389-users July 2009

389-users@lists.fedoraproject.org

56 participants
67 discussions

memberOf task problem
by John A. Sullivan III 18 Dec '09

18 Dec '09

Hello, all. We are in the process of upgrading from 8.0 to 8.1. We've hit a few glitches along the way but most has gone well. However, we wanted to implement the new memberOf functionality. We successfully added the plugin by editing dse.ldif and enabled it from the console. However, we've been unsuccessful in having existing group membership assigned to the memberOf attribute. We first tried to run fixup-memberOf.pl but the script does not exist. There is a template.fixup-memberOf.pl but this does not seem to have been built into a final script. We then thought we would use the new task feature of the console. We went to cn=memberof task,cn=tasks,cn=config and tried to create the task object. There was no nsDirectoryServerTask objectclass. We added an nstask but then found there was no basedn attribute we could add. We then created an extensibleobject instead but still not basedn attribute. Finally, we resorted to ldapmodify (we hesitated just because we are not very familiar with the command line tools). First, we did: dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config changetype: add objectclass: top objectclass: extensibleObject cn: fixMemberOf basedn: o=Internal,dc=ssiservices,dc=biz The Internal Organization has several organizations under it (for various clients) and then user organizational units under those organizations. Although it generated no errors, it did not seem to work. Perhaps I just don't know how to test it. However, the following did not return an memberOf data: /usr/lib64/mozldap/ldapsearch -b "ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory Manager" -w - -h ldap uid=myid memberOf Doing /usr/lib64/mozldap/ldapsearch -b "ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory Manager" -w - -h ldap uid=myid showed me plenty of attributes but nothing for memberOf I also tried creating the task with a basedn of ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz in case it did not change objects lower in the tree. Still no success. Finally I tried: dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config changetype: add objectclass: top objectclass: nsDirectoryServerTask cn: fixMemberOf basedn: o=Internal,dc=ssiservices,dc=biz adding new entry cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config ldap_add: Object class violation ldap_add: additional info: unknown object class "nsDirectoryServerTask" And received the expected unknown object class error. What are we doing wrong? Are these documentation bugs? Are there application bugs or do we simply not know what we are doing with tasks and memberOf? How do we get the memberOf information into our existing user objects? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

5 13

OpenLDAP as a slave of Fedora Directory Server?
by Anne (juniper) Cross 09 Aug '09

09 Aug '09

I've been through the FDS/389 website, and the best I've come up with is this: http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration Unfortunately, that gives me the sync in the wrong direction. We have pre-existing OpenLDAP servers that belong to a different group. We're supposed to be their ultimate source of data - once we get set up - but they won't change their servers from OpenLDAP because, as they say, they know how they work and why should they do more work. I don't need data synced back from OpenLDAP, but syncrepl doesn't appear to do the right thing when pointed at an FDS directory server, so what's the secret, undocumented method? Even a hint would help. Google just keeps turning up pages where people have named their box "Fedora" and it's all openldap to openldap. -- ,___, {o,o} Anne "Juniper" Cross (___) Senior Linux Systems Engineer and Extropic Crusader -"-"-- Information Technology, ITA Software /^^^

5 5

Supported Extension
by Techie 04 Aug '09

04 Aug '09

Greetings all, Is it possible to add the supportedExtension: 1.3.6.1.4.1.4203.1.11.1 to the 389 Directory server? Thank you

3 4

Samba integration with FDS and Heartbeat for HA Samba
by David Christensen 02 Aug '09

