389-users April 2009

389-users@lists.fedoraproject.org

41 participants
58 discussions

[Fedora-directory-users] Replication agreement trouble
by Juan Asensio Sánchez 22 Apr '09

22 Apr '09

Hi Since yesterday I am having troubles with replication between two servers. The replica is in multimaster mode in both servers, and everything is configured OK (database, suffixes, changelog, replica, agreements; until yesterday everything worked OK). [21/Apr/2009:11:04:57 +0200] NSMMReplicationPlugin - Replication agreement for agmt="cn=GRS_back-GRS_ppal" (grsgscvalp0101:636) could not be updated. For replication to take place, please enable the suffix and restart the server The only thing to mention are replication problems with other databases and replicas, but not for the replica of the agreement in the message. They were fixed re-initializing the consumers of those replicas. Any idea? Regards and thanks in advance.

2 3

[Fedora-directory-users] FDS for EPEL 5
by Orion Poplawski 21 Apr '09

21 Apr '09

Any reason we couldn't get FDS 1.2 packages into EPEL? I'm happy to drive it. -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA/CoRA Division FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com

1 0

Re: [Fedora-directory-users] fedora ds problem with updating centos
by Eric 21 Apr '09

21 Apr '09

> > Thanks Rich. My problem was fixed with your suggestion too. I had upgraded > OS without updating fedora ds.Is it the reson of problem? > > > Message: 3 > Date: Mon, 20 Apr 2009 07:53:05 -0600 > From: Rich Megginson <rmeggins(a)redhat.com> > Subject: Re: [Fedora-directory-users] fedora ds problem with updating > centos > To: "General discussion list for the Fedora Directory server project." > <fedora-directory-users(a)redhat.com> > Message-ID: <49EC7E41.9010505(a)redhat.com> > Content-Type: text/plain; charset="iso-8859-1" > > Eric wrote: > > Hi all, > > I had fedora-ds-1.1.3-1.fc6 installed on centos 5. I have updated > > centos to 5.3. now fedora ds cann't be start. when I use: service > > dirsrv start there is this error: > > ldap...[19/Apr/2009:06:46:14 -0400] - Unable to access nsslapd-rundir: > > Bad address > > [19/Apr/2009:06:46:14 -0400] - Ensure that user "ldap" has read and > > write permissions on (null) > > [19/Apr/2009:06:46:14 -0400] - Shutting down. > > [FAILED] > You upgraded fedora ds first, then upgraded CentOS to 5.3? ls -al > /var/run/dirsrv > > > > ------------------------------------------------------------------------ > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > > > -------------- next part -------------- > A non-text attachment was scrubbed... > Name: smime.p7s > Type: application/x-pkcs7-signature > Size: 3258 bytes > Desc: S/MIME Cryptographic Signature > Url : > https://www.redhat.com/archives/fedora-directory-users/attachments/20090420… > >

