389-users June 2011

389-users@lists.fedoraproject.org

38 participants
45 discussions

Re: [389-users] question syncing with AD
by solarflow99 28 Jun '11

28 Jun '11

>From my tests, no. OU's have to created and deleted manually in 389. For passwords, they have to be reset in AD since only passsync can pick them up. You can replicate any OU, just create the sub containers first and initiate a full resynchronization. On Mon, Jun 27, 2011 at 4:16 PM, solarflow99 <solarflow99(a)gmail.com> wrote: > > > On Mon, Jun 27, 2011 at 4:08 PM, Mi Zhou <mi.zhou(a)stjude.org> wrote: > >> Thanks Rich for the answer. A few more questions: >> >> Does existing password get synced during the initial full >> re-sychronization? or does it only sync changes? >> >> Does container entries got synced as well? Say, if a new OU was created >> on AD, will that be synced on 389? >> > >

1 0

Re: [389-users] question syncing with AD
by Mi Zhou 27 Jun '11

27 Jun '11

> > Does container entries got synced as well? Say, if a new OU was created > > on AD, will that be synced on 389? > During the initial sync init phase - yes. During the incremental phase > - no. Can we initiate a full resync to get this done, or it must be manually added on the other end? Thanks, Mi Email Disclaimer: www.stjude.org/emaildisclaimer

2 1

question syncing with AD
by Mi Zhou 27 Jun '11

27 Jun '11

Hi, I am exploring the possibilities of us setting up a 389 server and have it synchronize with our AD. I read that both 389 and AD have to be running SSL. We have multiple domain controllers that trust each other, some running SSL, some not. I wonder if every one of them have to be running SSL to make sync work. Also does "passsync" have to be installed on every domain controllers? Thanks a lot, Mi Email Disclaimer: www.stjude.org/emaildisclaimer

2 2

Add another administrator
by Gioachino Bartolotta 27 Jun '11

27 Jun '11

Hi all, it's possible to add another administrative user (similar to Directory Manager) but who can only manage only user accounts under dc=mydomain? Thanks -- ------------------------------------------- Gioachino Bartolotta ICQ #: 9103167 MSN Messenger: astraroth(a)email.it Yahoo & Skype: gioachino_bartolotta

1 0

win sync limitation
by solarflow99 27 Jun '11

27 Jun '11

I just noticed that a user created from windows cannot login on linux because they have no posixuser attributes. If there was 1 feature that would be a "nice to have", this would be it.

3 3

upgrade fedora-ds-1.1.3-1.fc6 to 389-ds
by Srinivas Janakiraman 23 Jun '11

23 Jun '11

Hi,I am trying to upgrade fedora-ds-1.1.3-1.fc6 to 389-ds.I have the following in my yum repo list. [dirsrv]name=Fedora Directory Server - 6 - $basearchbaseurl=http://directory.fedoraproject.org/yum/dirsrv/fedora/6/$basearch/RPMS [dirsrv-noarch]name=Fedora Directory Server - 6 - noarchbaseurl=http://directory.fedoraproject.org/yum/dirsrv/fedora/6/noarch… When I run yum upgrade fedora-ds fedora-ds-base, I am getting "Could not find update match". Please help me to find the problem. Thanks

