389-users July 2014

389-users@lists.fedoraproject.org

28 participants
32 discussions

DS SSL cfg
by ghiureai 22 Jul '14

22 Jul '14

Hello List, I would like to know if DS can be cfg for TLS/SSL + CA connections later one or must to be done at installation time ? Isabella -- -

2 1

synchronize 389DS uid with userPrincipalName from Active Directory
by Mihai Carabas 22 Jul '14

22 Jul '14

Hi, We are currently using 389-DS as a LDAP server for our university (University Politehnica from Bucharest). Right now we have about 35000 accounts created into the 389-DS. We need to synchronize all the accounts with an Active Directory server for various purposes (Wifi authentication/e-mail authentication, etc). I've setup the 389-DS / Active Directory replication succesfully but we have a design problem: a very high number of users has the username (uid: field) larger than 20 characters and I can't pass this uid to the ntUserDomainId (which is equivelant with the sAMAccount in AD). Is there any way that I can populate the userPrincipalName with this uid? (which does not have the limit indicated above) Thank you in advance, Mihai

2 4

LDAP Authenticated User Unable to Overwrite a File
by Paul Whitney 21 Jul '14

21 Jul '14

I am having an issue where and LDAP authenticated user cannot overwrite or remove a file on the LDAP-client system even though the permission are set to 777. However, the user is able to create a new file (file is owned by that user) and can be removed by that user. Is there some limitation on actions on a file owned by different user but permissions set to 777 (rwxrwxrwx)? I have checked to make sure no special attributes are enabled on the file (lsattr). Thanks Paul M. Whitney E-mail: paul.whitney(a)mac.com Cell: 410.493.9448 Sent from my browser.

1 1

service desk account can no longer modify passwords
by Elizabeth Jones 21 Jul '14

21 Jul '14

We have a service desk account that I created in our LDAP that has the ability to add/delete/modify all our user accounts. Except that now that we have password policy in place, it can no longer modify our user account passwords. I have confirmed that the password changes that it is doing conform to our password policy, but every time it comes back with constraint violation. But I can do anything with password changes as directory manager. One thing that I haven't confirmed is whether the accounts that they are trying to change are accounts that have expired. So does anyone know if an account has locked, can only directory manager change the password at that point? Or does anyone know what attributes I would need to have on my servicedesk account to allow it to change these passwords now? I don't want to give them directory manager if I can avoid it but I need to find some way to let them override password policy! thanks, EJ

1 0

Questions about 389 Directory Server
by Cary Lee Dailey 17 Jul '14

17 Jul '14

We are conducting research on different options for an LDAP related project we are working on. I have been asked to find answers to the following questions about 389: - max number of users/groups it can support - Integration with Oracle 11g? - Integration with OAM? - Current clients who use this. If anyone could help me out that would be great. Appreciate the info. Thanks, -- *Cary Lee Dailey, PMP®* *Business Analyst * Office 703-917-8188, ext. 112 Cell 703-220-7256 carylee.dailey@arrayinfotech [image: cid:image009.jpg@01CDE763.B9372570] <http://www.arrayinfotech.com/> 7474 Greenway Center Drive, Suite 600 Greenbelt, MD 20770 [image: Facebook_icon.jpg]Like ARRAY <http://www.facebook.com/pages/Array-Information-Technology/196357113747649?…> | [image: Twitter_icon.jpg] Follow ARRAY <https://twitter.com/ArrayInfoTech> | [image: Linkedln_icon.jpg] Join ARRAY <http://www.linkedin.com/company/array-information-technology-inc>

1 0

memberof plugin not working as expected
by Alberto Viana 16 Jul '14

16 Jul '14

Hi, 389-Directory/1.3.2.13 B2014.141.1513 I recently updated my server to 1.3.2.13 and the "memberof" plugin is not working as expected, it's not updating my user "memberOf" attribute whe I put a user in a group. How can I debug it? I tried to set my nsslapd-errorlog-level to 65536 but could not find any useful information. Thanks Alberto Viana

4 11

password policy
by Elizabeth Jones 16 Jul '14

16 Jul '14

We seem to have something odd going on with our password policy. I configured global password policy on our LDAPs so that all accounts under our userRoot subtree expire, then under the subtrees that contain our service accounts I configured to never expire. But I just noticed that the accounts under those subtrees actually have expiration date attributes. I went into one of the accounts and set the password policy explicitly on that account, but the attribute still shows that it is going to expire two days from now. So I'm waiting to see what happens in two days - will the password policy that I set for the subtree/user work, or will it expire because the attribute is set to make it expire. I'm kind of confused as to why it would even have that attribute set when the subtree is set to never expire. EJ

1 0

Server crash after some paged search
by carne_de_passaro 15 Jul '14

15 Jul '14

Hi all, I have a customer which have installed 389-ds-base-1.2.11.15-32.el6_5.x86_64 on his server. This server is acting as a HUB, cascading replications from the master to the slave servers. The issue is the fact of this server dies some times during a day. I look to the error log and see messages like this "pagedresults_parse_control_value: invalid cookie: -1" nothing relevant before it, and after it, I see that message when the server was started up. In my research on the internet, I've found this bug [1], which was already corrected. So my question right now is: Which version, exactly, this bug was corrected? In the webpage, it's say version 1.2.11, but how can I know if the version I'm using have this bug corrected? Thanks in advance. [1] https://fedorahosted.org/389/changeset/b2ee65dd6c4af4f2cab515406a6f7fd9f1dc…

2 2

new to 389DS - have Q's
by ghiureai 15 Jul '14

15 Jul '14

Hi Gurus, I'm new to 389 DS reading the RH DS docbefore start implementing, have Q's trying tohave system with high performance cfg Q1: Bellow in black is from RH DS documentation, I was expecting just creating the indexes in GUI DS console should be suficient , is this the correct, still need to run the manually script? Q2: What are operations to maintain the indexes are any updates statistics, reorg rebuild need to be run to maintainthe high performance in DS? Q3: Access controls what 's average of user rules do you ususually have per db or user. are there any maintenance jobs to perform, I believe the more AC rules you have you have the chance to affect login performance , is this correct? -- ----------------------------------------------------------- 9.3. Applying New Indexes to Existing Databases New indexes are not added to existing databases automatically. They must be added manually, and Directory Server has two methods for applying new indexes to an existing database: running the |db2index.pl| script or running a |cn=index,cn=tasks| task. Isabella A. Ghiurea Isabella.Ghiurea(a)nrc-cnrc.gc.ca Canadian Astronomy Data Centre |http://www.nrc-cnrc.gc.ca/eng/services/hia/data-centre.html National Research Council of Canada, Herzberg Institute of Astrophysics 5071 West Saanich Road, Victoria BC V9E 2E7, