389-users April 2009

389-users@lists.fedoraproject.org

41 participants
58 discussions

[Fedora-directory-users] Re: fedora ds problem with updating centos
by Andy Schofield 20 Apr '09

20 Apr '09

I have exactly the same error: > ldap...[19/Apr/2009:06:46:14 -0400] - Unable to access nsslapd-rundir: > Bad address In my case this is nothing to do with the upgrade to CentOS 5.3 (which went smoothly). Instead it is when I upgrade to fedora-ds-base-1.2.0 from fedora-ds-base-1.1.3-2. It does not seem to make any difference what the permissions are on the /var/run/dirsrv directory. To show this I have made the directory world writable and I still get the error. At the moment the permissions are: ls -ld /var/run/dirsrv drwxrwxrwx 2 ldap root 4096 Apr 20 18:09 /var/run/dirsrv Previously it was 750 Any other ideas? Andy PS I am running a production system so I have had to revert to 1.1.3 until this is fixed.

3 2

RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda 20 Apr '09

20 Apr '09

> Michal Rejda wrote: > >> Michal Rejda wrote: > >> > >>>> Michal Rejda wrote: > >>>> > >>>> > >>>>>> -----Original Message----- > >>>>>> From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora- > >>>>>> directory-users-bounces(a)redhat.com] On Behalf Of Rich Megginson > >>>>>> Sent: Tuesday, April 14, 2009 4:25 PM > >>>>>> To: General discussion list for the Fedora Directory server > >>>>>> > >> project. > >> > >>>>>> Subject: Re: [Fedora-directory-users] LDAP proxy > >>>>>> > >>>>>> Michal Rejda wrote: > >>>>>> > >>>>>> > >>>>>> > >>>>>>> I tried to use http://tinyurl.com/culeft. But the database link > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> doesn't work. I setup the database link to the Active Directory > >>>>>> > >> (and > >> > >>>>>> OpenLDAP). When I looked into Wireshark log, FDS send search > >>>>>> > >> request > >> > >>>>>> with controls: > >>>>>> > >>>>>> > >>>>>> > >>>>>>> 2.16.840.1.113730.3.4.2 > >>>>>>> 2.16.840.1.113730.3.4.12 > >>>>>>> And the AD server responded: Unavailable Critical Extension. > >>>>>>> > >>>>>>> I tried to remove this two controls from Database Link Settings > >>>>>>> > >> (in > >> > >>>>>>> > >>>>>> administration console) but it didn't help. The server didn't > >>>>>> > >> return > >> > >>>>>> the message above, but the administrative console show error > >>>>>> > >> dialog. > >> > >>>>>> What error? > >>>>>> > >>>>>> > >>>>>> > >>>>> I tried it again and the error message is exactly: > >>>>> > >>>>> Error fading object 'dn: dc=example, dc=com'. > >>>>> The error send by the server was: > >>>>> ". > >>>>> > >>>>> In the Whireshark log was still the search request witch control: > >>>>> 2.16.840.1.113730.3.4.2 > >>>>> > >>>>> Why is this control needed by the server when I removed it from > >>>>> > >>>>> > >>>> Database link settings? > >>>> > >>>> I'm not sure - maybe the console is not working correctly. Try > this: > >>>> 1) Shutdown the server > >>>> 2) cd /etc/dirsrv/slapd-yourinstance > >>>> 3) edit dse.ldif - look for the entry > >>>> dn: cn=config,cn=chaining database,cn=plugins,cn=config > >>>> 4) edit the nsTransmittedControls attribute - remove > >>>> 2.16.840.1.113730.3.4.2 > >>>> 5) save and restart the server > >>>> > >>>> > >>> I looked into dse.ldif for a nsTransmittedControls attribute. There > >>> > >> is only the 1.3.6.1.4.1.1466.29539.12. , not the problematic > >> 2.16.840.1.113730.3.4.2. > >> > >>> Isn't the 2.16.840.1.113730.3.4.2 hardcoded? > >>> > >> If it is, I don't see it. There is no mention of managedsa or > >> 2.16.840.1.113730.3.4.2 anywhere in the chaining backend code. The > >> only place it is mentioned is in the default list of > >> nsTransmittedControls in the template-dse.ldif used during new > >> instance creation. > >> > >>> Why is this so necessary? > >>> > >>> > >> It's not necessary, and I'm not sure where it is coming from. Once > >> place might be an internal operation, but I'm not sure what internal > >> operation would be doing this. You might also try to remove > >> nsActiveChainingComponents and nsPossibleChainingComponents to see > if > >> one of those components is doing an internal operation with > >> managedsait set. > >> > > > > I removed nsActiveChainingComponents and nsPossibleChainingComponents > and it didn't help. > > > Then I'm not sure where it's coming from. I suppose you could enable > tracing in the