389-users November 2012

389-users@lists.fedoraproject.org

37 participants
33 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

SO kills ns-ldapd because of memory usage
by Moisés Barba Pérez 19 Dec '12

19 Dec '12

Hi, I have a memory issue with 389-ds 1.2.5 in a CentOS 5.5 64bits 4GB ram. The server swaps when the server physical memory increase over 75% approx. When the swap is full the server reaches 100% of physical memory and the SO kills the ns-ldapd process. Out of memory: Killed process 30383, UID 99, (ns-slapd). The cache sizes are: nsslapd-dbcachesize: 838860800 nsslapd-import-cachesize: 20000000 nsslapd-cachememsize: 125829120 (for each 26 db) Which can be the problem?

3 11

389 <=> AD group sync
by Vesa Alho 11 Dec '12

11 Dec '12

Hi, I'm testing group sync between 389ds and Microsoft AD. It works otherwise, but incremental updates are not working. Any changes to groups on 389 side do not get synced to AD unless I do a full manual update triggered via console. Syncing users works normally. Would someone have an idea why? -Matti

3 14

Scripts to analyze 389 directory server access logs?
by Justin Piszcz 29 Nov '12

29 Nov '12

Hello, I've written a couple scripts to analyze these logs but was curious if there were any open source ones to analyze the 389 directory server access logs? Its always good to see the various methods of analysis (especially if there is any interpretation of what is found in the logs themselves). Is there anything out there that folks use? There is one on freshmeat but its for OpenLDAP only. Justin.

2 2

suggestion for Howto:ChainOnUpdate page
by Jovan.VUKOTIC＠sungard.com 29 Nov '12

29 Nov '12

Hi, In case you follow instructions from ChainOnUpdate page, http://directory.fedoraproject.org/wiki/Howto:ChainOnUpdate note that in "Step 2 (Hub Only)" OID for nsTransmittedControl: 2.16.840.1.113730.3.4.12 representing a proxied authorization control is an old OID of the control which newer version (version 2) is 2.16.840.1.113730.3.4.18 Hence, at least in my 389 DS, version 1.2.10.7, which rootDSE has the newer OID of the control among its supportedcontrol values it was required that dn: cn=config,cn=chaining database,cn=plugins,cn=config has nsTransmittedControl: 2.16.840.1.113730.3.4.18 Otherwise, I kept receiving "Critical extension is unavailable (12)" error Hope this may be helpful to someone. Thanks, Jovan

2 1

Password Expiration Time
by Tariq Kmail 27 Nov '12

27 Nov '12

I am using php to change the password for my ldap users, and now I am trying to enable the password expiration policy But when I enable it, most of the users became blocked users because they did not change their password recently. I want to unlock them using php or ldap automatically.. what are the attributes needed to solve this problem? I tried to reset passwordexpirationtime to be in the future for all of them, but this did not work to unblock them Any help please? Thanks

2 1

chain on update by ldapmodify problem
by Jovan.VUKOTIC＠sungard.com 27 Nov '12

27 Nov '12

Hi, I have two Directory Servers (1.2.10.7 version) configured in single master replication topology over TLS/SSL encrypted line. Replication works fine, but I cannot have chain on update work although I have set both servers as per http://www.directory.fedora.redhat.com/wiki/Howto:ChainOnUpdate page. I have tested the functionality with openldap ldapmodify tool with -e !authzid general extension, but I keep receiving an error for which I could not find anything about "authzid=: Event not found": # ldapmodify -x -H ldaps://asp.com:636 -D "uid=rmanager,cn=config" -w secret -e !authzid="dn:uid=amisovic,ou=people,dc=asp,dc=com" -f amisovic_upd.ldif authzid=: Event not found. Any help will be appreciated! Thanks! Jovan

2 2

ACI for single user access
by James Chamberlain 26 Nov '12

26 Nov '12

I'm trying to figure out how to write an ACI which would allow one user to read a particular branch of the directory, but deny all others. If I specify it as two rules - one denying access to everyone, the other granting access to this user - no one can read that branch. If I specify it as a single rule, that this user can read this branch, it's not imposing any new restrictions and everyone can read the branch. I've tried reading the documentation and didn't see this example listed. Can anyone point me in the right direction? Thanks, James

2 4

NSMMReplicationPlugin - repl_set_mtn_referrals
by Andreas Kekkou 26 Nov '12

26 Nov '12

Hi, I have recently deleted and recreated the MMR between my two server and since then the following message is appearing in the error log: NSMMReplicationPlugin - repl_set_mtn_referrals: could not set referrals for replica dc=xxx,dc=xxx,dc=xxx,dc=xxx: 32 When the MMR has been deleted the referrals has not been cleared automatically and I have removed them manually, but I don't remember exactly the syntax. I need some help adding them back. Regards, Andreas

2 1

db2* backup scripts - location and recreating
by Orion Poplawski 26 Nov '12

26 Nov '12

Couple related issue around the generated db2* and similar scripts in /usr/lib{,64}/dirsrv/slapd-%{instance}. - Can these be recreated easily without messing with an otherwise working instance? - I think this is a bad location to put generated files. I would suggest /var/lib/dirsrv/slapd-%{instance}/bin instead. The use of /usr seems to violate the FHS: http://www.pathname.com/fhs/pub/fhs-2.3.html#THEUSRHIERARCHY /usr is the second major section of the filesystem. /usr is shareable, read-only data. That means that /usr should be shareable between various FHS-compliant hosts and must not be written to. Any information that is host-specific or varies with time is stored elsewhere. -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2012