389-users October 2011

389-users@lists.fedoraproject.org

28 participants
25 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

Re: [389-users] Replication trouble when promoting dedicated Consumer to Multiple master [SOLVED]
by Roland Schwingel 19 Dec '11

19 Dec '11

Hi..... Finally I got it I don't know whether I did it the fully correct way, but it works now. I found that this mysterious replica id 3 was stored in dse.ldif of my server-b: To recap my scenario: server A < ----- server B <-----> server C -----> server D (dedicated Consumer) (multiple Master replica ID:1) (multiple Master replica ID:2) (Dedicated Consumer) I wanted to promote my server D to become a multiple master - but it did not work. What did I do to get it going: 1. Removed all replication agreements to/from server D. 2. Stopped all LDAP services on all servers (I was a little desperate) 3. Found replica id 3 in dse.ldif of server B(?) - nowhere else (why B and not C?) 4. Removed these bogus entries. 5. Restarted all LDAP services on all machines. 6. ldapsearch on server C still revealed the bogus replica id 3 (Where the heck is that cached?). 7. Reinitialized consumer server C from server B and restarted ldap on server C. 8. ldapsearch was clean by then. 9. removed my suffix on server D and removed changelog. 10. recreated suffix on server D and made server D a dedicated consumer 11. on server C created replication agreement to server D 12. initialized server D from server C. 13, Enabled changelog on server D 14. Changed server D to be Multiple Master with replica id 3 15, Created replication aggreement to server C from server D. 16. Worked. Restarted LDAP on server D and C. 17. Still works and replicates to all other machines along the path. 18. I need vacation.... Holy Moly! Roland __________________ Hi Reinhard, Thanks for your reply!! 389-users-bounces(a)lists.fedoraproject.org wrote on 14.07.2011 16:25:10: > From: Reinhard Nappert <rnappert(a)juniper.net> > To: "General discussion list for the 389 Directory server project." > <389-users(a)lists.fedoraproject.org> > Date: 14.07.2011 16:28 > Subject: Re: [389-users] Replication trouble when promoting > dedicated Consumer to Multiple master > Sent by: 389-users-bounces(a)lists.fedoraproject.org > > Do a ldapsearch -b 'nsuniqueid=ffffffff-ffffffff-ffffffff- > ffffffff,dc=mydomain,dc=com' -D <directory manager> -w <password> -s > base objectclass=nstombstone > > This gives you all the configured (history) of replication ids. The > following is the output in my setup. > > dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,o=base > objectClass: top > objectClass: nsTombstone > objectClass: extensibleobject > nsds50ruv: {replicageneration} 4df7a107000000010000 > nsds50ruv: {replica 1 ldap://yale:389} 4df7a396000000010000 4e19ad950000000100 > 00 > nsds50ruv: {replica 3 ldap://norquay:389} 4df7a39d000000030000 4e1605650000000 > 30000 > nsds50ruv: {replica 4 ldap://mustrum:389} 4df7a3a0000000040000 4dfb93650000000 > 40000 > nsds50ruv: {replica 2 ldap://louise:389} 4df7a39a000000020000 4e171a0700000002 > 0000 > o: base > nsruvReplicaLastModified: {replica 1 ldap://yale:389} 00000000 > nsruvReplicaLastModified: {replica 3 ldap://norquay:389} 00000000 > nsruvReplicaLastModified: {replica 4 ldap://mustrum:389} 00000000 > nsruvReplicaLastModified: {replica 2 ldap://louise:389} 00000000 > /\ > | > replication-id > I issued that command on my server Server C. I get the following results: # extended LDIF # # LDAPv3 # base <nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,dc=mydomain,dc=com> with scope baseObject # filter: objectclass=nstombstone # requesting: ALL # # ffffffff-ffffffff-ffffffff-ffffffff, mydomain.com dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff, dc=mydomain,dc=com objectClass: top objectClass: nsTombstone objectClass: extensibleobject nsds50ruv: {replicageneration} 4bf162c6000000010000 nsds50ruv: {replica 2 ldap://server-c.mydomain.com:389} 4cd3fa1e00000002 0000 4e1ef45b000000020000 nsds50ruv: {replica 3 ldap://server-d.mydomain.de:389} nsds50ruv: {replica 1 ldap://server-b.mydomain.de:389} 4bf16732000000010 000 4e1ffa3e000000010000 dc: mydomain nsruvReplicaLastModified: {replica 2 ldap://server-c.mydomain.com:389} 4 e1ef445 nsruvReplicaLastModified: {replica 3 ldap://server-d.mydomain.de:389} 00000000 nsruvReplicaLastModified: {replica 1 ldap://server-b.mydomain.de:389} 4e 1ffa26 # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 When I look at it I see that replica id 3 is assigned to my server-d (which should get that replica id). I started over deleted my server-d assigned it replica id 4 but nothing changes. I also cannot get rid of the informations for server-d in that nsuniqueid how can I do that? Thanks, Roland

