389-users October 2010

389-users@lists.fedoraproject.org

37 participants
47 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

Severe dn corruption
by Edward Z. Yang 01 Nov '10

01 Nov '10

Hello, Last evening we experienced server corruption inside our replicated prefix. Three users got moved from ou=People,dc=scripts,dc=mit,dc=edu to dc=scripts, and another user got moved from ou=People,dc=scripts to ou=People,ou=People,dc=scripts. We also couldn't fix it because it claimed that the correct DN existed. We also saw replication conflicts using , as the thing after nsuniqueid instead of +. Please advise. Cheers, Edward P.S. Our dirsrvs have been crashing and segfaulting because of the GSSAPI bugs, so if you want to blame it on that, ok, though dirsrv should not be corrupting data when it gets interrupted.

3 2

Several root suffixes
by Andreas Andersson 01 Nov '10

01 Nov '10

Hi! Is 389 DS working fine using 5 - 10 root suffixes? I know its not very common as you usually only need one root suffix for your organization. The reason why I'm asking is that I want to consolidate several test environments into one single LDAP environment. I know its possible in 389 but are there any technical issues or limitations I might run into doing this? Regards - Andreas

2 1

In need of Storing Cleartext Password
by Uzor Ide 29 Oct '10

29 Oct '10

Hi we have a need for 389 directory to store password in clear text, in given subtree. I have used the console to configure password policy and chose CLEAR for the encryption scheme under passwordStorageScheme, yet the passwords are still SSHA encrypted. Is there any other thing that I should do. # entry-id: 11 dn: cn=users,cn=subscribers,dc=ourcompany,dc=com objectClass: top objectClass: nsContainer cn: users # entry-id: 14 dn: cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany,dc=com objectClass: nsContainer objectClass: top cn: nsPwPolicyContainer # entry-id: 15 dn: cn=cn\3DnsPwPolicyEntry\2Ccn\3Dusers\2Ccn\3Dsubscribers\2Cdc\3Dourcompany\2Cdc\ 3Dcom,cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany,dc=com objectClass: ldapsubentry objectClass: passwordpolicy objectClass: top cn: cn=nsPwPolicyEntry,cn=users,cn=subscribers,dc=ourcompany,dc=com passwordMustChange: off passwordExp: off passwordHistory: on passwordMinAge: 0 passwordChange: off passwordStorageScheme: clear passwordInHistory: 3 passwordLockout: on passwordLockoutDuration: 21600 passwordResetFailureCount: 1800 passwordUnlock: on passwordMaxFailure: 3 # entry-id: 16 dn: cn=cn\3DnsPwTemplateEntry\2Ccn\3Dusers\2Ccn\3Dsubscribers\2Cdc\3Dourcompany\2Cd c\3Dcom,cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany,dc=com objectClass: extensibleObject objectClass: costemplate objectClass: ldapsubentry objectClass: top cosPriority: 1 pwdpolicysubentry: cn=cn\3DnsPwPolicyEntry\2Ccn\3Dusers\2Ccn\3Dsubscribers\2Cdc\3 Dourcompany\2Cdc\3Dcom,cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany ,dc=com cn: cn=nsPwTemplateEntry,cn=users,cn=subscribers,dc=ourcompany,dc=com # entry-id: 17 dn: cn=nsPwPolicy_CoS,cn=users,cn=subscribers,dc=ourcompany,dc=com objectClass: ldapsubentry objectClass: cosSuperDefinition objectClass: cosPointerDefinition objectClass: top costemplatedn: cn=cn\3DnsPwTemplateEntry\2Ccn\3Dusers\2Ccn\3Dsubscribers\2Cdc\3Do urcompany\2Cdc\3Dcom,cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany,d c=com cosAttribute: pwdpolicysubentry default operational-default cn: nsPwPolicy_CoS # entry-id: 18 dn: uid=testuser,cn=users,cn=subscribers,dc=ourcompany,dc=com givenName: U-da-man uidNumber: 501 gidNumber: 501 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: account objectClass: radiusprofile uid: testuser userPassword: {SSHA}HBk8h1pkgsUocxUgPF+HNeuHF1LgYaI99co6Aw== radiusFramedMTU: 1400 radiusGroupName: local radiusHuntgroupName: vpn.ourcompany.com radiusRealm: vpn.ourcompany.com radiusServiceType: Framed-User radiusFilterId: std.ppp passwordGraceUserTime: 0 dialupAccess: yes There is also an attribute pwdpolicysubentry: cn=cn\3DnsPwPolicyEntry\2Ccn\3Dusers\2Ccn\3Daccounts\2Cdc\3Dourcompany\2Cdc\3Dcom,cn=nsPwPolicyContainer,cn=users,cn=accounts,dc=ourcompany,dc=com that shows up in the testuser's profile from the console that does not show up in the ldif dump. Please help I have followed the documentation Redhat directory 8.2 thanks