2 3

Req : Multimaster replication query
by s.varadha rajan 23 Jun '11

23 Jun '11

Hi, Anyone can help me, regarding my below query ? Regards, Varad On Tue, Jun 21, 2011 at 7:26 PM, Rich Megginson <rmeggins(a)redhat.com> wrote: > ** > On 06/20/2011 11:42 PM, s.varadha rajan wrote: > > Hi Rich, > > Please let me know, where can i get modified "mmr.pl" as per my below > requirement. > > I don't know. > > > Best Regards, > Varad > > > > On Fri, Jun 17, 2011 at 7:46 PM, Rich Megginson <rmeggins(a)redhat.com>wrote: > >> On 06/16/2011 11:45 PM, s.varadha rajan wrote: >> >> Hi, >> >> i ran the below command in supplier side and the output is, >> >> # extended LDIF >> # >> # LDAPv3 >> # base <cn=config> with scope subtree >> # filter: (objectclass=nsds5replicationagreement) >> # requesting: ALL >> # >> >> # Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.com po >> rt 389, replica, o\3Dnetscaperoot, mapping tree, config >> dn: cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.c >> om port 389",cn=replica,cn="o=netscaperoot",cn=mapping tree,cn=config >> objectClass: top >> objectClass: nsDS5ReplicationAgreement >> cn: "Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.com >> port 389" >> nsDS5ReplicaHost: sam.xxx.xxx.com >> nsDS5ReplicaRoot: o=netscaperoot >> >> >> This is the problem. I doubt that you wanted to replicate >> o=netscaperoot. You probably wanted to replicate your user data suffix e.g. >> dc=example,dc=com. >> >> Can someone please fix mmr.pl? >> >> >> nsDS5ReplicaPort: 389 >> nsDS5ReplicaBindDN: cn=repman,cn=config >> nsDS5ReplicaBindMethod: simple >> nsds5replicaTimeout: 120 >> nsDS5ReplicaCredentials: {DES}VdEnvxoUkmw1TpV1QyVPtg== >> nsds5replicareapactive: 0 >> nsds5replicaLastUpdateStart: 20110616123147Z >> nsds5replicaLastUpdateEnd: 20110616123147Z >> nsds5replicaChangesSentSinceStartup:: MToxNC8wIA== >> nsds5replicaLastUpdateStatus: 0 Incremental update succeeded >> nsds5replicaUpdateInProgress: FALSE >> nsds5replicaLastInitStart: 20110616104148Z >> nsds5replicaLastInitEnd: 20110616104153Z >> nsds5replicaLastInitStatus: 0 Total update succeeded >> >> # search result >> search: 2 >> result: 0 Success >> >> # numResponses: 2 >> # numEntries: 1 >> >> >> Regards, >> Varad >> >> >> >> On Thu, Jun 16, 2011 at 8:47 PM, Rich Megginson <rmeggins(a)redhat.com>wrote: >> >>> On 06/16/2011 07:33 AM, s.varadha rajan wrote: >>> >>> Hi, >>> >>> For me no issues to recive the logs.anyway, i have performed the >>> following steps again, >>> >>> 1.Stop the "dirsrv" on both sides. >>> 2.Enabled "nsslapd-errorlog-level: 8192" on both servers in "dse.ldif" >>> file. >>> 3.Started the "dirsrv" on both servers. >>> 4.Export the datas in .ldif and imported to "sam" system >>> 4.From "varad.xxx.xxx.com,Remove the agreement again (./mmr.pl --host1 >>> varad.xxx.xxx.com --host2 sam.xxx.xxx.com --host1_id 1 --host2_id 2 >>> --bindpw <password> --repmanpw <password> --remove) >>> 5.From "varad.xxx.xxx.com,Created agreement again (./mmr.pl --host1 >>> varad.xxx.xxx.com --host2 sam.xxx.xxx.com --host1_id 1 --host2_id 2 >>> --bindpw <password> --repmanpw <password> --create) >>> 6.Then created one user under "ou=people" , as a uid=TT in supplier side >>> (varad.xxx.xxx.com) >>> 7.but not replicated in other system... >>> >>> Supplier system (/var/log/dirsrv/slapd-varad/errors): ( >>> varad.xxx.xxx.com): >>> >>> [16/Jun/2011:18:36:48 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): Disconnected from the consumer >>> [16/Jun/2011:18:36:48 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: start -> ready_to_acquire_replica >>> [16/Jun/2011:18:36:48 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: ready_to_acquire_replica -> wait_for_changes >>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: wait_for_changes -> wait_for_changes >>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: wait_for_changes -> start >>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): No linger to cancel on the connection >>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): Disconnected from the consumer >>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: start -> ready_to_acquire_replica >>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: ready_to_acquire_replica -> wait_for_changes >>> >>> Consumer system: (sam.xxx.xxx.xom): >>> >>> [16/Jun/2011:18:46:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): Disconnected from the consumer >>> [16/Jun/2011:18:46:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: start -> ready_to_acquire_replica >>> [16/Jun/2011:18:46:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: ready_to_acquire_replica -> wait_for_changes >>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: wait_for_changes -> wait_for_changes >>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: wait_for_changes -> start >>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): No linger to cancel on the connection >>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): Disconnected from the consumer >>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: start -> ready_to_acquire_replica >>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin - >>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: ready_to_acquire_replica -> wait_for_changes >>> >>> So,please let me know what is the problem ? and how to resolve ? >>> >>> on the supplier >>> ldapsearch -x -D "cn=directory manager" -W -b cn=config >>> '(objectclass=nsds5replicationagreement)' >>> >>> >>> Regards, >>> Varad >>> >>> >>> On Wed, Jun 15, 2011 at 7:41 PM, Rich Megginson <rmeggins(a)redhat.com>wrote: >>> >>>> On 06/14/2011 11:59 PM, s.varadha rajan wrote: >>>> >>>> Hi, >>>> >>>> Thanks for the reply.that's ok.but if i create one new user in >>>> supplier side,it's not replicating to consumer side.i think ubuntu 10.04 LTS >>>> supports fedora-ds 1.1.x and dont have updated ppa links. for this case, >>>> shall i upgrade the latest version, will give the solution? After upgrade, >>>> how can i migrate my existing data. >>>> >>>> First check your errors log on your supplier side to see if there are >>>> any errors during the incremental update phase (the messages below are from >>>> the init phase), then check the access log on the consumer side to see if >>>> the supplier is connecting and attempting to send the new user. >>>> >>>> If that shows nothing, then try enabling the replication log level - >>>> http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting >>>> >>>> >>>> or give me a solution for this. >>>> >>>> Regards, >>>> Varad >>>> >>>> >>>> On Tue, Jun 14, 2011 at 8:26 PM, Rich Megginson <rmeggins(a)redhat.com>wrote: >>>> >>>>> On 06/14/2011 08:23 AM, s.varadha rajan wrote: >>>>> >>>>> Hi, >>>>> >>>>> I followed the procedure to configure "multi-master replication" as >>>>> per >>>>> http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication. >>>>> but i got an error as >>>>> >>>>> *From consumer side:* >>>>> >>>>> 14/Jun/2011:19:25:41 +051800] NSMMReplicationPlugin - >>>>> multimaster_be_state_change: replica o=netscaperoot is coming online; >>>>> enabling replication >>>>> [14/Jun/2011:19:25:41 +051800] NSMMReplicationPlugin - >>>>> replica_reload_ruv: Warning: new data for replica o=netscaperoot does not >>>>> match the data in the changelog. >>>>> Recreating the changelog file. This could affect replication with >>>>> replica's consumers in which case the consumers should be reinitialized. >>>>> >>>>> This is not an error. It just means the consumer has been initialized >>>>> with data from the master, and it had old data (probably from setup) which >>>>> was wiped out. >>>>> >>>>> >>>>> *From Supplier side:* >>>>> >>>>> [14/Jun/2011:19:26:12 +051800] NSMMReplicationPlugin - Beginning total >>>>> update of replica "agmt="cn="Replication from varad.xxx.xxx.com port >>>>> 389 to sam.xxx.xxx.com port 389"" (sam:389)". >>>>> [14/Jun/2011:19:26:15 +051800] NSMMReplicationPlugin - Finished total >>>>> update of replica "agmt="cn="Replication from varad.xxx.xxx.com port >>>>> 389 to sam.xxx.xxx.com port 389"" (sam:389)". Sent 120 entries. >>>>> >>>>> >>>>> We are using the OS-Ubuntu 10.04. I searched in google and got the >>>>> some result in "https://bugzilla.redhat.com/show_bug.cgi?id=388021". >>>>> but i dont know how to fix this.Please help on this. >>>>> >>>>> Regards, >>>>> Varad >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> On Mon, May 30, 2011 at 12:27 PM, s.varadha rajan < >>>>> rajanvaradhu(a)gmail.com> wrote: >>>>> > >>>>> > Hi, >>>>> > >>>>> > Thanks for the reply.I will try and update you further. >>>>> > >>>>> > Regards, >>>>> > Varad >>>>> > >>>>> > >>>>> > >>>>> > On Fri, May 27, 2011 at 8:30 PM, Rich Megginson <rmeggins(a)redhat.com> >>>>> wrote: >>>>> >> >>>>> >> On 05/27/2011 12:11 AM, s.varadha rajan wrote: >>>>> >> >>>>> >> Hi, >>>>> >> >>>>> >> Can i get any update on my below query ? >>>>> >> >>>>> >> Regards, >>>>> >> Varad >>>>> >> >>>>> >> On Tue, May 24, 2011 at 6:17 PM, s.varadha rajan < >>>>> rajanvaradhu(a)gmail.com> wrote: >>>>> >>> >>>>> >>> Hi, >>>>> >>> We are using Ubuntu 10.04 server OS and all the web applications >>>>> are running on that.We have already implemented fedora-ds for ldap auth.now >>>>> we are planning to go some up-gradation.kindly let me know the following, >>>>> >>> 1.How to migrate running fedora-ds server to another server ? >>>>> >>> 2.i have taken all the user/group+etc in ldif format.is it enough >>>>> for migration or any other db (/var/lib/dirsrv/slapd-<instance>) also need >>>>> to bacup ? >>>>> >> >>>>> >> LDIF should be fine. >>>>> >>> >>>>> >>> if any procedure please share with me ? how to import/export .ldif >>>>> file >>>>> >> >>>>> >> /usr/lib[64]/dirsrv/slapd-INSTNAME/db2ldif - export database to ldif >>>>> >> /usr/lib[64]/dirsrv/slapd-INSTNAME/ldif2db - import database from >>>>> ldif >>>>> >>> >>>>> >>> 3.in our setup,one server is in public network.so i am planning to >>>>> do replication through "ldaps", i.e local server to public server >>>>> replication through highly secure how to ? >>>>> >> >>>>> >> Not exactly, but there is plenty of documentation - see >>>>> http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-single/… >>>>> >>> >>>>> >>> Please help me on the above topics. >>>>> >>> Regards, >>>>> >>> Varad >>>>> >> >>>>> >> -- >>>>> >> 389 users mailing list >>>>> >> 389-users(a)lists.fedoraproject.org >>>>> >> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>> > >>>>> >>>>> >>>>> >>>> >>>> >>> >>> >> >> > >