2 1

Corrupted entry - Replication error
by Moisés Barba Pérez 08 Nov '11

08 Nov '11

Hi, I have a problem with one entry in LDAP. Two ldap servers configured as hub replication, each one with its own db. It have been such a replication error or something like that, and it was created a entry in the read-only db of one of them with this format nsuniqueid=4e5f6001-1dd211b2-af5aa850-d3090000+uid=########L,ou=people,o=XXXX,dc=XXXX,dc=XX where the original is uid=########L,ou=people,o=XXXX,dc=XXXX,dc=XX having both of then in the read-only db and the correct one in the original ldap. I can't remove the wrong entry because in the original ldap there is only the correct one. How can I fix this entry (removing it, I guess) ??? My ldap version is 1.2.5 and the OS is centos5.5. Regards, Moses.

2 3

Adding custom attribute
by David Hoskinson 31 Oct '11

31 Oct '11

I am creating a self service page that will allow users to rest their ldap passwords with the use of a "secret" . In the 389 console I am creating a custom attribute called secret in the configuration tab -> schema->attributes with syntax directory string. This string will be 50 characters randomly created with upper and lower case numbers and letters. After that I am creating a object class called "reset" and placing secret in that object class with the Parent of person. When I go to my user and attempt to add the attribute from the drop down menu, secret doesn't show. I am just hunting and pecking here but think I am getting close... any help would be appreciated. David Hoskinson | DATATRAK International Systems Engineer Mayfield Heights, Ohio, USA +1.440.443.0082 x 124 (p) | +1.216.280.5457 (m) david.hoskinson(a)datatrak.net<mailto:david.hoskinson@datatrak.net> | www.datatrak.net<http://www.datatrak.net/>

2 1

Data inconsitency during replication
by Das, Jyoti Ranjan (STSD) 31 Oct '11

31 Oct '11

Hi, I am new to 389 directory server. Could you please help me in the below mentioned query? Thank you very much in advance. Problem statement: Data loss during the replication between Supplier and consumer when master changelog db file is being deleted due to some reason , consumer is imported with some stale data and consumer doesn't want initialization during the new replication agreement. The test scenario is given below. Test scenario: Steps: 1) Topology Supplier -----------Replication agreement-----------------> Hub Both replicas are in sync at this time as mentioned below. Let's take this sample example: Five entries has been added starting from CSN1 to CSN5 2) Take a db2ldif with "-r" option from the Hub replica. 3) Add another 5 entries in the supplier. Let's take their CSN numbers are starting from CSN6 to CSN10 4) Delete the replication agreements 5) Delete the master changelog db file from the changelogdb directory. 6) Add another 5 entries in the supplier. Let's take their CSN numbers are staring from CSN11 to CSN15 7) Import the ldif file taken in Step-2 in the Hub replica( it's a initialization of consumer with the stale data) 8) Create the replication agreement between master and hub with the "do not initialize" option. 9) Now we will see the data loss starting from CSN6 to CSN14. Only entry with CSN15 will be replicated to the consumer and also will continue further with successful replication Questions: 1) Is this a correct approach in this scenario to continue with replication even if there are data losses instead of halting the replication? >From the code analysis: File: " ldapserver/ldap/servers/plugins/replication/cl5_api.c" If the requested CSN number is now found in the changelog db file and also not there in the purge list, it makes the following assumption and continues with replication /* there is a special case which can occur just after migration - in this case, the consumer RUV will contain the last state of the supplier before migration, but the supplier will have an empty changelog, or the supplier changelog will not contain any entries within the consumer min and max CSN - also, since the purge RUV contains no CSNs, the changelog has never been purged ASSUMPTIONS - it is assumed that the supplier had no pending changes to send to any consumers; that is, we can assume that no changes were lost due to either changelog purging or database reload - bug# 603061 - richm(a)netscape.com */ Is it a correct approach in this scenario to halt the replication with a fatal error message in the error log file? Regards, Jyoti

