389-users March 2013

389-users@lists.fedoraproject.org

33 participants
43 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

pam_groupdn is not working for some Centos 6.2
by Fosiul Alam 01 Apr '13

01 Apr '13

Hi pam_groupdn is not working on some of my centos 6.2 server. from google i can see , there is a issues with https://access.redhat.com/knowledge/solutions/64719 but dont understand , how to solve this Can any one please give me some light ?? Thanks

2 2

389DS Certificates
by alexandre 29 Mar '13

29 Mar '13

Hello, I want to Configure the Password Sync Service and do this command (in / etc/dirsrv/slapd-instance): "certutil -d . -L -n "CA certificate" -a > dsca.crt" But "CA certificate" doesn't exist. As I can see in web: " /etc/dirsrv/slapd-[instance name] This is where the certificates for the directory instance are stored, as well as its pin.txt file. " So I can't export server certificate on my Windows server. Thanks in advance !

4 6

CoS usage
by Jovan.VUKOTIC＠sungard.com 29 Mar '13

29 Mar '13

Hi, I have 389 DS (1.2.10.7 version) I am getting confusing ldapsearch results when I use two classic CoS entries defined under the same subtree in order to have the subtree accounts assigned with one of two different values of a shared/generated attribute - in my case pwdpolicysubentry attribute. I want to point out that a mechanism of generating shared attributes by both CoS entries work as expected and that I defined them via bash script and not over 389 Management Console or ns-newpwdpolicy.pl script(they both work with pointer CoS and I needed classic CoS). Also, all generated attributes are visible in the Console. This is also ok. In the first test, I had in both CoS's definition entries (I will mark them here as 1) and 2) ) the "operational-default" qualifier: cosattribute: pwdpolicysubentry operational-default. Hence, I expected that the below search would not return any of the entries with generated attributes... but it did -all of them. (Entries were returned without generated attributes: this is OK as pwdpolicysubentry is an operational attribute) # ldapsearch -x -ZZ -h localhost -D "cn=directory manager" -b "ou=people,dc=example,dc=com" -w secret -s sub "(pwdpolicysubentry=*)" "*" I got the same result when in both 1) and 2) a qualifier was just cosattribute: pwdpolicysubentry operational that I consider as correct. When I modified 1) and 2) CoS definition entries to be: cosattribute: pwdpolicysubentry the ldapsearch returned none of them, but only an entry that has pwdpolicysubentry of its own. Nothing changed when I put "default" qualifier explicitly. What I expected was to return all entries - those with their own pwdpolicysubentry and the others (with the generated one). (In my example, entries with generated attributes do not have their own attributes). Finally, and the most confusing case: 1) cosattribute: pwdpolicysubentry while in 2) cosattribute: pwdpolicysubentry operational returned them all as if the qualifier in 2) have impact on CoS 1) qualifier (?!) Do you know if my version(1.2.10.7) of the server has any bug related to CoS definitions or I am something wrong? If you need more information, please ask. Thank you, Jovan Vukotic

2 1

Re: [389-users] Distributed Numeric Assignment plugin fails with indexing
by Rich Megginson 29 Mar '13

