389-users July 2012

389-users@lists.fedoraproject.org

39 participants
40 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

ldapsearch is fine but from authentication purpose its not doing anything
by Fosiul Alam 31 Jul '12

31 Jul '12

Hi I have setup ldap server and from client its returning example : [root@home ~]# ldapsearch -x -ZZ -D "cn=Directory manager" -w xxx -h ldap-2.fosiul.lan -b "dc=fosiul,dc=lan" "(cn=Fosiul Alam)" # extended LDIF # # LDAPv3 # base <dc=fosiul,dc=lan> with scope subtree # filter: (cn=Fosiul Alam) # requesting: ALL # # falam, users, uk, fosiul.lan dn: uid=falam,ou=users,l=uk,dc=fosiul,dc=lan givenName: Fosiul sn: Alam loginShell: /bin/bash/bash uidNumber: 1000 gidNumber: 3000 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount uid: falam cn: Fosiul Alam homeDirectory: /home/falam userPassword:: e1NTSEF9UGtqNjhvSU1pSR0RrSWNYYkVvYVU2V2c9PQ= = # search result search: 3 result: 0 Success # numResponses: 2 # numEntries: 1 and in the access log : 28/Jul/2012:15:42:57 +0100] conn=229 fd=70 slot=70 connection from 192.0.0.4 to 192.0.0.9 [28/Jul/2012:15:42:57 +0100] conn=229 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [28/Jul/2012:15:42:57 +0100] conn=229 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [28/Jul/2012:15:42:57 +0100] conn=229 SSL 256-bit AES [28/Jul/2012:15:42:57 +0100] conn=229 op=1 BIND dn="cn=Directory manager" method=128 version=3 [28/Jul/2012:15:42:57 +0100] conn=229 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [28/Jul/2012:15:42:57 +0100] conn=229 op=2 SRCH base="dc=fosiul,dc=lan" scope=2 filter="(cn=Fosiul Alam)" attrs=ALL [28/Jul/2012:15:42:57 +0100] conn=229 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [28/Jul/2012:15:42:57 +0100] conn=229 op=3 UNBIND [28/Jul/2012:15:42:57 +0100] conn=229 op=3 fd=70 closed - U1 But From command line , when i do [root@home ~]# id falam id: falam: No such user [28/Jul/2012:15:44:26 +0100] conn=230 fd=70 slot=70 connection from 192.0.0.4 to 192.0.0.9 [28/Jul/2012:15:44:26 +0100] conn=230 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS" [28/Jul/2012:15:44:26 +0100] conn=230 op=0 RESULT err=0 tag=120 nentries=0 etime=0 [28/Jul/2012:15:44:26 +0100] conn=230 SSL 256-bit AES [28/Jul/2012:15:44:26 +0100] conn=230 op=1 BIND dn="" method=128 version=3 [28/Jul/2012:15:44:26 +0100] conn=230 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="" [28/Jul/2012:15:44:26 +0100] conn=230 op=2 SRCH base="dc=fosiul,dc=lan" scope=2 filter="(&(objectClass=posixAccount)(uid=falam))" attrs="uid userPassword uidNumber gidNumber cn homeDirectory loginShell gecos description objectClass" [28/Jul/2012:15:44:26 +0100] conn=230 op=2 RESULT err=0 tag=101 nentries=0 etime=0 [28/Jul/2012:15:44:26 +0100] conn=230 op=-1 fd=70 closed - B1 So basically, ldapsearch is working but authentication is not working .. Can any one please help me with this . and i am using Centos 5.8 Fosiul.