2 2

Announcing 389 Directory Server 1.2.7 Alpha 3 for testing
by Rich Megginson 29 Oct '10

29 Oct '10

The 389 team is pleased to announce the availability for testing of Alpha 3 of version 1.2.7. This release contains some new features as well as many bug fixes. On those platforms which have OpenLDAP built with Mozilla NSS crypto support (Fedora 14 and later), the packages are built with OpenLDAP instead of the Mozilla LDAP C SDK. WARNING: If you are upgrading from a previous 1.2.6 release candidate, you will need to run fixfiles to fix some SELinux AVCs, or directory server will not start. See bug https://bugzilla.redhat.com/show_bug.cgi?id=622882 To fix, run this: fixfiles -R 389-ds-base restore If you are upgrading from 1.2.5 or earlier, or a stable 1.2.6, there is no problem. WARNING: If you are upgrading from a 1.2.6 alpha or release candidate, you will need to manually fix your entryrdn index files. See http://port389.org/wiki/Subtree_Rename#warning:_upgrade_from_389_v1.2.6_.28… for more information. If you are upgrading from 1.2.5 or earlier, or a 1.2.6 stable release, there is no problem. The new packages and versions are: * 389-ds-base 1.2.7.a3 * 389-admin 1.1.12.a2 * 389-adminutil 1.1.13 * 389-dsgw 1.1.6 * perl-Mozilla-LDAP 1.5.3 (Fedora 14 and later) ***We need your help! Please help us test this software.*** It is an Alpha release, so it may have a few glitches, but it has been tested for regressions and for new feature bugs. The Fedora system requires that packages go into Testing until verified and pushed to Stable. The more testing we get, the faster we can release these packages to Stable. See the Release Notes for information about how to provide testing feedback (or just send an email to 389-users(a)lists.fedoraproject.org). === Installation === yum install --enablerepo=[updates-testing|epel-testing] 389-ds setup-ds-admin.pl === Upgrade === yum upgrade --enablerepo=[updates-testing|epel-testing] 389-ds-base 389-admin 389-adminutil 389-dsgw perl-Mozilla-LDAP setup-ds-admin.pl -u === New features === * On Fedora 14 and later, the 389 packages are built with OpenLDAP instead of Mozilla LDAP * Account Policy - keep track of last login, automatically disable unused accounts * The replication changelog has been moved into the main server database environment * Member Of supports multiple membership attributes === Bugs Fixed === This release contains many bug fixes. The complete list of bugs fixed is found at the link below. Note that bugs marked as MODIFIED have been fixed but are still in testing. * Bug List for 389 1.2.7 https://bugzilla.redhat.com/showdependencytree.cgi?id=576869&hide_resolved=1 * Release Notes - http://port389.org/wiki/Release_Notes * Install_Guide - http://port389.org/wiki/Install_Guide * Download - http://port389.org/wiki/Download

1 0

What are people using to manager user accounts?
by Orion Poplawski 28 Oct '10

28 Oct '10

I'd be very interested to know what tools people are using to manage user accounts in the directory server. Currently we are using a modified version of fdstools because we have a Posix + Samba environment, but would be interested in other solutions that may be out there. Thanks! -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA/CoRA Division FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com