29 Mar '13

On 03/25/2013 10:07 AM, Soeren Malchow wrote: > Untitled Document > > Hi Rich, > > we tried the methods described in Nathans post, specifically indexing > the nummer assingned through DNA including the nsMatchingRule, when > indexing, the index processes exactly 1000 entries and 98% and stops > though there are 1017 entries in the database. > Does the index process hang? Or does it just report 98% and complete normally? You can use dbscan to find out exactly what's in the index. > The nsslapd-idlistscanlimit is at the default of 4000 (though we also > tried increasing it inbetween) > > To > > From dse.ldif > > <- snip-> > > nsslapd-idlistscanlimit: 4000 > > nsslapd-pagedidlistscanlimit: 0 > > <-snip-> > That isn't used for creating indexes. > > The other four databases have much less entries and there is no problem. > > Increasing the loglevel does not give anymore information, I think I > even found the code somewhere the is responsible for the error message > and for me it does not really help. > > The only other numbr that is “1000” is the dnaThreshold but that > should not have anything to do with it, nevertheless I tried > increasing it to 2000 to see if anything changes. > > This is the DNA onfiguration from dse.ldif > > ßsnip à > > dn: cn=organization-employeeNumbers,cn=Distributed Numeric Assignment > Plugin,c > > n=plugins,cn=config > > objectClass: top > > objectClass: extensibleObject > > dnaNextValue: 220380 > > dnaMaxValue: 249999 > > dnaSharedCfgDN: > cn=organizations-employeeNumbers,ou=Ranges,ou=Organizations,dc > > =XXX,dc=XXX > > dnaThreshold: 2000 > > dnaType: employeeNumber > > dnaScope: ou=Organizations,dc=XXX,dc=XXX > > dnaFilter: (objectclass=inetOrgPerson) > > dnaMagicRegen: magic > This is a problem, but not perhaps the only problem. If employeeNumber is INTEGER syntax, "magic" is not a valid value for an integer. Pick a number that cannot possibly be in your range. > cn: organization-employeeNumbers > > creatorsName: cn=directory manager > > modifiersName: > uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoo > > t > > createTimestamp: 20120831184744Z > > modifyTimestamp: 20130322022625Z > > ßsnip à > > Unfortunately we are stuck and can’t find anymore to go on. > > I already tried deleting a lot of users (approximately 50 with the DNA > attribute) trying to index again still tells me it indexed 1000 > entries (98%) > > And still it is not possible to create users, the Apache Directory > Studio displays the following error > > ßsnip à > > Error while creating entry > > - [LDAP: error code 1 - Allocation of a new value for range > cn=organization-employeenumbers,cn=distributed numeric assignment > plugin,cn=plugins,cn=config failed! Unable to proceed.] > > java.lang.Exception: [LDAP: error code 1 - Allocation of a new value > for range cn=organization-employeenumbers,cn=distributed numeric > assignment plugin,cn=plugins,cn=config failed! Unable to proceed.] > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkResponse(DirectoryApiConnectionWrapper.java:1271) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.access$600(DirectoryApiConnectionWrapper.java:110) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper$6.run(DirectoryApiConnectionWrapper.java:926) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.runAndMonitor(DirectoryApiConnectionWrapper.java:1173) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.checkConnectionAndRunAndMonitor(DirectoryApiConnectionWrapper.java:1107) > > at > org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.createEntry(DirectoryApiConnectionWrapper.java:948) > > at > org.apache.directory.studio.ldapbrowser.core.jobs.CreateEntryRunnable.createEntry(CreateEntryRunnable.java:224) > > at > org.apache.directory.studio.ldapbrowser.core.jobs.CreateEntryRunnable.run(CreateEntryRunnable.java:124) > > at > org.apache.directory.studio.connection.ui.RunnableContextRunner$1.run(RunnableContextRunner.java:113) > > at > org.eclipse.jface.operation.ModalContext$ModalContextThread.run(ModalContext.java:121) > > [LDAP: error code 1 - Allocation of a new value for range > cn=organization-employeenumbers,cn=distributed numeric assignment > plugin,cn=plugins,cn=config failed! Unable to proceed.] > > ßsnip à > > Any hint how to pinpoint the problem > Can you post the excerpt from the directory server access and errors log from around the time of the apache ds error showing the corresponding 389 ds errors? > Thanks > > Soeren > > *From:*Rich Megginson [mailto:rmeggins@redhat.com] > *Sent:* Montag, 25. März 2013 23:24 > *To:* Scott Crooks > *Cc:* General discussion list for the 389 Directory server project.; > Soeren Malchow > *Subject:* Re: [389-users] Distributed Numeric Assignment plugin fails > with indexing > > On 03/24/2013 10:08 PM, Scott Crooks wrote: > > Rich, > > Here's the information you requested. > > *389-ds-base-1.2.11.15-12.el6_4.x86_64* is the version, from the > EPEL 6 repositories. > > To be more specific, the *indexes* for that particular database > (ou=Organizations,dc=test,dc=net) are exactly at 1000, > > > I'm still not sure what you mean by 1000 - where does this number come > from? > > Nathan's post had some good information for getting more information > about DNA. > > > but the database has 1017 entries. There are 953 users > (inetOrgPerson's) in the tree (ou=Organizations,dc=test,dc=net) > that also have the employeeNumber attribute that are managed by DNA. > > The database for//ou=Organizations,dc=test,dc=net is actually > comprised of 4 databases. It's set-up like this: > > 1. Company 1: o=Company1,ou=Organizations,dc=test,dc=net has it's > own database > 2. Company 2: o=Company2,ou=Organizations,dc=test,dc=net has it's > own database > 3. Company 3: o=Company3,ou=Organizations,dc=test,dc=net has it's > own database > 4. All other companies fall within the > *ou=Organizations,dc=test,dc=net* database. > > The database mentioned above that has 1017 entries is just > the*ou=Organizations,dc=test,dc=net* one. > > If you want I can provide exact numbers for the others. > > Best Regards > > Scott Crooks > Systems Engineer > > scott.crooks(a)mcon.net <mailto:scott.crooks@mcon.net> > Phone: +86 10 8587 7441 > Mobile: +86 138 1089 8314 > http://www.mcon.net > > Logo > > > > MCON China Ltd. > Suite 1202, e-Tower > 12C Guanghua Road > Chaoyang District > Beijing 100020 > > > > *埃蒙坎信息系**统集****成技**术**(**北****京**)**有限公司** > *中国北京市朝阳区光华路丙12号 > 数码01大厦1202室 > 邮编：100020 > > Member of mcon group: Australia • Austria • China • Czech Republic > • Germany • India • Japan • Malaysia • Russia • South Korea • > Switzerland • USA > > On 03/22/2013 11:57 PM, Rich Megginson wrote: > > On 03/22/2013 03:24 AM, Scott Crooks wrote: > > Greetings, > > We're using 389-ds on CentOS 6.4 > > > What version of 389-ds-base? rpm -q 389-ds-base > > > with 3 master LDAP servers in different locations. All > three master servers have a problem adding new users in > our organization database using the DNA plugin. > > We receive the following (unhelpful) error message in the > log files: > > /[22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD begin > [22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD parameter > untagged: uid > [22/Mar/2013:09:54:37 +0800] NSUniqueAttr - ADD > target=cn=testuser01,ou=Organizations,dc=test,dc=net > *[22/Mar/2013:09:54:37 +0800] dna-plugin - dna_pre_op: > failed to allocate a new ID!! > [22/Mar/2013:09:54:37 +0800] dna-plugin - dna_pre_op: > operation failure [1] > *[22/Mar/2013:09:54:37 +0800] roles-plugin - --> roles_post_op > [22/Mar/2013:09:54:37 +0800] roles-plugin - --> > roles_cache_change_notify > [22/Mar/2013:09:54:37 +0800] roles-plugin - <-- roles_post_op/ > > We've tried indexing the uidNumber and employeeNumber > attributes as described here: > *http://www.spinics.net/linux/fedora/389-users/msg10796.html* > > One curious fact: there are exactly 1000 users in our > database for ou=Organizations,dc=test,dc=net. When > following the instructions for the above link, the log > outputs the following > > */organizations: Indexing attribute: employeenumber > organizations: Indexed 1000 entries (97%). > organizations: Finished indexing./*/ > / > Our organization uses employeenumber rather than > uidNumber, but they're the same in the end. We find it > strange that the user creation fails at *exactly* 1000 > entries. > > > What do you mean "user creation fails at exactly 1000 > entries"? Do you mean "after adding the 1000th user entry"? > The error above is from attempting to add cn=testuser01 - was > that the 1000th user entry? > > > > Any ideas on where the configuration is wrong? We assume > it's a configuration problem. > > Best Regards > > Scott Crooks > Systems Engineer > > scott.crooks(a)mcon.net <mailto:scott.crooks@mcon.net> > Phone: +86 10 8587 7441 > Mobile: +86 138 1089 8314 > http://www.mcon.net > > Logo > > > > MCON China Ltd. > Suite 1202, e-Tower > 12C Guanghua Road > Chaoyang District > Beijing 100020 > > > > *埃蒙坎信息系**统集****成技**术**(**北****京**)**有限公司** > *中国北京市朝阳区光华路丙12号 > 数码01大厦1202室 > 邮编：100020 > > Member of mcon group: Australia • Austria • China • Czech > Republic • Germany • India • Japan • Malaysia • Russia • > South Korea • Switzerland • USA > > > > > -- > > 389 users mailing list > > 389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org> > > https://admin.fedoraproject.org/mailman/listinfo/389-users >