directory server and see if there is anything > interesting in the error log - see > http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting In the attachment is the part of the server error log. I removed all messages before I click on the exclamation mark before the DN in the Fedora administration console -> Directory folder tab. I don't understand this log. It is helpful for you? > > > >>>>>>>> Michal Rejda wrote: > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> Hi all, > >>>>>>>>> > >>>>>>>>> Im trying to setup proxy on FDS to another LDAP server > >>>>>>>>> > >> (OpenLDAP > >> > >>>>>>>>> and Active Directory). I tried two ways, but none of these > >>>>>>>>> > >> works: > >> > >>>>>>>>> 1) New database link to LDAP server. > >>>>>>>>> > >>>>>>>>> - The remote LDAP server (OpenLDAP) returns: null. > manageDSAit > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>> control > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> value not found > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>> You might have to tweak the controls used by chaining - see > >>>>>>>> http://tinyurl.com/culeft > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> 2) Create multiple-master replication and setup other server > >>>>>>>>> as > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>> consumer. > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> - But this show error: 255 Replication error acquiring > replica: > >>>>>>>>> unknown error. > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>> Replication will only work to a SunDS, not to any other > vendor. > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> My question is: Is there way how to setup proxy to access > >>>>>>>>> > >> another > >> > >>>>>>>>> > >>>>>>>>> > >>>>>>>> LDAP > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> server from Fedora DS? I know that is possible to use AD > sync, > >>>>>>>>> > >>>>>>>>> > >>>> but > >>>> > >>>> > >>>>>> I > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>> cannot install anything on the AD server. The second reason > >>>>>>>>> why > >>>>>>>>> > >> I > >> > >>>>>>>>> > >>>>>>>>> > >>>>>>>> need > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>> > >>>>>>>>> to setup proxy is to use data stored in LDAP server > (OpenLDAP, > >>>>>>>>> Open Direcoty Server and Active Directory) in one place. I > >>>>>>>>> need > >>>>>>>>> > >>>>>>>>> > >>>> to > >>>> > >>>> > >>>>>> update > >>>>>> > >>>>>> > >>>>>> > >>>>>>>>> them too. It is not necessary to synchronize passwords. > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>> See also > >>>>>>>> > >>>>>>>> > >> http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration > >> > >>>>>>>> > >>>>>>>> > >>>>>>>>> Thank you for reply. > >>>>>>>>> > >>>>>>>>> Regards, > >>>>>>>>> > >>>>>>>>> Michal > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>>>>>>>> > >>> > >>> -- > >>> Fedora-directory-users mailing list > >>> Fedora-directory-users(a)redhat.com > >>> https://www.redhat.com/mailman/listinfo/fedora-directory-users > >>> > >>> > > > > > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > >

2 1

[Fedora-directory-users] fedora ds problem with updating centos
by Eric 20 Apr '09

20 Apr '09

Hi all, I had fedora-ds-1.1.3-1.fc6 installed on centos 5. I have updated centos to 5.3. now fedora ds cann't be start. when I use: service dirsrv start there is this error: ldap...[19/Apr/2009:06:46:14 -0400] - Unable to access nsslapd-rundir: Bad address [19/Apr/2009:06:46:14 -0400] - Ensure that user "ldap" has read and write permissions on (null) [19/Apr/2009:06:46:14 -0400] - Shutting down. [FAILED]

2 1

[Fedora-directory-users] atomically delete subtree (non leaf)
by Roberto Polli 20 Apr '09

20 Apr '09

hi all, usually ldap isn't able to atomically delete a subtree (non-leaf). This is annoying while cleaning eg. an user addressbook of thousands of contacts. Can fedora directory server manage in some way this kind of deletion atomically? If not, do you think it's an interesting feature? Peace, R. -- Roberto Polli Babel S.r.l. - http://www.babel.it Tel. +39.06.91801075 - fax +39.06.91612446 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) "Il seguente messaggio contiene informazioni riservate. Qualora questo messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto della legge in materia di protezione dei dati personali."