4 10

Question about users and groups in sub suffixes
by Paul Robert Marino 30 Jul '12

30 Jul '12

Hello every one I have a strange problem Im trying to use 389 server in a large organization and i have to break the directory into several sub suffixes or root suffixes. there is the scenario I work for Large company A Large company A owns 1) subsidiary b 2) subsidiary c 3) subsidiary d Large company A uses domain example.com subsidiary b uses domain b.example.com subsidiary c uses domain c.example.com subsidiary d uses domain d.example.com I would like to separate each of the subsidiaries into their own sub suffix partially because of security reasons also to minimize unneeded replication for local read only slaves at the subsidiary sites, and I would also like the administrator at each subsidiary to have the option of manage their own users or having the administrators at the parent company do it for them. now creating the sub suffix with its own database is fairly well documented and works well with ou's but doesn't seem to work with dc's if i create the new suffix as a dc and go into the users and groups in the console and try to add a user to the new dc it wont let me. if i use the Users drop down menu and try to change directory and set the base to the new dc (e.g. dc=b,dc=example,dc=com) it tells me the dc isn't valid I also tried creating a root suffix and ran into the same problem so what am i missing? Is there some initial database population step I didn't see in the documentation or do i need to setup some ACIs or what?

2 4

How create nisnetgrouptriple
by Fosiul Alam 30 Jul '12

30 Jul '12

HI every where i see, it tells me to create nisnetgrouptriple by using from ldif . but i am quite new to do that. So i want to know how will i create this by using "centos-idm-console" I already created organization group, nisgetgroupclass Ou=netgroup cn=puppet Now i need to create nisnetgrouptriple where i will be able to enter server name but dont understand how will i create that . Can any one please give me some light how I will create that by using centos-idm-console Thanks for help Fosiul.

2 1

How to export CA certificate into client from server
by Fosiul alam 28 Jul '12

28 Jul '12

Hi I think i am very close to fix the issue Please have a look to the bellow commands I can do this from SErver or client .. this result i get root@home ~]# ldapsearch -x -ZZ -D "cn=Directory manager" -w xxxx -h ldap-2.fosiul.lan -b "dc=fosiul,dc=lan" # extended LDIF # # LDAPv3 # base <dc=fosiul,dc=lan> with scope subtree # filter: (objectclass=*) # requesting: ALL # # fosiul.lan dn: dc=fosiul,dc=lan dc: fosiul objectClass: domain objectClass: top # uk, fosiul.lan dn: l=uk,dc=fosiul,dc=lan l: uk objectClass: locality objectClass: top # groups, uk, fosiul.lan dn: ou=groups,l=uk,dc=fosiul,dc=lan objectClass: organizationalUnit objectClass: top ou: groups # users, uk, fosiul.lan dn: ou=users,l=uk,dc=fosiul,dc=lan objectClass: organizationalUnit objectClass: top ou: users # techops-uk, groups, uk, fosiul.lan dn: cn=techops-uk,ou=groups,l=uk,dc=fosiul,dc=lan gidNumber: 3000 objectClass: top objectClass: groupofuniquenames objectClass: posixgroup cn: techops-uk # falam, users, uk, fosiul.lan dn: uid=falam,ou=users,l=uk,dc=fosiul,dc=lan givenName: Fosiul sn: Alam loginShell: /bin/bash/bash uidNumber: 1000 gidNumber: 3000 objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetorgperson objectClass: posixAccount uid: falam cn: Fosiul Alam homeDirectory: /home/falam userPassword:: e1NTSEF9UGtqNjhvazF1SFR0NUR5T0Roa2FSU1pSR0RrSWNYYkVvYVU2V2c9PQ= = # search result search: 3 result: 0 Success # numResponses: 7 # numEntries: 6 so falam is in LDAP so from linux client or server if i type id falam or ssh falam@ldap-2 it should accept the password but i get this [root@home ~]# id falam id: falam: No such user or Jul 28 13:31:33 ldap-2 sshd[6071]: pam_succeed_if(sshd:auth): error retrieving information about user falam Jul 28 13:31:34 ldap-2 sshd[6071]: Failed password for invalid user falam from 192.0.0.4 port 60072 ssh2 Please help with my last problem thanks