2 2

Error code '-11 - System error'
by alexandre 29 Mar '13

29 Mar '13

Hello, in the replication, I have enable Replica and put Multiple Master replica role with a Current Supplier DNs. I made a new Windows Sync Agreement, after is done I try to "initiate full re-synchronisation" I get : *The consumer initialization has unsuccessfully completed. * *The error received by the replica is: '-11 - System error'* If somebody knows how pass trough. Thanks a lot ! Alex

1 0

Fwd: Certificate between 389DS and Active Directory
by alexandre 28 Mar '13

28 Mar '13

Hello, just to explain why I'm in confusion, I saw this line on redhat procedure: "Import the CA certificate from Directory Server into Active Directory. Click *Trusted Root CA*, then *Import*, and browse for the Directory Server CA certificate." and this one on a website: "#This exports the server-cert which you will need on the windows AD pk12util -d . -o servercert.p12 -n Server-Cert" So I check, and I don't have any "servercert.p12" in my directory server (/etc/dirsrv/slapd-389/) I go to install the Password Sync in my Domain Controller, hope it works ;) Thanks of the community. 2013/3/27 alexandre <axel0felix(a)gmail.com> > Yes you're right, I was speaking for my domain controller (it have > automatically on the trusted root certification authorithy... And I made a > webenrollment request from my 38ds and install the CA cert on my 389ds... > > thanks > Le 27 mars 2013 17:51, "Rich Megginson" <rmeggins(a)redhat.com> a écrit : > > On 03/27/2013 10:32 AM, alexandre wrote: >> >> My CA is on my domain controller. >> >> >> Then it is not going to be in the list of "Trusted Root Certification >> Authorities" on the 389 machine unless you install it. >> >> Le 27 mars 2013 17:11, "Rich Megginson" <rmeggins(a)redhat.com> a écrit : >> >>> On 03/27/2013 10:07 AM, alexandre wrote: >>> >>> Ok now I know where my confusion come from. So just to check, in my >>> case the CA cert that issued the 389DS server cert is automatically in my >>> "Trusted Root Certification Authorities" because my authority is on my >>> domain controller !? >>> >>> >>> I don't know. What is the CA? >>> >>> >>> Thanks ! >>> Alex >>> >>> >>> 2013/3/27 Rich Megginson <rmeggins(a)redhat.com> >>> >>>> On 03/27/2013 09:53 AM, alexandre wrote: >>>> >>>> Yes I understand that. >>>> >>>> To resume, I have a server-cert and a CA cert in my 389DS. I have a CA >>>> cert in my active directory. >>>> >>>> So I need server cert in my AD !? >>>> >>>> >>>> No. AD only needs the CA cert of the CA that issued the 389DS server >>>> cert. >>>> >>>> >>>> >>>> I don't really understand "But you must generate cert for DS on AD >>>> CA", if I did a request by web-enrollment from my 389DS, and install it on >>>> my 389DS, it's good like that ? >>>> >>>> >>>> Yes. But PassSync doesn't use the Windows/AD Trusted Cert store, so >>>> you still have to export that CA cert and install it using certutil, as >>>> described in the documentation for setting up PassSync. >>>> >>>> >>>> >>>> Thanks a lot ! >>>> Alex >>>> >>>> >>>> 2013/3/27 Grzegorz Dwornicki <gd1100(a)gmail.com> >>>> >>>>> Yes and that button allows you to install server cert (again generated >>>>> in your case on AD CA) . CA tab allows you to install CA cert. >>>>> >>>>> Greg. >>>>> 27 mar 2013 16:33, "alexandre" <axel0felix(a)gmail.com> napisał(a): >>>>> >>>>> Sorry my capture is not on the mail, it's the point 12.2.1. >>>>>> 4.c.Go to the *CA Certs* tab, and click *Install* at the bottom of >>>>>> the window. >>>>>> On this link: >>>>>> https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/9.0… >>>>>> >>>>>> Thanks >>>>>> >>>>>> >>>>>> 2013/3/27 alexandre <axel0felix(a)gmail.com> >>>>>> >>>>>>> Thanks for the new Link ! >>>>>>> >>>>>>> @Rich Megginson "It's not the 389DS server certificate, but the >>>>>>> CA certificate for the CA that issued the 389DS server certificate, that >>>>>>> you need for PassSync" >>>>>>> >>>>>>> @Grzegorz Dwornicki "But you must generate cert for DS on AD CA. >>>>>>> Then you need