3 7

[Fedora-directory-users] Trouble starting 1.2.0 on debian lenny.
by Ryan Braun [ADS] 17 Apr '09

17 Apr '09

I just got finished building some lenny packages for fds 1.2.0 and I am having some issues getting the DS running properly. Using my buildscripts (which create a working 1.2.0 and 1.1.3 for etch, incrementing lenny package names as required), the build works, but when I try to create an instance, I get an error about Netscape Portable Runtime failing to load a library. lenny:/opt/dirsrv/sbin# ./setup-ds.pl ============================================================================== This program will set up the Fedora Directory Server. SNIP Directory Manager DN [cn=Directory Manager]: Password: Password (confirm): Could not import LDIF file '/tmp/ldifUjjWfx.ldif'. Error: 256. Output: importing data ... [14/Apr/2009:12:58:17 -0400] - SSL alert: Security Initialization: NSS initialization failed (Netscape Portable Runtime error -5977 - Failure to load dynamic library.): certdir: /etc/dirsrv/slapd-lenny [14/Apr/2009:12:58:17 -0400] - ERROR: NSS Initialization Failed. Error: Could not create directory server instance 'lenny'. Exiting . . . Log file is '/tmp/setupuyjm1M.log' I first noticed an issue when building mozldap, this came up gcc -shared -Wl,-soname -Wl,libssldap60.so -o libssldap60.so ./clientinit.o ./ldapsinit.o ./errormap.o -L../../../../../dist/lib -lldap60 -lprldap60 -L/usr/lib/ -lssl3 -lnss3 -lsoftokn3 -L/usr/lib/ -lplc4 -lplds4 - lnspr4 /usr/bin/ld: cannot find -lsoftokn3 Which led my to find out lenny libnss3-1d has libsofttokn3.so in /usr/lib/nss and not /usr/lib. So I added a symlink to /usr/lib. After that mozldap and everything built ok. But now I'm wondering if I need some kind of special -- with-nss-lib statements in my ./configure's. lenny:~/fdsbuildscripts/mozldap# dpkg -L libnss3-1d /usr /usr/lib /usr/lib/nss /usr/lib/nss/libfreebl3.so /usr/lib/nss/libsoftokn3.so /usr/lib/nss/libnssdbm3.so /usr/lib/nss/libnssckbi.so /usr/lib/nss/libsoftokn3.chk /usr/lib/nss/libfreebl3.chk /usr/lib/libnss3.so.1d /usr/lib/libnssutil3.so.1d /usr/lib/libsmime3.so.1d /usr/lib/libssl3.so.1d /usr/share /usr/share/doc /usr/share/doc/libnss3-1d /usr/share/doc/libnss3-1d/copyright /usr/share/doc/libnss3-1d/changelog.Debian.gz /usr/lib/libssl3.so /usr/lib/libsmime3.so /usr/lib/libnssutil3.so /usr/lib/libnss3.so vs etch /usr /usr/share /usr/share/doc /usr/share/doc/libnss3-0d /usr/share/doc/libnss3-0d/copyright /usr/share/doc/libnss3-0d/changelog.Debian.gz /usr/share/doc/libnss3-0d/MPL.gz /usr/lib /usr/lib/libnss3.so.0d /usr/lib/libsmime3.so.0d /usr/lib/libsoftokn3.so.0d /usr/lib/libssl3.so.0d /usr/lib/xulrunner /usr/lib/xulrunner/libfreebl3.so /usr/lib/xulrunner/libnssckbi.so /usr/lib/xulrunner/libfreebl3.chk /usr/lib/libsoftokn3.0d.chk Here are my ./configure options when building mozldap and fedora-ds-base mozldap ./configure --prefix=/ \ --libdir=/usr/lib/ \ --includedir=/usr/include/mozldap \ --oldincludedir=/usr/include/mozldap \ --sysconfdir=/usr/share/mozldap/etc/ \ --bindir=/usr/lib/mozldap/ \ --enable-clu \ --with-nss-inc=/usr/include/nss/ \ --with-nss-lib=/usr/lib/ \ --with-nspr-inc=/usr/include/nspr/ \ --with-nspr-lib=/usr/lib/ \ --with-svrcore-inc=/usr/include \ --with-svrcore-lib=/usr/lib \ --with-sasl fedora-ds-base CPPFLAGS=-DNETSNMP_USE_INLINE=1 ./configure \ --prefix=/opt/dirsrv \ --enable-bundle \ --localstatedir=/var \ --sysconfdir=/etc \ --datadir=/usr/share \ --with-svrcore-inc=/usr/include \ --with-svrcore-lib=/usr/lib \ --with-ldapsdk-inc=/usr/include/mozldap/ \ --with-ldapsdk-lib=/usr/lib/ \ --with-ldapsdk-bin=/usr/lib/mozldap \ --with-nss-inc=/usr/include/nss/ \ --with-nss-lib=/usr/lib/ \ --with-nspr-inc=/usr/include/nspr/ \ --with-nspr-lib=/usr/lib/ \ --with-icu-inc=/usr/include/unicode \ --with-icu-lib=/usr/lib \ --with-icu-bin=/usr/bin \ --with-sasl \ --with-net-snmp \ --with-kerberos Thanks Ryan