02 Aug '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I successfully setup heartbeat and glusterfs (instead of DRBD) to provide an HA Samba configuration. I tested that fail over worked fine all the existing computers were able to get to their shares and re authenticate users. However I discovered that I was not able to join computers to the domain after the configuration was setup. The netbios name was changed to accommodate the new heartbeat VIP and the new VIP is the only address I have samba bound to. When I go to add the computer to the domain, type to the domain in and hit enter, I am presented with a login dialog box. When I enter the admin and password and hit enter, after a few seconds I get the warning that a controller for the domain could not be foumd. I suspect that there is some caching going on and (maybe) winbind is using the old info for the PDC and not the new? Are there any caches I could clear that may fix this? Am I on the right track or is there somethign else I should be looking at? When I compare the ldap access logs with and without heartbeat, there is a difference in the query. As I previously mentioned, without heartbeat, adding is successful, with heartbeat it is not. I found that the search base is different: With heartbeat - SRCH base="cn=groups,cn=accounts,dc=example,dc=com" scope=2 filter="(&(objectClass=sambaGroupMapping)(gidNumber=99))" attrs="gidNumber sambaSID sambaGroupType sambaSIDList description displayName cn objectClass" W/heartbeat - SRCH base="sambaDomainName=exampleHQ,sambaDomainName=exampleHQ,dc=example,dc=com" scope=2 filter="(&(objectClass=sambaTrustedDomainPassword)(sambaDomainName=exampleHQ))" attrs=ALL When I compared the logs when executing pdbedit -Lv with both setups, the queries are the same. Why would samba do a different query to the same instance of ldap when configured with heartbeat and without heartbeat? The address that samba is binding to/from for access to ldap is not the VIP provided by heartbeat. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org iEYEARECAAYFAkpzTW4ACgkQ5B+8XEnAvqub1ACdGFBhVRaePH0fuTD0mORGIMgB V48AnR0znBY9KD3nhYYdPtR2dQXUWxBO =jrTm -----END PGP SIGNATURE-----

2 1

Re: [389-users] Chaining and LDAP_UNWILLING_TO_PERFORM problem
by Roberto Polli 31 Jul '09

31 Jul '09

On Wednesday 29 July 2009 18:35:56 you wrote: > Roberto Polli wrote: > > On Wednesday 29 July 2009 18:09:17 Rich Megginson wrote: > >> Does this give any useful information? > >> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Configuring_Directo > >>ry_ > >> Databases-Creating_and_Maintaining_Database_Links.html#Creating_and_Main > >>tain ing_Database_Links-Database_Links_and_Access_Control_Evaluation > > > > I read it more than once..made some slides too > > http://docs.google.com/present/view?id=dd4mpk7p_10366hxdsmn > > > > nonethless I may have made some mistake. > > > > what I didn't understood is why - when updating userPassword - the remote > > server states that > > > >> NSACLPlugin - proxied authorization dn is () > > > > instead of > > > >> NSACLPlugin - proxied authorization dn is (uid=u1,ou=serv > >> ice administrators,dc=babel,dc=it) > > > > hope this could clarify a bit my problem.. > > Are you using the ldappasswd command to update the password? ldapmodify: dn: uid=pippo,dc=example,dc=com changetype: modify replace: userPassword userPassword: pippo1242102d32d322d8321p8enxnc093212190cx321 > You may have to allow that component to chain. > http://www.redhat.com/docs/manuals/dir-server/8.1/admin/Configuring_Directo >ry_Databases-Creating_and_Maintaining_Database_Links.html#Configuring_the_Ch >aining_Policy-Chaining_Component_Operations Even if I don't use SASL, anyway I enabled chaining of PasswordPolicy controls, but nothing changes. .. but..is it right that in aclplugin.c the function acl_get_proxyauth_dn( pb, &proxy_dn, &errtext ) returns proxy_dn = "" ? Peace, R. -- Roberto Polli Babel S.r.l. - http://www.babel.it Tel. +39.06.91801075 - fax +39.06.91612446 Tel. cel +39.340.6522736 P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma) "Il seguente messaggio contiene informazioni riservate. Qualora questo messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto della legge in materia di protezione dei dati personali."

2 5

Multimaster upgrade issues
by DANIEL CRISTIAN CRUZ 30 Jul '09

30 Jul '09

Hi all, Does someone had problems upgrading a cluster with 2 multi-master servers and several consumers? We are planning a upgrade, first one master, than the other. Consumers will be upgraded eventually. Is the aproach correct? Regards, Daniel Cruz

