symbol in (Example, Inc.) is an issue ? But this doesn't happen when i create certifcate requests with openssl commands. Regards Niranjan

2 1

[Fedora-directory-users] PassSync : Windows Active Directory remember my last 2 passwords
by Hugo Etievant 12 Nov '08

12 Nov '08

hello, I discovered a strange behavior with Active Directory LDAP protocol ! My config : - an Active Directory on MS Windows Server 2003 SP2 + PassSync service - a Fedora Directory Server 1.1.3 + Replication Agreement for Windows synchronization Bidirectional synchronization of accounts is running, it is OKAY. When an administrator reset an user password with Administration Server Console, this user can connects him to Windows LDAP with the new password choosed by administrator (the sync of password is OK), But this user can also uses the previous password (big surprise) ! => both are accepted by Windows LDAP : the last and the previous password !!! How that can be possible ???! And how to stop this strange behavior ? User connexions are made with ldapsearch command : /usr/lib/mozldap/ldapsearch -h adfds -P /etc/dirsrv/slapd-fds3/ -m /etc/dirsrv/slapd-fds3/ -D "cn=Gontran Bonheur,cn=Users,dc=example,dc=fr" -b "cn=Users,dc=example,dc=fr" -w - "(cn=Gontran Bonheur)" dn This request accepts the new and the previous passwords !!!!!! If I force "Send and Receive Updates Now" in the Console, the behavior does not change. If my user uses Windows login banner, this behavior doesn't appear. Regards. -- * Hugo Étiévant ***

3 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2008