3 7

RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda 17 Apr '09

17 Apr '09

> Michal Rejda wrote: > >> Michal Rejda wrote: > >> > >>>> -----Original Message----- > >>>> From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora- > >>>> directory-users-bounces(a)redhat.com] On Behalf Of Rich Megginson > >>>> Sent: Tuesday, April 14, 2009 4:25 PM > >>>> To: General discussion list for the Fedora Directory server > project. > >>>> Subject: Re: [Fedora-directory-users] LDAP proxy > >>>> > >>>> Michal Rejda wrote: > >>>> > >>>> > >>>>> I tried to use http://tinyurl.com/culeft. But the database link > >>>>> > >>>>> > >>>> doesn't work. I setup the database link to the Active Directory > (and > >>>> OpenLDAP). When I looked into Wireshark log, FDS send search > request > >>>> with controls: > >>>> > >>>> > >>>>> 2.16.840.1.113730.3.4.2 > >>>>> 2.16.840.1.113730.3.4.12 > >>>>> And the AD server responded: Unavailable Critical Extension. > >>>>> > >>>>> I tried to remove this two controls from Database Link Settings > (in > >>>>> > >>>>> > >>>> administration console) but it didn't help. The server didn't > return > >>>> the message above, but the administrative console show error > dialog. > >>>> > >>>> What error? > >>>> > >>>> > >>> I tried it again and the error message is exactly: > >>> > >>> Error fading object 'dn: dc=example, dc=com'. > >>> The error send by the server was: > >>> ". > >>> > >>> In the Whireshark log was still the search request witch control: > >>> 2.16.840.1.113730.3.4.2 > >>> > >>> Why is this control needed by the server when I removed it from > >>> > >> Database link settings? > >> > >> I'm not sure - maybe the console is not working correctly. Try this: > >> 1) Shutdown the server > >> 2) cd /etc/dirsrv/slapd-yourinstance > >> 3) edit dse.ldif - look for the entry > >> dn: cn=config,cn=chaining database,cn=plugins,cn=config > >> 4) edit the nsTransmittedControls attribute - remove > >> 2.16.840.1.113730.3.4.2 > >> 5) save and restart the server > >> > > > > I looked into dse.ldif for a nsTransmittedControls attribute. There > is only the 1.3.6.1.4.1.1466.29539.12. , not the problematic > 2.16.840.1.113730.3.4.2. > > Isn't the 2.16.840.1.113730.3.4.2 hardcoded? > If it is, I don't see it. There is no mention of managedsa or > 2.16.840.1.113730.3.4.2 anywhere in the chaining backend code. The only > place it is mentioned is in the default list of nsTransmittedControls > in > the template-dse.ldif used during new instance creation. > > Why is this so necessary? > > > It's not necessary, and I'm not sure where it is coming from. Once > place > might be an internal operation, but I'm not sure what internal > operation > would be doing this. You might also try to remove > nsActiveChainingComponents and nsPossibleChainingComponents to see if > one of those components is doing an internal operation with managedsait > set. I removed nsActiveChainingComponents and nsPossibleChainingComponents and it didn't help. > > > >>>>>> Michal Rejda wrote: > >>>>>> > >>>>>> > >>>>>> > >>>>>>> Hi all, > >>>>>>> > >>>>>>> Im trying to setup proxy on FDS to another LDAP server > (OpenLDAP > >>>>>>> and Active Directory). I tried two ways, but none of these > works: > >>>>>>> > >>>>>>> 1) New database link to LDAP server. > >>>>>>> > >>>>>>> - The remote LDAP server (OpenLDAP) returns: null. manageDSAit > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> control > >>>>>> > >>>>>> > >>>>>> > >>>>>>> value not found > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> You might have to tweak the controls used by chaining - see > >>>>>> http://tinyurl.com/culeft > >>>>>> > >>>>>> > >>>>>> > >>>>>>> 2) Create multiple-master replication and setup other server as > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> consumer. > >>>>>> > >>>>>> > >>>>>> > >>>>>>> - But this show error: 255 Replication error acquiring replica: > >>>>>>> unknown error. > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> Replication will only work to a SunDS, not to any other vendor. > >>>>>> > >>>>>> > >>>>>> > >>>>>>> My question is: Is there way how to setup proxy to access > another > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> LDAP > >>>>>> > >>>>>> > >>>>>> > >>>>>>> server from Fedora DS? I know that is possible to use AD sync, > >>>>>>> > >> but > >> > >>>> I > >>>> > >>>> > >>>>>>> cannot install anything on the AD server. The second reason why > I > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> need > >>>>>> > >>>>>> > >>>>>> > >>>>>>> to setup proxy is to use data stored in LDAP server (OpenLDAP, > >>>>>>> Open Direcoty Server and Active Directory) in one place. I need > >>>>>>> > >> to > >> > >>>> update > >>>> > >>>> > >>>>>>> them too. It is not necessary to synchronize passwords. > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>>> > >>>>>> See also > >>>>>> > http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration > >>>>>> > >>>>>> > >>>>>> > >>>>>>> Thank you for reply. > >>>>>>> > >>>>>>> Regards, > >>>>>>> > >>>>>>> Michal > >>>>>>> > >>>>>>> > >>>>>>> > > > > > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > >

2 1

[Fedora-directory-users] Samba 3 + FDS
by Juan Pablo Lorier 16 Apr '09

16 Apr '09

Hi there. I'm installing samba 3 + Centos Directory Server on a Centos 5 server. I've followed the fds samba howto but when I get to the line where it uses pdbedit, there's nothing listed by pdbedit. I checked pdbedit -L and nothing comes back. As I'm new to fds (and ldap) I don't know what can be wrong. how can I check if samba is able to work with fds authentication? I suspect that samba is not accesing fds and so it can't see the administrator entry. Regards, JPL -- Este mensaje ha sido analizado por MailScanner en busca de virus y otros contenidos peligrosos, y se considera que está limpio.

1 0

RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda 16 Apr '09

16 Apr '09

> Michal Rejda wrote: > > > >> -----Original Message----- > >> From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora- > >> directory-users-bounces(a)redhat.com] On Behalf Of Rich Megginson > >> Sent: Tuesday, April 14, 2009 4:25 PM > >> To: General discussion list for the Fedora Directory server project. > >> Subject: Re: [Fedora-directory-users] LDAP proxy > >> > >> Michal Rejda wrote: > >> > >>> I tried to use http://tinyurl.com/culeft. But the database link > >>> > >> doesn't work. I setup the database link to the Active Directory (and > >> OpenLDAP). When I looked into Wireshark log, FDS send search request > >> with controls: > >> > >>> 2.16.840.1.113730.3.4.2 > >>> 2.16.840.1.113730.3.4.12 > >>> And the AD server responded: Unavailable Critical Extension. > >>> > >>> I tried to remove this two controls from Database Link Settings (in > >>> > >> administration console) but it didn't help. The server didn't return > >> the message above, but the administrative console show error dialog. > >> > >> What error? > >> > > I tried it again and the error message is exactly: > > > > Error fading object 'dn: dc=example, dc=com'. > > The error send by the server was: > > ". > > > > In the Whireshark log was still the search request witch control: > > 2.16.840.1.113730.3.4.2 > > > > Why is this control needed by the server when I removed it from > Database link settings? > > > I'm not sure - maybe the console is not working correctly. Try this: > 1) Shutdown the server > 2) cd /etc/dirsrv/slapd-yourinstance > 3) edit dse.ldif - look for the entry > dn: cn=config,cn=chaining database,cn=plugins,cn=config > 4) edit the nsTransmittedControls attribute - remove > 2.16.840.1.113730.3.4.2 > 5) save and restart the server I looked into dse.ldif for a nsTransmittedControls attribute. There is only the 1.3.6.1.4.1.1466.29539.12. , not the problematic 2.16.840.1.113730.3.4.2. Isn't the 2.16.840.1.113730.3.4.2 hardcoded? Why is this so necessary? > > > >>>> Michal Rejda wrote: > >>>> > >>>> > >>>>> Hi all, > >>>>> > >>>>> Im trying to setup proxy on FDS to another LDAP server (OpenLDAP > >>>>> and Active Directory). I tried two ways, but none of these works: > >>>>> > >>>>> 1) New database link to LDAP server. > >>>>> > >>>>> - The remote LDAP server (OpenLDAP) returns: null. manageDSAit > >>>>> > >>>>> > >>>> control > >>>> > >>>> > >>>>> value not found > >>>>> > >>>>> > >>>>> > >>>> You might have to tweak the controls used by chaining - see > >>>> http://tinyurl.com/culeft > >>>> > >>>> > >>>>> 2) Create multiple-master replication and setup other server as > >>>>> > >>>>> > >>>> consumer. > >>>> > >>>> > >>>>> - But this show error: 255 Replication error acquiring replica: > >>>>> unknown error. > >>>>> > >>>>> > >>>>> > >>>> Replication will only work to a SunDS, not to any other vendor. > >>>> > >>>> > >>>>> My question is: Is there way how to setup proxy to access another > >>>>> > >>>>> > >>>> LDAP > >>>> > >>>> > >>>>> server from Fedora DS? I know that is possible to use AD sync, > but > >>>>> > >> I > >> > >>>>> cannot install anything on the AD server. The second reason why I > >>>>> > >>>>> > >>>> need > >>>> > >>>> > >>>>> to setup proxy is to use data stored in LDAP server (OpenLDAP, > >>>>> Open Direcoty Server and Active Directory) in one place. I need > to > >>>>> > >> update > >> > >>>>> them too. It is not necessary to synchronize passwords. > >>>>> > >>>>> > >>>>> > >>>> See also > >>>> http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration > >>>> > >>>> > >>>>> Thank you for reply. > >>>>> > >>>>> Regards, > >>>>> > >>>>> Michal > >>>>> > >>>>>