to import this cert with AD CA cert on DS" >>>>>>> >>>>>>> Sorry I don't understand "CA certificate for the CA that issued >>>>>>> the 389DS server certificate", I have to export this one below to the AD? >>>>>>> (it's empty on this capture, but with CA certificate on my directory >>>>>>> server): >>>>>>> >>>>>>> >>>>>>> >>>>>>> @Grzegorz Dwornicki --> do you have a procedure to do that ? I >>>>>>> don't find in redhat documentation. (when you said AD CA, do you considerthat AD CA = Authority installed on my AD ?) >>>>>>> >>>>>>> Many thanks, for your answers. And your patience about my >>>>>>> translation problems. >>>>>>> >>>>>>> Best regards, >>>>>>> Alex >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> 2013/3/27 Grzegorz Dwornicki <gd1100(a)gmail.com> >>>>>>> >>>>>>>> I had missunderstood you im this case. No you don't need to create >>>>>>>> second CA. But you must generate cert for DS on AD CA. Then you need to >>>>>>>> import this cert with AD CA cert on DS >>>>>>>> >>>>>>>> Greg. >>>>>>>> 27 mar 2013 15:41, "alexandre" <axel0felix(a)gmail.com> napisał(a): >>>>>>>> >>>>>>>> I'm really impressed by the reactivity of this list !!! >>>>>>>>> >>>>>>>>> Sorry my understanding is not perfect because i'm french, so I >>>>>>>>> don't have any CA in my DS, I have one CA (installed on my domain >>>>>>>>> controller). >>>>>>>>> >>>>>>>>> Do I need to install a CA in my DS ? (when I write CA for me it >>>>>>>>> means a Authority). >>>>>>>>> >>>>>>>>> >>>>>>>>> Alex >>>>>>>>> >>>>>>>>> >>>>>>>>> 2013/3/27 Grzegorz Dwornicki <gd1100(a)gmail.com> >>>>>>>>> >>>>>>>>>> If you have diferent CA in AD vs DS then you need to do this >>>>>>>>>> import. >>>>>>>>>> >>>>>>>>>> AD by default don't use LDAPS or STARTSSL soo you need to install >>>>>>>>>> ms cert CA stuff. >>>>>>>>>> >>>>>>>>>> Greg. >>>>>>>>>> 27 mar 2013 15:07, "alexandre" <axel0felix(a)gmail.com> napisał(a): >>>>>>>>>> >>>>>>>>>>> Hello, >>>>>>>>>>> >>>>>>>>>>> I try to follow this procedure : >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/8.2… >>>>>>>>>>> >>>>>>>>>>> Everything works fine, except I don't understand right this >>>>>>>>>>> line: >>>>>>>>>>> >>>>>>>>>>> "Import the CA certificate from Directory Server into Active >>>>>>>>>>> Directory. Click *Trusted Root CA*, then *Import*, and browse >>>>>>>>>>> for the Directory Server CA certificate." >>>>>>>>>>> >>>>>>>>>>> For me CA certificate, it's a certificate from the Authority, >>>>>>>>>>> so in my Active Directory the certificate from the authority is already >>>>>>>>>>> know in the Trusted Root CA. >>>>>>>>>>> >>>>>>>>>>> So, do I need to import 389DS server certificate in my active >>>>>>>>>>> directory ? >>>>>>>>>>> >>>>>>>>>>> And finally, there is no indication to do that, someone can >>>>>>>>>>> help me to pass through ? >>>>>>>>>>> >>>>>>>>>>> Thanks in advance. >>>>>>>>>>> >>>>>>>>>>> Best regards, >>>>>>>>>>> Alex >>>>>>>>>>> >>>>>>>>>>> -- >>>>>>>>>>> 389 users mailing list >>>>>>>>>>> 389-users(a)lists.fedoraproject.org >>>>>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>>>>>>> >>>>>>>>>> >>>>>>>>>> -- >>>>>>>>>> 389 users mailing list >>>>>>>>>> 389-users(a)lists.fedoraproject.org >>>>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>>>>>> >>>>>>>>> >>>>>>>>> >>>>>>>>> -- >>>>>>>>> 389 users mailing list >>>>>>>>> 389-users(a)lists.fedoraproject.org >>>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>>>>> >>>>>>>> >>>>>>>> -- >>>>>>>> 389 users mailing list >>>>>>>> 389-users(a)lists.fedoraproject.org >>>>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>> -- >>>>>> 389 users mailing list >>>>>> 389-users(a)lists.fedoraproject.org >>>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>>> >>>>> >>>>> -- >>>>> 389 users mailing list >>>>> 389-users(a)lists.fedoraproject.org >>>>> https://admin.fedoraproject.org/mailman/listinfo/389-users >>>>> >>>> >>>> >>>> >>>> -- >>>> 389 users mailing list389-users@lists.fedoraproject.orghttps://admin.fedoraproject.org/mailman/listinfo/389-users >>>> >>>> >>>> >>> >>> >>