2 1

RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda 21 Apr '09

21 Apr '09

> Michal Rejda wrote: > >> Michal Rejda wrote: > >> > >>>> Michal Rejda wrote: > >>>> > >>>> > >>>>>> Michal Rejda wrote: > >>>>>> > >>>>>> > >>>>>> > >>>>>>>> -----Original Message----- > >>>>>>>> From: fedora-directory-users-bounces(a)redhat.com > [mailto:fedora- > >>>>>>>> directory-users-bounces(a)redhat.com] On Behalf Of Rich > Megginson > >>>>>>>> Sent: Tuesday, April 14, 2009 4:25 PM > >>>>>>>> To: General discussion list for the Fedora Directory server > >>>>>>>> > >>>>>>>> > >>>> project. > >>>> > >>>> > >>>>>>>> Subject: Re: [Fedora-directory-users] LDAP proxy > >>>>>>>> > >>>>>>>> Michal Rejda wrote: > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> I tried to use http://tinyurl.com/culeft. But the database > >>>>>>>>> link > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>> doesn't work. I setup the database link to the Active > Directory > >>>>>>>> > >>>>>>>> > >>>> (and > >>>> > >>>> > >>>>>>>> OpenLDAP). When I looked into Wireshark log, FDS send search > >>>>>>>> > >>>>>>>> > >>>> request > >>>> > >>>> > >>>>>>>> with controls: > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> 2.16.840.1.113730.3.4.2 > >>>>>>>>> 2.16.840.1.113730.3.4.12 > >>>>>>>>> And the AD server responded: Unavailable Critical Extension. > >>>>>>>>> > >>>>>>>>> I tried to remove this two controls from Database Link > >>>>>>>>> Settings > >>>>>>>>> > >>>>>>>>> > >>>> (in > >>>> > >>>> > >>>>>>>> administration console) but it didn't help. The server didn't > >>>>>>>> > >>>>>>>> > >>>> return > >>>> > >>>> > >>>>>>>> the message above, but the administrative console show error > >>>>>>>> > >>>>>>>> > >>>> dialog. > >>>> > >>>> > >>>>>>>> What error? > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>> I tried it again and the error message is exactly: > >>>>>>> > >>>>>>> Error fading object 'dn: dc=example, dc=com'. > >>>>>>> The error send by the server was: > >>>>>>> ". > >>>>>>> > >>>>>>> In the Whireshark log was still the search request witch > control: > >>>>>>> 2.16.840.1.113730.3.4.2 > >>>>>>> > >>>>>>> Why is this control needed by the server when I removed it from > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> Database link settings? > >>>>>> > >>>>>> I'm not sure - maybe the console is not working correctly. Try > >>>>>> > >> this: > >> > >>>>>> 1) Shutdown the server > >>>>>> 2) cd /etc/dirsrv/slapd-yourinstance > >>>>>> 3) edit dse.ldif - look for the entry > >>>>>> dn: cn=config,cn=chaining database,cn=plugins,cn=config > >>>>>> 4) edit the nsTransmittedControls attribute - remove > >>>>>> 2.16.840.1.113730.3.4.2 > >>>>>> 5) save and restart the server > >>>>>> > >>>>>> > >>>>>> > >>>>> I looked into dse.ldif for a nsTransmittedControls attribute. > >>>>> There > >>>>> > >>>>> > >>>> is only the 1.3.6.1.4.1.1466.29539.12. , not the problematic > >>>> 2.16.840.1.113730.3.4.2. > >>>> > >>>> > >>>>> Isn't the 2.16.840.1.113730.3.4.2 hardcoded? > >>>>> > >>>>> > >>>> If it is, I don't see it. There is no mention of managedsa or > >>>> 2.16.840.1.113730.3.4.2 anywhere in the chaining backend code. The > >>>> only place it is mentioned is in the default list of > >>>> nsTransmittedControls in the template-dse.ldif used during new > >>>> instance creation. > >>>> > >>>> > >>>>> Why is this so necessary? > >>>>> > >>>>> > >>>>> > >>>> It's not necessary, and I'm not sure where it is coming from. Once > >>>> place might be an internal operation, but I'm not sure what > >>>> internal operation would be doing this. You might also try to > >>>> remove nsActiveChainingComponents and nsPossibleChainingComponents > >>>> to see > >>>> > >> if > >> > >>>> one of those components is doing an internal operation with > >>>> managedsait set. > >>>> > >>>> > >>> I removed nsActiveChainingComponents and > >>> nsPossibleChainingComponents > >>> > >> and it didn't help. > >> > >> Then I'm not sure where it's coming from. I suppose you could enable > >> tracing in the directory server and see if there is anything > >> interesting in the error log - see > >> http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting > >> > > > > In the attachment is the part of the server error log. I removed all > > messages before I click on the exclamation mark before the DN in the > > Fedora administration console -> Directory folder tab. I don't > > understand this log. It is helpful for you? > > > > > Ah, I see. You are using the console to try to browse the AD tree? And > you are using the console admin user "admin"? Try ldapsearch from the > command line, and attempt to authenticate as an AD user (e.g. > cn=administrator,cn=users,dc=example,dc=com). Yes, you are right. I use the console to browse AD tree. But I do this because there is attention marker before the root suffix (lib-w2k3r2) in the Directory tab and I just double click on it. I tried ldapsearch using AD user (Administrator). I'm able to login but the ldapsearch don't show any results (I use Apache Directory Studio). When I looked into Whireshark log, I now see that another critical extension is missing: 2.16.840.1.113730.3.4.12. The log is in the attachment. > >>>>>>>>>> Michal Rejda wrote: > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>> Hi all, > >>>>>>>>>>> > >>>>>>>>>>> Im trying to setup proxy on FDS to another LDAP server > >>>>>>>>>>> > >>>>>>>>>>> > >>>> (OpenLDAP > >>>> > >>>> > >>>>>>>>>>> and Active Directory). I tried two ways, but none of these > >>>>>>>>>>> > >>>>>>>>>>> > >>>> works: > >>>> > >>>> > >>>>>>>>>>> 1) New database link to LDAP server. > >>>>>>>>>>> > >>>>>>>>>>> - The remote LDAP server (OpenLDAP) returns: null. > >>>>>>>>>>> > >> manageDSAit > >> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> control > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>> value not found > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> You might have to tweak the controls used by chaining - see > >>>>>>>>>> http://tinyurl.com/culeft > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>> 2) Create multiple-master replication and setup other > server > >>>>>>>>>>> as > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> consumer. > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>> - But this show error: 255 Replication error acquiring > >>>>>>>>>>> > >> replica: > >> > >>>>>>>>>>> unknown error. > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> Replication will only work to a SunDS, not to any other > >>>>>>>>>> > >> vendor. > >> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>> My question is: Is there way how to setup proxy to access > >>>>>>>>>>> > >>>>>>>>>>> > >>>> another > >>>> > >>>> > >>>>>>>>>>> > >>>>>>>>>> LDAP > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>> server from Fedora DS? I know that is possible to use AD > >>>>>>>>>>> > >> sync, > >> > >>>>>>>>>>> > >>>>>> but > >>>>>> > >>>>>> > >>>>>> > >>>>>>>> I > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>>> cannot install anything on the AD server. The second reason > >>>>>>>>>>> why > >>>>>>>>>>> > >>>>>>>>>>> > >>>> I > >>>> > >>>> > >>>>>>>>>>> > >>>>>>>>>> need > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>>> to setup proxy is to use data stored in LDAP server > >>>>>>>>>>> > >> (OpenLDAP, > >> > >>>>>>>>>>> Open Direcoty Server and Active Directory) in one place. I > >>>>>>>>>>> need > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>> to > >>>>>> > >>>>>> > >>>>>> > >>>>>>>> update > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>>>> them too. It is not necessary to synchronize passwords. > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>> See also > >>>>>>>>>> > >>>>>>>>>> > >>>>>>>>>> > >>>> http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration > >>>> > >>>> > >>>>>>>>>> > >>>>>>>>>>> Thank you for reply. > >>>>>>>>>>> > >>>>>>>>>>> Regards, > >>>>>>>>>>> > >>>>>>>>>>> Michal > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>>>>>>>> > >>>>> -- > >>>>> Fedora-directory-users mailing list > >>>>> Fedora-directory-users(a)redhat.com > >>>>> https://www.redhat.com/mailman/listinfo/fedora-directory-users > >>>>> > >>>>> > >>>>> > >>> > >>> -- > >>> Fedora-directory-users mailing list > >>> Fedora-directory-users(a)redhat.com > >>> https://www.redhat.com/mailman/listinfo/fedora-directory-users > >>> > >>> > > > > > > --------------------------------------------------------------------- > - > > -- > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > >

2 1

[Fedora-directory-users] RE: Where to search mail archives, cannot find the command: remove-ds-admin.pl - don't worry
by lambam80＠hotmail.com 21 Apr '09

21 Apr '09

Hello again. Don't worry, I simply re-ran /usr/sbin/setup-ds-admin.pl and it worked. Thanks, Dave From: lambam80(a)hotmail.com To: fedora-directory-users(a)redhat.com; lambam80(a)hotmail.com Subject: Where to search mail archives, cannot find the command: remove-ds-admin.pl Date: Tue, 21 Apr 2009 03:54:36 -0400 Hello everybody and thanks for all your help in the past. Q1: Fistly, what is the recommended means to search the mail archives ? I don't fancy downloading all the GZIP files found here: https://www.redhat.com/archives/fedora-directory-users/ http://www.redhat.com/mailman/listinfo/fedora-directory-users Q2. I have the following version of Directory Server running on Fedora 10: [root@ldap4 dirsrv]# cat /etc/redhat-release Fedora release 10 (Cambridge) [root@ldap4 sbin]# /usr/sbin/ns-slapd -v Fedora Project Fedora-Directory/1.1.3 B2008.289.115 Q2: I cannot find the command remove-ds-admin.pl as documented here: http://directory.fedoraproject.org/wiki/FDS_Setup#remove-ds-admin.pl Even with the find command. Where might I find this command, please ? Cdlt, Dave Internet Explorer 8 makes surfing easier. Get it now! _________________________________________________________________ Internet Explorer 8 helps keep your personal info safe. http://go.microsoft.com/?linkid=9655581

1 0

[Fedora-directory-users] Configure LDAP clients
by Rusch Philipp pru09 21 Apr '09

21 Apr '09

Hello all, my last try to move on with the SSL certificates. I have installed fedora-ds 1.0.4 and have used the setupssl.sh script to generate the certificates on my both servers. After that I jumped tot he „configure ldap clients“ section and there it says: „If you have more than 1 CA cert, you will have to concatenate them into a single file.“ Can anyone tell me how I have to concatenate the two cacert.asc files? I have tried several things without any result (e.g cat cacert1.asc cacert2.asc > cacert.asc). Only the first certificate is used to establish a new tls connection. I woul appreciate any help about this problem! Thank you in advance. Rgds Philipp P Im Sinne unserer Umwelt: Bitte bedenken Sie, dass ein Ausdruck dieser Nachricht wertvolle Ressourcen verbraucht. For the sake of our environment: Please be aware of the fact that printing this message consumes valuable resources.

2 1

[Fedora-directory-users] logconv showing unindexed searches on indexed attributes.
by James Chavez 21 Apr '09

21 Apr '09

Hello List, I have a directory with 20,000 plus users. The output from logconv is showing me that I have unindexed searches with a search filter of '(uidNumber=*)'. However my uidNumber attribute is indeed indexed. The documentation states the following " In Directory Server, when examining an index, if more than a certain number of entries are found, the server stops reading the index and marks the search as unindexed for that particular index." I believe this is what is going on because if i increase the idlistscanlimit the searches no longer show as unindexed. So a few questions. Is this a serious warning or error and does it effect performance? It seems to me that it renders the indexes useless for directories with more than 4,000 entries unless the idlistscanlimit is increased. Can I increase it only for the uidNumber or chosen attributes attributes? I am assuming the answer to this is no since it seems to be set globally. Is there a tool similar to OpenLDAP's slapindex utility to maintain index integrity in FDS or is it not necessary? Thank you