2 1

How to export CA certificate into client from server
by Fosiul alam 28 Jul '12

28 Jul '12

Hi Thanks no i think its fine .. I was trying with ldap-2 only but when i use faqdn name its work llike bellow ldapsearch -x -ZZ -D "cn=Directory manager" -w password -h ldap-2.fosiul.lan -b "dc=fosiul,dc=lan" Which is returning all result ( if i try from server) example (last few lines) uid: falam cn: Fosiul Alam homeDirectory: /home/falam userPassword:: NUR5T0Roa2FSU1pSR0RrSWNYYkVvYVU2V2c9PQ= = # search result search: 3 result: 0 Success # numResponses: 7 - Ignored: # numEntries: 6 does it mean its ok ?? but when when i do : ( From ldap server) [root@ldap-2 ~]# ldapsearch -x -ZZ '(uid=falam)' # extended LDIF # # LDAPv3 # base <> with scope subtree # filter: (uid=falam) # requesting: ALL # # search result search: 3 result: 0 Success its not getting anything .. what to do Thanks for your help

2 1

How to export CA certificate into client from server
by Fosiul alam 28 Jul '12

28 Jul '12

Hi thanks I understand i will have to start from scratch for certificate .. but few explanation i need My ldapserver host name is : ldap-2.fosiul.lan and I just cn="Directory Manager" so according to those info.. what shall i put in , dc=directory ??? and cn=directory.example.com" ??? My server hostname or "Directory Manager" # certutil -S -n "CA certificate" -s "cn=CA cert,dc=directory,dc=example,dc=com" -2 -x -t "CT,," -m 1000 -v 720 -d . -k rsa Make sure you say yes to "Is this a CA certificate [y/N]?" and everything else will be default. Next we create your server cert. Make sure your cn is your FQDN of this server. # certutil -S -n "directory-Server-Cert" -s "cn=directory.example.com" -c "CA certificate" -t "u,u,u" -m 1001 -v 720 -d . -k rsa Thanks for your help . Really appreciate ..

2 1

How to export CA certificate into client from server
by Fosiul alam 28 Jul '12

28 Jul '12

Hi I am not getting reply by email, so i cant click on reply... how will i get reply by email ?? @<arpittolani(a)gmail.com> i think i have done something wrong to create certs I have used bellow script to create all the certificate : https://github.com/richm/scripts/blob/master/setupssl2.sh now when i do this ,i get bellow error .. ldapsearch -x -ZZ -D "cn=Directory manager" -w password -h ldap-2 -b "dc=fosiul,dc=lan" ldap_start_tls: Connect error (-11) additional info: TLS: hostname does not match CN in peer certificate

3 2

How to export CA certificate into client from server
by Fosiul alam 28 Jul '12

28 Jul '12

Hi Dont know how to reply on same thread. but thank for quick reply. its case sensitive. so I created the cert file and i put that one into client , and i configured as documentated /etc/openldap/ldap.conf URI ldap://ldap-2.fosiul.lan/ BASE dc=fosiul,dc=lan TLS_CACERTDIR /etc/openldap/cacerts/ TLS_REQCERT allow #TLS_CACERT /etc/openldap/cacerts/cacert.asc and in /etc/ldap.conf base dc=fosiul,dc=lan uri ldap://ldap-2.fosiul.lan/ ssl start_tls tls_cacertdir /etc/openldap/cacerts/ #TLS_CACERT /etc/openldap/cacerts/cacert.asc pam_password md5 and i can see it created another file in /etc/openldap/cacerts/ directory like ths 5be5959f.0 ds-ca.crt and when i do like this id usrname it does not find the user and i dont see any error in /var/log/message so its like its connecting to ldap. .but it does not get any information do i have to say Cn="Directory Manager" some where in ldap.conf file ?? thanks for your help. Fosiul but in clients , log file

3 2

How to export CA certificate into client from server
by Fosiul alam 28 Jul '12

28 Jul '12

Hi Thanks for reply. but there is a problem .. is there is the example certutil -d . -L Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CA certificate CTu,u,u server-cert u,u,u Server-Cert u,u,u [root@ldap-2 slapd-ldap-2]# certutil -d . -L -n "CA Certificate" -a > /root/ds-ca.crt certutil: Could not find cert: CA Certificate : File not found. so it does not find the file .. whats shall i do ?? Thanks

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2012