2 4

Account type dialog
by KodaK 28 Oct '11

28 Oct '11

Hi, Can someone point me to some documentation to tell me how to add the account types like you see in this screenshot? http://i.imgur.com/OrKiU.png I've added some AIX specific attributes and I'd like to add them under a checkbox like the "NT User" and "Posix User" categories. I've searched quite a bit, but I must be missing some important bit of info, I can't find anything. Thanks a lot, --Jason

2 2

How do you prevent someone from doing this
by Cawley, Chris 28 Oct '11

28 Oct '11

Hello - How would you prevent a user who has access from downloading the entire directory? Is there a flag or schema that would allow this? - Thansk

3 2

Password history and default password
by Mazier Alexandre 26 Oct '11

26 Oct '11

[Apologize for my English] Hello I'm trying to set up a password policy for my users. Especially, I set a password history value of 6. In case of a password recovery process, I want to give to the administrator to restore the password to a default value which is equally the value used for the account creation. The problem at this time is obvious: the password change is refused since the default password is already in the history. Is there any way to force the password restauration? Furthermore, I have some questions with about the way password history is working. I can see through 389-console that users have a multi-valued attributes passwordhistory. However I'm unable to get it with a command line ldapsearch request. How can I obtain this password history list? Maybe for the same reason, if I delete the passwordhistory attribute and try to restore the password to its initial value, I always obtain an exception due to the presence of the password in the history. Those points are not clearly referenced in the documentation. Thanks a lot for your help. Regards, Alexandre MAZIER Intervenant GIP CPAGE Parc Technologique de la Toison d'Or 19 rue Louis de Broglie BP 56507 21065 DIJON Cedex Tél : 03 80 28 46 46 Fax : 03 80 28 46 01 Mailto:Alexandre.Mazier@cpage.fr P Avant d'imprimer cet e-mail, si nous réfléchissions à l'impact sur l'environnement ? Les données et renseignements contenus dans ce message sont personnels, confidentiels et secrets. Si vous n'êtes pas destinataire de ce message, merci de le détruire immédiatement et d'avertir l'expéditeur. Le GIP CPAGE décline toute responsabilité au titre de ce message s'il a été altéré, déformé ou falsifié. The information contained in this message is privileged, confidential, and protected from disclosure. If you are not intended addressee of this message, please cancel it immediately and inform the sender. GIP CPAGE shall not be liable for the message if altered, changed or falsified.

2 1

NIS: doubled user entries with ypcat group
by cnu 24 Oct '11

24 Oct '11

Hello, we run several 389 DirectoryServer with a master slave replication. To support our old solaris enviroment we use "https://fedorahosted.org/slapi-nis/" for NIS: I use slapi-nis 0.26 from the Fedorarepository (src rpm) and compiled it for RH5. Solaris and other types of machines are running well. "id user" and "groups user" ist working. But I get with command "ypcat groups" doubled user entries for each group. When I have a group for example: group "test1" with user "user1 user2" I get with ypcat group | grep test1: test1: user1 user2 user1 user2 When I execute the command: id user1 I get test1 only once. In our dse.ldif I have following entries for group.byname: dn: nis-domain=xxxx+nis-map=group.byname,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject objectClass: top nis-domain: xxxx nis-map: group.byname nis-base: ou=Groups, dc=yyyyy, dc=com and group.gid dn: nis-domain=xxxx+nis-map=group.bygid,cn=NIS Server,cn=plugins,cn=config objectClass: extensibleObject objectClass: top nis-domain: xxxx nis-map: group.bygid nis-base: ou=Groups, dc=yyyyy, dc=com With LDAP I get: [root@NIS2LDAP ~]# ldapsearch -x -h localhost -s base -b "cn=test1,ou=groups,dc=yyyyy,dc=com" # extended LDIF # # LDAPv3 # base <cn=test1,ou=groups,dc=yyyyy,dc=com> with scope baseObject # filter: (objectclass=*) # requesting: ALL # # test1, Groups, yyyyy.com dn: cn=test1,ou=Groups,dc=yyyyy,dc=com objectClass: posixGroup objectClass: top objectClass: groupOfUniqueNames cn: tiger gidNumber: 484 memberUid: user1 memberUid: user2 uniqueMember: uid=user1,ou=People,dc=yyyyy,dc=com uniqueMember: uid=user2,ou=People,dc=yyyyy,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Is memberUid / uniqueMember a problem ? thanks, br cnu

2 1

389 server on production
by Alex Pershyn 21 Oct '11

21 Oct '11

Hi all, Can anybody tell me about using 389 in production environment? Is it stable? Were there many issues with it? Is there any support in case of production trouble? Thanks, Alex Pershyn, Application architect, Enabil Solutions Ltd

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users October 2011