1 0

Db-link setup question
by Reinhard Nappert 29 Jul '09

29 Jul '09

Hi, I have two LDAP Servers setup (Server A and Server B). Both of them have the identical suffix (o=suffix). Again, both of them have a people organizational unit (ou=people,o=suffix). Server B has a big subtree (ou=region B,ou=people,o=suffix). My intension is to create a db link on Server A, which links to the ou=region B,ou=people,o=suffix subtree on Server B. I did create the database link and a new suffix l=location B,ou=people,o=suffix on Server A with the following entries: dn: cn=serverBlink,cn=chaining database,cn=plugins,cn=config objectclass: top objectclass: extensibleObject objectclass: nsBackendInstance nsslapd-suffix: ou=region B,ou=people,o=suffix nsfarmserverurl: ldap://serverB:389/ nsmultiplexorbinddn: cn=proxy admin,cn=config nsmultiplexorcredentials: secret cn: serverBlink dn: cn="l=location B,ou=people,o=suffix",cn=mapping tree,cn=config objectclass: top objectclass: extensibleObject objectclass: nsMappingTree nsslapd-state: backend nsslapd-backend: serverBlink nsslapd-parent-suffix: "ou=people,o=suffix " cn: "l=location B,ou=people,o=suffix" I am only interested in reading the server B information, when accessing from server A. The "proxy admin" user was created as well. When I do a search with the base l=location B,ou=people,o=suffix, accessing server A, I always get the following error "Proxy dn should not be rootdn". What did I miss for the setup? Thanks, -Reinhard

2 10

using tasks question
by Techie 29 Jul '09

29 Jul '09

Hello, I am looking to automate some things with cn=tasks?. I have read the Task invocation info but no nsdirectoryservertask objectclass exists even in the source from what I see.Where can I get the schema file with this O class? Thank you

2 2

cache settings
by Nick Gresham 29 Jul '09

29 Jul '09

Hi All I'm looking for some clarification (best practices) on setting cache sizes for Fedora DS. What is the difference between the maximum cache size under LDBM Plug-in settings tab and the cache size under individual backends' Database Settings tab? http://directory.fedoraproject.org/wiki/Performance_Tuning gives some reference to disk cache and memory cache differences but I've been unable to find further references. Thanks Nick