2 1

RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda 15 Apr '09

15 Apr '09

> -----Original Message----- > From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora- > directory-users-bounces(a)redhat.com] On Behalf Of Rich Megginson > Sent: Tuesday, April 14, 2009 4:25 PM > To: General discussion list for the Fedora Directory server project. > Subject: Re: [Fedora-directory-users] LDAP proxy > > Michal Rejda wrote: > > I tried to use http://tinyurl.com/culeft. But the database link > doesn't work. I setup the database link to the Active Directory (and > OpenLDAP). When I looked into Wireshark log, FDS send search request > with controls: > > 2.16.840.1.113730.3.4.2 > > 2.16.840.1.113730.3.4.12 > > And the AD server responded: Unavailable Critical Extension. > > > > I tried to remove this two controls from Database Link Settings (in > administration console) but it didn't help. The server didn't return > the message above, but the administrative console show error dialog. > > > What error? I tried it again and the error message is exactly: Error fading object 'dn: dc=example, dc=com'. The error send by the server was: ". In the Whireshark log was still the search request witch control: 2.16.840.1.113730.3.4.2 Why is this control needed by the server when I removed it from Database link settings? > > > >> Michal Rejda wrote: > >> > >>> Hi all, > >>> > >>> Im trying to setup proxy on FDS to another LDAP server (OpenLDAP > >>> and Active Directory). I tried two ways, but none of these works: > >>> > >>> 1) New database link to LDAP server. > >>> > >>> - The remote LDAP server (OpenLDAP) returns: null. manageDSAit > >>> > >> control > >> > >>> value not found > >>> > >>> > >> You might have to tweak the controls used by chaining - see > >> http://tinyurl.com/culeft > >> > >>> 2) Create multiple-master replication and setup other server as > >>> > >> consumer. > >> > >>> - But this show error: 255 Replication error acquiring replica: > >>> unknown error. > >>> > >>> > >> Replication will only work to a SunDS, not to any other vendor. > >> > >>> My question is: Is there way how to setup proxy to access another > >>> > >> LDAP > >> > >>> server from Fedora DS? I know that is possible to use AD sync, but > I > >>> cannot install anything on the AD server. The second reason why I > >>> > >> need > >> > >>> to setup proxy is to use data stored in LDAP server (OpenLDAP, Open > >>> Direcoty Server and Active Directory) in one place. I need to > update > >>> them too. It is not necessary to synchronize passwords. > >>> > >>> > >> See also > >> http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration > >> > >>> Thank you for reply. > >>> > >>> Regards, > >>> > >>> Michal > >>> > >>> > > > > > > > > -- > > Fedora-directory-users mailing list > > Fedora-directory-users(a)redhat.com > > https://www.redhat.com/mailman/listinfo/fedora-directory-users > > >

