389-users November 2008

389-users@lists.fedoraproject.org

43 participants
59 discussions

[Fedora-directory-users] Removing attributes from Active Directory on sync
by Jeff Williams 11 Nov '08

11 Nov '08

Hello, I'm trying to create a AD<->FDS sync Our AD has the following layout: uid=myuser,Ou=User,OU=CompanyGroup,dc=ourADdomain,dc=com While our LDAP structure has the following layout: uid=myuser,ou=people,dc=ldapdomain,dc=com How can I make sure that the users from the AD ou=user,ou=CompanyGroup,dc=ouraddomain,dc=com are placed in the ou=people,dc=ldapdomain,dc=com container? I'm not sure how to consistently remove the excessive AD attribute? Thanks, Jeff Williams

2 3

[Fedora-directory-users] Windows sync: Synchronization of group membership
by Erling Ringen Elvsrud 11 Nov '08

11 Nov '08

Hello list, According to the RHDS Administration Guide in the chapter on Windows Sync(page 531): "The membership of groups is synchronized with the constraint that only those members that are also within the scope of the agreement are propagated" (note that I did not read this before the test) I have tried the following: In AD I have: ou=LinuxUsers ou=LinuxGroups I have configured two separate synchronization agreements in RHDS, one that populate ou=People from ou=LinuxUsers in AD and one that populate ou=Groups from ou=LinuxGroups in AD. The synchronization works, and after it is complete I use ldapsearch on ou=Groups in RHDS and ou=LinuxGroups in AD and the member-attributes is indeed missing on the RHDS side. So, in order to keep group-membership I need to synchronize the parent ou of both users and groups. So something like ou=LinuxUsers,ou=Linux, dc=... and ou=LinuxGroups, ou=Linux, dc=... must be created in AD, and in the synchronization agreement I will sync ou=Linux and get both users and groups. The alternative is to synchronize with the current parrent of LinuxUsers and LinuxGruops. Is this correct? Do you know why this "limitation" exists? Thanks Erling

2 1

[Fedora-directory-users] Coolkey
by Zach Casper 10 Nov '08

10 Nov '08

I'm currently attempting to use the Coolkey applet but we are not Gemalto users/developers. Does a version exist in a CAP file versus the IJC built Java Card applet or Does a non-Cyberflex dependent src exist? I don't believe that SDK is available but non-the-less it was still a "for fee" piece. Where is the true Open Source non-dependent Coolkey solution? We have already been using MUSCLE and others but I understand Coolkey has matured from v0.9.1 and current MUSCLE is at v0.9.8 Zach

1 0

[Fedora-directory-users] remote connection to console
by Eric 10 Nov '08

10 Nov '08

Hi, there was a fedora ds version 1.0.4. admin had a remote console via an intermadiate machine using ssh tunnel. fedora-ds folder was destroyed then I replaced it with a copy of fedora-ds folder from another installation. the server works well but the admin hasn't remote console. the ssh file that worked before is: ssh -L 389:ldap server IP:389 -L 8080:ldap server IP:port of fedora-ds installation -l admin intermadiate _machine _IP I only changed the port number of fedora-ds installation with new port number. shuld I change another thing?

1 0

Re: [Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09 10 Nov '08

10 Nov '08

Hi, Thank you for your help. I am using fedora-ds 1.0.4-1 (RH4). I need both, the certificate and the key. Rgds Phru

1 0

[Fedora-directory-users] PassSync : Windows Active Directory remember my last 2 passwords
by Vipul Ramani 07 Nov '08

07 Nov '08

Well It is not FDS problem - this is something MS changed in win2003 http://support.microsoft.com/?kbid=906305 -- Regards Vipul Ramani

1 0

[Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09 07 Nov '08

07 Nov '08

Hi together, I have successfully set up my directory server. For a disaster tolerant topology I want to load balance the two servers over a F5 LTM load balancer. My problem is, that I have tried to export the certificate ( I have a self generated one ) without a result. The load balancer could only read certificates in pem format. So, if anyone of you know what type of certificate the DS uses let me know about it ;-) The certificate was generated with the gencert.sh script which is available under http://github.com/richm/scripts/tree/master%2Fsetupssl.sh?raw=true I don't know very much about the SSL stuff so I am not sure If I have tried the right tools/commands. Which one is the certificate the slapd-yourhost-cert8.db or is it only stored in there? Thank you in advance! Cheers phru

3 2

Re: [Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09 07 Nov '08

07 Nov '08

I had the same issue exporting my certificate in pkcs12 format to import it to the radius part of my authentification server. Indeed, there are two certificates in the pkcs12 file for chaining with root certificat, you must specify to write options to extract only the good one (or edit the pem on you own to cut off the bad one). # certutil -d . -L # pk12util -d . -o ldap-server.pk12 -n «certificate name » # pk12util -d /etc/dirsrv/slapd-server/ -i ldap-server.pk12 -n «certificat name» # openssl pcks12 -clcerts : no client certificate -cacerts : no CA certificate I think the option -cacerts will fix your issue as it fixed mine. In fact, it's a bug with poor implementations of pem file reading (like freeradius does). Hope it would help. Regards. -- Nicolas CAREL Service Commun Informatique Chef de service Tel : 04 72 76 61 43 - e-mail : nicolas carel inrp fr <mailto:nicolas%20carel%20inrp%20fr> Institut National de Recherche Pédagogique <http://www.inrp.fr/> 19 allée de Fontenay - B.P. 17424 - 69347 LYON CEDEX 07 Standard : 04 72 76 61 00 - Télécopie : 04 72 76 61 10 Attachment: smime.p7s <https://www.redhat.com/archives/fedora-directory-users/2008-November/p7sg6w…> Description: S/MIME Cryptographic Signature Hi, Thank you for your help. I am using fedora-ds 1.0.4-1 (RH4). When I try to run the certutil -d . -L command there is no output or certificate available?! Where is the mistake? /opt/fedora-ds/alias /opt/fedora-ds/shared/bin/certutil -d . -L In the directory /opt/fedora-ds/alias I have the following files: admin-serv-host-cert8.db admin-serv-host-key3.db adminserver.p12 cacert.asc cert8.db gencert.sh key3.db libnssckbi.so noise.txt password.conf pwdfile.txt secmod.db slapd-host-cert8.db slapd- host -cert8.db.bak slapd- host -key3.db slapd- host -key3.db.bak slapd- host -pin.txt The secured LDAP connection from a client to the server is working properly, therefore I think the certificates are installed right. Thank you in advance Regards Phru

1 0

[Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09 06 Nov '08

06 Nov '08

1 0

[Fedora-directory-users] Discussion about "Configuration DS" & "User DS" settings in Admin Server Console
by Hugo Etievant 06 Nov '08

06 Nov '08

hello, In the general "Configuration" tab of "Administration Server" Console, what differences between connexion settings in "User DS" and "Configuration DS" tabs ? Theses settings are redundant, no ? "User DS" settings are used by Administration Server to be connected to the Directory Server configuration database (netscapeRoot). But what additional information is supplied by "Configuration DS" ??? bye -- * Hugo Étiévant ***

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2008