2 1

Chaining and LDAP_UNWILLING_TO_PERFORM problem
by Giovanni Mancuso 29 Jul '09

29 Jul '09

Hi, i try to configure 2 Directory Server with db link. I have first DS that point to second DS that have DB in filesystem. I create a proxy user in second DS: # tproxy, config dn: uid=tproxy,cn=config uid: tproxy givenName: test objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson sn: proxy cn: test proxy userPassword:: ********************************************* and i create in first DS the "Dababase link" that use this user to bind in second DS. In second DS i add the following aci: (targetattr = "*") (target = "ldap:///dc=example,dc=com") (version 3.0;acl "AciChepermettetutto";allow (all)(userdn = "ldap:///uid=tproxy,cn=config");) (targetattr = "*") (target = "ldap:///dc=example,dc=com") (version 3.0;acl "proxy acl";allow (proxy)(userdn = "ldap:///uid=tproxy,cn=config");) Bu if i try to execute the ldapserach in first directory server i have the following error: dapsearch -h localhost -x -p 20389 -D "cn=Directory Manager" -w ********* -b "dc=example,dc=com" "(objectclass=*)" # extended LDIF # # LDAPv3 # base <dc=example,dc=com> with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 53 Server is unwilling to perform text: Proxy dn should not be rootdn # numResponses: 1 If i enable verbose logging in my error log i have: [15/Jul/2009:18:44:47 +0200] - activity on 65r [15/Jul/2009:18:44:47 +0200] - => slapi_reslimit_get_integer_limit() conn=0xb1557d68, handle=3 [15/Jul/2009:18:44:47 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [15/Jul/2009:18:44:47 +0200] - read activity on 65 [15/Jul/2009:18:44:47 +0200] - add_pb [15/Jul/2009:18:44:47 +0200] - => slapi_reslimit_get_integer_limit() conn=0xb1557c08, handle=3 [15/Jul/2009:18:44:47 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [15/Jul/2009:18:44:47 +0200] - get_pb [15/Jul/2009:18:44:47 +0200] - conn 1 activity level = 2 [15/Jul/2009:18:44:47 +0200] - conn 1 turbo rank = 2 out of 3 conns [15/Jul/2009:18:44:47 +0200] - do_search [15/Jul/2009:18:44:47 +0200] - => get_filter_internal [15/Jul/2009:18:44:47 +0200] - PRESENT [15/Jul/2009:18:44:47 +0200] - <= get_filter_internal 0 [15/Jul/2009:18:44:47 +0200] get_filter - before optimize: (objectClass=*) [15/Jul/2009:18:44:47 +0200] get_filter - after optimize: (objectClass=*) [15/Jul/2009:18:44:47 +0200] - SRCH base="dc=example,dc=com" scope=2 deref=0 sizelimit=0 timelimit=0 attrsonly=0 filter="(objectClass=*)" attrs=ALL [15/Jul/2009:18:44:47 +0200] - => get_ldapmessage_controls [15/Jul/2009:18:44:47 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.2) [15/Jul/2009:18:44:47 +0200] - <= slapi_control_present 0 (NOT FOUND) [15/Jul/2009:18:44:47 +0200] - => slapi_control_present (looking for 1.3.6.1.4.1.42.2.27.8.5.1) [15/Jul/2009:18:44:47 +0200] - <= slapi_control_present 0 (NOT FOUND) [15/Jul/2009:18:44:48 +0200] - <= get_ldapmessage_controls 2 controls [15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.3) [15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 0 (NOT FOUND) [15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.20) [15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 0 (NOT FOUND) [15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.14) [15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 0 (NOT FOUND) [15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for 1.3.6.1.4.1.42.2.27.9.5.2) [15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 0 (NOT FOUND) [15/Jul/2009:18:44:48 +0200] - mapping tree selected backend : example [15/Jul/2009:18:44:48 +0200] - => slapi_reslimit_get_integer_limit() conn=0xb1557cb8, handle=2 [15/Jul/2009:18:44:48 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [15/Jul/2009:18:44:48 +0200] - => slapi_reslimit_get_integer_limit() conn=0xb1557cb8, handle=1 [15/Jul/2009:18:44:48 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [15/Jul/2009:18:44:48 +0200] - => compute_limits: sizelimit=2000, timelimit=3600 [15/Jul/2009:18:44:48 +0200] - Calling plugin 'ACL preoperation' #1 type 403 [15/Jul/2009:18:44:48 +0200] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.12) [15/Jul/2009:18:44:48 +0200] - <= slapi_control_present 1 (FOUND) [15/Jul/2009:18:44:48 +0200] - => send_ldap_result 53::Proxy dn should not be rootdn [15/Jul/2009:18:44:48 +0200] - flush_ber() wrote 43 bytes to socket 65 [15/Jul/2009:18:44:48 +0200] - <= send_ldap_result [15/Jul/2009:18:44:48 +0200] - mapping tree release backend : example [15/Jul/2009:18:44:48 +0200] - slapi_filter_free type 0x87 [15/Jul/2009:18:44:49 +0200] - => slapi_reslimit_get_integer_limit() conn=0xb1557d68, handle=3 [15/Jul/2009:18:44:49 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [15/Jul/2009:18:44:49 +0200] - => slapi_reslimit_get_integer_limit() conn=0xb1557cb8, handle=3 [15/Jul/2009:18:44:49 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [15/Jul/2009:18:44:49 +0200] - => slapi_reslimit_get_integer_limit() conn=0xb1557c08, handle=3 [15/Jul/2009:18:44:49 +0200] - <= slapi_reslimit_get_integer_limit() returning NO VALUE [15/Jul/2009:18:44:49 +0200] - listener got signaled [15/Jul/2009:18:44:53 +0200] - Event id a19b958 called at 1247676293 (scheduled for 1247676293) [15/Jul/2009:18:44:55 +0200] - ldbm backend flushing [15/Jul/2009:18:44:55 +0200] - ldbm backend done flushing [15/Jul/2009:18:44:55 +0200] - ldbm backend flushing [15/Jul/2009:18:44:55 +0200] - ldbm backend done flushing The problem seems the "ACL preoperation" plugin. Indeed if i disable this plugin, it WORKS. But i cannot disable this plugin. Any ideas to solve the problem?? Thanks and sorry in advance for my bad English //

3 12

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2009