2 1

[Fedora-directory-users] Installation error
by Samuel Germain 15 Apr '09

15 Apr '09

Hello, I am trying to install Fedora Directory Server on Fedora Core 10 but the last step of the installation is going wrong. The log file is following below Anybody can help me ? Thanks a lot Best regards * [09/04/15:18:49:53] - [Setup] Info Would you like to continue? [09/04/15:18:50:18] - [Setup] Info yes [09/04/15:18:50:18] - [Setup] Info Choose a setup type: 1. Express Allows you to quickly set up the servers using the most common options and pre-defined defaults. Useful for quick evaluation of the products. 2. Typical Allows you to specify common defaults and options. 3. Custom Allows you to specify more advanced options. This is recommended for experienced server administrators only. To accept the default shown in brackets, press the Enter key. [09/04/15:18:50:18] - [Setup] Info Choose a setup type [09/04/15:18:50:19] - [Setup] Info 2 [09/04/15:18:50:19] - [Setup] Info Enter the fully qualified domain name of the computer on which you're setting up server software. Using the form <hostname>.<domainname> Example: eros.example.com. To accept the default shown in brackets, press the Enter key. [09/04/15:18:50:20] - [Setup] Info Computer name [09/04/15:18:50:22] - [Setup] Info localhost.fr [09/04/15:18:50:22] - [Setup] Info The servers must run as a specific user in a specific group. It is strongly recommended that this user should have no privileges on the computer (i.e. a non-root user). The setup procedure will give this user/group some permissions in specific paths/files to perform server-specific operations. If you have not yet created a user and group for the servers, create this user and group using your native operating system utilities. [09/04/15:18:50:22] - [Setup] Info System User [09/04/15:18:50:26] - [Setup] Info samuel [09/04/15:18:50:26] - [Setup] Info System Group [09/04/15:18:50:28] - [Setup] Info samuel [09/04/15:18:50:28] - [Setup] Info Server information is stored in the configuration directory server. This information is used by the console and administration server to configure and manage your servers. If you have already set up a configuration directory server, you should register any servers you set up or create with the configuration server. To do so, the following information about the configuration server is required: the fully qualified host name of the form <hostname>.<domainname>(e.g. hostname.example.com), the port number (default 389), the suffix, the DN and password of a user having permission to write the configuration information, usually the configuration directory administrator, and if you are using security (TLS/SSL). If you are using TLS/SSL, specify the TLS/SSL (LDAPS) port number (default 636) instead of the regular LDAP port number, and provide the CA certificate (in PEM/ASCII format). If you do not yet have a configuration directory server, enter 'No' to be prompted to set up one. [09/04/15:18:50:28] - [Setup] Info Do you want to register this software with an existing configuration directory server? [09/04/15:18:50:32] - [Setup] Info no [09/04/15:18:50:32] - [Setup] Info Please enter the administrator ID for the configuration directory server. This is the ID typically used to log in to the console. You will also be prompted for the password. [09/04/15:18:50:32] - [Setup] Info Configuration directory server administrator ID [09/04/15:18:50:34] - [Setup] Info admin [09/04/15:18:50:34] - [Setup] Info Password [09/04/15:18:50:37] - [Setup] Info Password (confirm) [09/04/15:18:50:39] - [Setup] Info The information stored in the configuration directory server can be separated into different Administration Domains. If you are managing multiple software releases at the same time, or managing information about multiple domains, you