4 6

issues installing in RHEL6.1
by Paul Robert Marino 22 Jun '11

22 Jun '11

Ive been trying to install on 389 RHEL 6.1 and i keep geting dependency errors This is the last error thats hanging me up and i know its just an incorrect dependency in the spec file or a package that has not updated in the repo yet see below " yum install 389-ds --enablerepo=epel-389-ds-base .. ... ... ... --> Finished Dependency Resolution Error: Package: 389-ds-1.2.1-1.el6.noarch (epel) Requires: 389-ds-console-doc Error: 389-ds-base conflicts with selinux-policy-targeted Error: Package: 389-ds-1.2.1-1.el6.noarch (epel) Requires: 389-ds-console You could try using --skip-broken to work around the problem You could try running: rpm -Va --nofiles --nodigest [root@lnn1214 ~]# yum search 389-ds-console Loaded plugins: rhnplugin Warning: No matches found for: 389-ds-console No Matches found [root@lnn1214 ~]# yum install 389-ds-console --enablerepo=epel-389-ds-base Loaded plugins: rhnplugin Setting up Install Process No package 389-ds-console available. Error: Nothing to do [root@lnn1214 ~]# yum search 389-ds-console --enablerepo=epel-389-ds-base Loaded plugins: rhnplugin Warning: No matches found for: 389-ds-console No Matches found [root@lnn1214 ~]# yum search 389-console --enablerepo=epel-389-ds-base Loaded plugins: rhnplugin ===================================================================================== N/S Matched: 389-console ====================================================================================== 389-console.noarch : 389 Management Console Name and summary matches only, use "search all" for everything. " This is the last error thats hanging me up

2 3

Help getting an Ubuntu Client to work with 389 Directory Server - specifically Ubuntu 11.04 (GNU/Linux 2.6.38-8-server x86_64)
by Clint Dilks 22 Jun '11