3 2

DSGW SELinux issues
by Orion Poplawski 27 Oct '10

27 Oct '10

Running on CentOS 5.4, get: type=AVC msg=audit(1288197048.706:347260): avc: denied { execute_no_trans } for pid=1388 comm="httpd.worker" path="/usr/lib/dirsrv/dsgw-cgi-bin/lang" dev=dm-4 ino=225129 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file Looks like these are mislabeled: [root@earth admin-serv]# ls -Z /usr/lib/dirsrv/cgi-bin -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t admpw -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t config -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t download -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t dsconfig -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_create -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_listdb -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_remove -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_restart -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_shutdown -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_snmpctrl -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_start -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_unregister -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t help -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t htmladmin -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t monreplication -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ReadLog -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t repl-monitor-cgi.pl -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t restartsrv -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t sec-activate -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t security -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t start_config_ds -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t statpingserv -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t statusping -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t stopsrv -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ugdsconfig -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t viewdata -rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t viewlog [root@earth admin-serv]# ls -Z /usr/lib/dirsrv/dsgw-cgi-bin -rwxr-xr-x root root system_u:object_r:lib_t auth -rwxr-xr-x root root system_u:object_r:lib_t csearch -rwxr-xr-x root root system_u:object_r:lib_t dnedit -rwxr-xr-x root root system_u:object_r:lib_t doauth -rwxr-xr-x root root system_u:object_r:lib_t domodify -rwxr-xr-x root root system_u:object_r:lib_t dosearch -rwxr-xr-x root root system_u:object_r:lib_t edit -rwxr-xr-x root root system_u:object_r:lib_t lang -rwxr-xr-x root root system_u:object_r:lib_t myorg -rwxr-xr-x root root system_u:object_r:lib_t newentry -rwxr-xr-x root root system_u:object_r:lib_t org -rwxr-xr-x root root system_u:object_r:lib_t search -rwxr-xr-x root root system_u:object_r:lib_t tutor -rwxr-xr-x root root system_u:object_r:lib_t unauth 389-admin-1.1.11-1.el5 389-admin-console-1.1.5-1.el5 389-admin-console-doc-1.1.5-1.el5 389-adminutil-1.1.8-4.el5 389-console-1.1.4-1.el5 389-ds-1.2.1-1.el5 389-ds-base-1.2.6.1-2.el5 389-ds-console-1.2.3-1.el5 389-ds-console-doc-1.2.3-1.el5 389-dsgw-1.1.5-1.el5 File a bug? -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA/CoRA Division FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com

2 1

389-console jar issues
by Orion Poplawski 27 Oct '10

27 Oct '10

It appears that my 389-console is trying to get /java/jars/389-admin-1.1.jar to access the admin server and /java/jars/389-ds-1.2.3.jar to access the directory server, but the jar files are in /java/ not /java/jars. 389-admin-1.1.11-1.el5 389-admin-console-1.1.5-1.el5 389-admin-console-doc-1.1.5-1.el5 389-adminutil-1.1.8-4.el5 389-console-1.1.4-1.el5 389-ds-1.2.1-1.el5 389-ds-base-1.2.6.1-2.el5 389-ds-console-1.2.3-1.el5 389-ds-console-doc-1.2.3-1.el5 389-dsgw-1.1.5-1.el5 -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA/CoRA Division FAX: 303-415-9702 3380 Mitchell Lane orion(a)cora.nwra.com Boulder, CO 80301 http://www.cora.nwra.com

1 3

can 389 DS server 1.1 be configured this way?
by Mike Li 27 Oct '10

27 Oct '10

Can I configure the 389 DS server 1.1 to change its returning error codes? i.e. can I *configure* it so that it returns LDAP_NO_SUCH_OBJECT (0x20) instead of LDAP_INVALID_DN_SYNTAX (0x22) to client, when it receives client's searching string with an invalid DN syntax ? -- anyone has done this? just curious. Thanks

2 1

openldap ldapsearch command
by Frederic Hornain 27 Oct '10

27 Oct '10

Dear *, How can I configure the Directory server in order to use SASL DIGEST-MD5 with ldapsearch qnd without error messages? ldapsearch -W -h xxx.xxx.xxx.xxx -U username -b "dc=example,dc=com" -Y DIGEST-MD5 Enter LDAP Password : xxxxx SASL/DIGEST-MD5 authentication started ldap_sasl_interactive_bind_s: Invalid credentials (49) additional info: SASL(-14): authorization failure: unable canonify user and get auxprops Thanks in advance for your help and your time. BR Frederic ;) ----------------------------------------------------- Fedora-ambassadors-list mailing list Fedora-ambassadors-list(a)redhat.com

4 12

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2010