2 1

[Fedora-directory-users] Windows sync woes
by John A. Sullivan III 20 Apr '09

20 Apr '09

Hello, all. I'm having grief trying to get DS 8.0 to synchronize with Active Directory on Windows 2003 Server R2. I first tried to synchronize an existing branch of DS with ntuser ids to a fresh AD. That kept failing with sync total update aborted LDAP error operations error code 1 and messages about failing to replay creation in the errors log. I then deleted the agreement, created a new empty branch in DS, and set up a windows synchronization agreement. All the errors went away. I also verified communication with /usr/lib64/mozldap/ldapsearch -Z -P ./cert8.db -h <hostname> -p 636 -D "cn=Synch Manager,cn=users,dc=some,dc=domain" -w - -s sub -b "cn=Users,dc=some,dc=domain" "cn=*" However, when I create a new user in DS, it does not propagate to AD. I create the user, add the NT user option and set the uid as well as check the create new account and delete account boxes. The DS is set up as a single master. We do not want entries from AD propagating to DS, just from DS to AD. We initially created the synchronization user in AD as a member of domain admins. We also tried making it a member of enterprise and schema admins. Nothing seems to work. We see nothing in the AD logs to indicate where the failure is. We see very little on DS: [20/Apr/2009:21:41:21 -0400] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=TestWinSync" (timberline:636)". [20/Apr/2009:21:41:22 -0400] - Entry "uid=Guest,o=a0000-0012,o=Internal, dc=ssiservices, dc=biz" missing attribute "sn" required by object class "person" [20/Apr/2009:21:41:22 -0400] - Entry "uid=SUPPORT_388945a0,o=a0000-0012,o=Internal, dc=ssiservices, dc=biz" missing attribute "sn" required by object clas [20/Apr/2009:21:41:22 -0400] - Entry "uid=Administrator,o=a0000-0012,o=Internal, dc=ssiservices, dc=biz" missing attribute "sn" required by object class " [20/Apr/2009:21:41:22 -0400] - Entry "uid=krbtgt,o=a0000-0012,o=Internal, dc=ssiservices, dc=biz" missing attribute "sn" required by object class "person" [20/Apr/2009:21:41:22 -0400] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=TestWinSync" (timberline:636)". Sent 18 entries. [20/Apr/2009:21:43:07 -0400] NSMMReplicationPlugin - agmt="cn=TestWinSync" (timberline:636): windows_replay_update: Cannot replay add operation. [20/Apr/2009:21:43:07 -0400] NSMMReplicationPlugin - agmt="cn=TestWinSync" (timberline:636): Simple bind resumed [20/Apr/2009:21:48:06 -0400] NSMMReplicationPlugin - agmt="cn=TestWinSync" (timberline:636): Simple bind resumed [20/Apr/2009:21:55:58 -0400] NSMMReplicationPlugin - agmt="cn=TestWinSync" (timberline:636): windows_replay_update: Cannot replay add operation. [20/Apr/2009:21:55:58 -0400] NSMMReplicationPlugin - agmt="cn=TestWinSync" (timberline:636): Simple bind resumed [20/Apr/2009:22:00:59 -0400] NSMMReplicationPlugin - agmt="cn=TestWinSync" (timberline:636): Simple bind resumed I was surprised to see the entries for the Windows based users propagating. They do not show up in DS. I'm assuming the replay add operation failures are the attempts to add the user defined in DS. The user was most minimal with only SN, givenname, cn, uid, password and the above mentioned nt attributes set. Not being very versed in AD, I'm sure I must be making some dumb mistake but I don't see what it is. Any suggestions on where to look? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

1 0

[Fedora-directory-users] Am I on the right list?
by Juan Pablo Lorier 20 Apr '09

20 Apr '09

Hi guys, I posted about samba + fds a few days ago but didn't get any reply. Maybe it's because this is not the right list?. I just need a had because I can get openldap + samba working, but not with fds. regards -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que está limpio.

1 0

Re: [Fedora-directory-users] Re: fedora ds problem with updating centos
by Andy Schofield 20 Apr '09

20 Apr '09

> Andy Schofield wrote: > I have exactly the same error: > > ldap...[19/Apr/2009:06:46:14 -0400] - Unable to access > > nsslapd-rundir: Bad address Thanks Rich - it was fixed by your suggestion: > mkdir -p /var/run/dirsrv/slapd-yourinstancename - chown to your server > user id - chmod to make it rwx by the server user ID > shutdown the directory server - Edit dse.ldif, the cn=config entry - > add nsslapd-rundir: /var/run/dirsrv/slapd-yourinstancename (SELinux was already running in permissive mode - sorry I should have mentioned that in my initial post). All seems to be working fine with 1.2.0 now.

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2009