22 Jun '11

Hi, Can anyone point me to some good documentation that shows how to get Ubuntu 11.04 (GNU/Linux 2.6.38-8-server x86_64) working as a client with 389 Directory Server? I have tried following https://help.ubuntu.com/community/FedoraDirectoryServerClientHowto but it seems to be old. /etc/pam_ldap.conf being replaced by /etc/ldap.conf. >From my experience setting up CentOS clients I expected there to also be a config file similar to /etc/openldap/ldap.conf. It appears this is /etc/ldap/ldap.conf. I have also looked at https://help.ubuntu.com/community/LDAPClientAuthentication I then came across https://help.ubuntu.com/11.04/serverguide/C/openldap-server.html#openldap-a… And did sudo dpkg-reconfigure ldap-auth-config sudo auth-client-config -t nss -p lac_ldap sudo pam-auth-update Currently a getent passwd or getent group is not returning any results from ldap. We can see the client making connections but it doesn't seem to be asking for any information. ldapsearch -vv -x -b 'ou=Active,ou=People,dc=cms, dc=waikato,dc=ac,dc=nz' '(objectclass=*)' appears to work correctly. Below are the two main config files cat /etc/ldap.conf | grep -v '^#' | grep -v '^$' base ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz ldap_version 3 pam_member_attribute uniquemember pam_password clear uri ldap://inf2.cms.waikato.ac.nz/ tls_cacertdir /etc/ssl/certs pam_password_prohibit_message Please visit https://secure.scms.waikato.ac.nz/password/ to change your password. ssl start_tls nss_base_passwd ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz?sub nss_base_shadow ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz?sub nss_base_group ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz?sub nss_base_netgroup ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz?sub nss_map_attribute uniqueMember memberUid nss_initgroups_ignoreusers avahi,backup,bin,daemon,games,gnats,irc,landscape,libuuid,list,lp,mail,man,messagebus,nagios,news,ntp,postfix,proxy,root,sshd,sync,sys,syslog,uucp,www-data nss_reconnect_tries 5 # no. of times to double the sleep time nss_reconnect_sleeptime 4 # initial sleep value nss_reconnect_maxsleeptime 64 # max sleep value to cap at nss_reconnect_maxconntries 2 cat /etc/ldap/ldap.conf | grep -v '^#' | grep -v '^$' URI ldap://inf2.cms.waikato.ac.nz/ BASE ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz TLS_CACERTDIR /etc/ssl/certs >From /var/log/auth we see Jun 22 13:52:28 wdm2 getent: nss_ldap: reconnecting to LDAP server... Jun 22 13:52:28 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Jun 22 13:52:32 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Jun 22 13:56:50 wdm2 getent: nss_ldap: reconnecting to LDAP server... Jun 22 13:56:50 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping 4 seconds)... Jun 22 13:56:54 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping 8 seconds)... Jun 22 13:57:02 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping 16 seconds)... To see all config files go to http://www.scms.waikato.ac.nz/~clintd/ubuntu-ldap/etc/ Thank you for any insight you can offer relating to this issue.

2 2

Re: [389-users] win sync error
by solarflow99 22 Jun '11

22 Jun '11

On Tue, Jun 21, 2011 at 1:39 PM, Rich Megginson <rmeggins(a)redhat.com> wrote: > ** > On 06/21/2011 11:23 AM, solarflow99 wrote: > > I'm using self signed certs, did I miss something? > > Probably. There are many steps involved in getting winsync to use >> TLS/SSL to talk to AD, and getting AD PassSync to use TLS/SSL to talk to >> DS. Which >> > > From the Docs listed online: > http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Adminis… > > The 8.2 docs are better > > http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-single/… > > and I went over everything else I could possibly find too. It seems in the > case of self signed certificates, > > Are you talking about self signed certs for 389 or for AD? > I guess that would be both. This is all internal so no servers need real third party signed certificates, just trying to get it to work. > the windows CA has to exported as a .cer file, and imported in 389 with: > certutil -d . -A -n "AD Cert" -t "CTu,u,u" -i ad-cert.cer > > Yes, that is correct. So what's the problem? > It wasn't mentioned anywhere, so once I guessed what had to be done, now i'm getting a different error: # /usr/lib64/mozldap/ldapsearch -v -Z -P /etc/dirsrv/slapd-ldapserver/cert8.db -h 10.10.10.210 -p 636 -D "cn=administrator" -w mypassword -b "cn=users,dc=389testdomain,dc=local" "objectclass=*" ldapsearch: started Tue Jun 21 08:41:15 2011 ldap_init( 10.10.10.210, 636 ) ldaptool_getcertpath -- /etc/dirsrv/slapd-ldapserver/cert8.db ldaptool_getkeypath -- /etc/dirsrv/slapd-ldapserver/cert8.db ldaptool_getmodpath -- (null) ldaptool_getdonglefilename -- (null) ldap_simple_bind: Invalid credentials ldap_simple_bind: additional info: 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2011