1 0

MemberOf Plugin Question
by Chandan Kumar 27 Mar '13

27 Mar '13

Hello, So far I have been managed to do some setup of 389 server, thanks to prompt community. Now, I am having some trouble in getting the MemberOf plugin work for 389-ds-base-1.2.11.15-11. When I add a user into a group, the memberOf attribute is not being added to the user entry. While googling a bit I came across an older post of this group http://www.redhat.com/archives/fedora-directory-users/2009-December/msg0016… based on that, I checked dse.ldif and the Plugin configuration also looks good. dn: cn=MemberOf Plugin,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject cn: MemberOf Plugin nsslapd-pluginPath: libmemberof-plugin nsslapd-pluginInitfunc: memberof_postop_init nsslapd-pluginType: postoperation nsslapd-pluginEnabled: on nsslapd-plugin-depends-on-type: database memberofgroupattr: uniqueMember memberofattr: memberOf nsslapd-pluginId: memberof nsslapd-pluginVersion: 1.2.11.15 nsslapd-pluginVendor: 389 Project nsslapd-pluginDescription: memberof plugin modifiersName: cn=directory manager modifyTimestamp: 20130322162350Z The way I am adding users : dn: uid=chandank,ou=People,dc=ma,dc=net objectclass: person objectclass: inetorgperson objectclass: posixAccount cn: Chandan sn: k givenName: chandank uid:chandank uidNumber:5006 gidNumber:5006 objectclass: mepOriginEntry mepManagedEntry: cn=chandank homeDirectory: /home/chandank loginShell: /bin/bash The way I am adding them into a group: dn: cn=sys,ou=Groups,dc=ma,dc=net changetype: modify add: uniqueMember uniqueMember: uid=chandank,ou=People,dc=ma,dc=net And after I have added the user I am expecting an MemberOf attribute entry in the user entry itself. I am not sure whether it is the right way to do so. For the records: Having MemberOf attribute in the user entry would allow me use ldap Access filters in sssd.conf file eg. "ldap_access_filter = memberOf=cn=allowedusers,ou=Groups,dc=example,dc=com" and hence will be able to restrict users from login on different systems. Thanks Chandan -- -- http://about.me/chandank

2 4

Certificate between 389DS and Active Directory
by alexandre 27 Mar '13

27 Mar '13

Hello, I try to follow this procedure : https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Directory_Server/8.2… Everything works fine, except I don't understand right this line: "Import the CA certificate from Directory Server into Active Directory. Click *Trusted Root CA*, then *Import*, and browse for the Directory Server CA certificate." For me CA certificate, it's a certificate from the Authority, so in my Active Directory the certificate from the authority is already know in the Trusted Root CA. So, do I need to import 389DS server certificate in my active directory ? And finally, there is no indication to do that, someone can help me to pass through ? Thanks in advance. Best regards, Alex

3 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users March 2013