may use the Administration Domain to keep them separate. If you are not using administrative domains, press Enter to select the default. Otherwise, enter some descriptive, unique name for the administration domain, such as the name of the organization responsible for managing the domain. [09/04/15:18:50:39] - [Setup] Info Administration Domain [09/04/15:18:50:41] - [Setup] Info fr [09/04/15:18:50:41] - [Setup] Info The standard directory server network port number is 389. However, if you are not logged as the superuser, or port 389 is in use, the default value will be a random unused port number greater than 1024. If you want to use port 389, make sure that you are logged in as the superuser, that port 389 is not in use. [09/04/15:18:50:41] - [Setup] Info Directory server network port [09/04/15:18:50:44] - [Setup] Info 389 [09/04/15:18:50:44] - [Setup] Info Each instance of a directory server requires a unique identifier. This identifier is used to name the various instance specific files and directories in the file system, as well as for other uses as a server instance identifier. [09/04/15:18:50:44] - [Setup] Info Directory server identifier [09/04/15:18:50:46] - [Setup] Info localhost [09/04/15:18:50:46] - [Setup] Info The suffix is the root of your directory tree. The suffix must be a valid DN. It is recommended that you use the dc=domaincomponent suffix convention. For example, if your domain is example.com, you should use dc=example,dc=com for your suffix. Setup will create this initial suffix for you, but you may have more than one suffix. Use the directory server utilities to create additional suffixes. [09/04/15:18:50:46] - [Setup] Info Suffix [09/04/15:18:50:48] - [Setup] Info dc=fr [09/04/15:18:50:48] - [Setup] Info Certain directory server operations require an administrative user. This user is referred to as the Directory Manager and typically has a bind Distinguished Name (DN) of cn=Directory Manager. You will also be prompted for the password for this user. The password must be at least 8 characters long, and contain no spaces. Press Control-B or type the word "back", then Enter to back up and start over. [09/04/15:18:50:48] - [Setup] Info Directory Manager DN [09/04/15:18:50:49] - [Setup] Info cn=Directory Manager [09/04/15:18:50:49] - [Setup] Info Password [09/04/15:18:50:57] - [Setup] Info Password (confirm) [09/04/15:18:51:05] - [Setup] Info The Administration Server is separate from any of your web or application servers since it listens to a different port and access to it is restricted. Pick a port number between 1024 and 65535 to run your Administration Server on. You should NOT use a port number which you plan to run a web or application server on, rather, select a number which you will remember and which will not be used for anything else. [09/04/15:18:51:05] - [Setup] Info Administration port [09/04/15:18:51:08] - [Setup] Info 9830 [09/04/15:18:51:08] - [Setup] Info The interactive phase is complete. The script will now set up your servers. Enter No or go Back if you want to change something. [09/04/15:18:51:08] - [Setup] Info Are you ready to set up your servers? [09/04/15:18:51:10] - [Setup] Info yes [09/04/15:18:51:10] - [Setup] Info Creating directory server . . . [09/04/15:18:51:13] - [Setup] Info Your new DS instance 'localhost' was successfully created. [09/04/15:18:51:13] - [Setup] Info Creating the configuration directory server . . . [09/04/15:18:54:22] - [Setup] Fatal Error: failed to open an LDAP connection to host 'localhost.fr' port '389' as user 'cn=Directory Manager'. Error: unknown. [09/04/15:18:54:22] - [Setup] Fatal Failed to create the configuration directory server [09/04/15:18:54:22] - [Setup] Fatal Exiting . . . Log file is '/tmp/setupZf31Ze.log'*

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2009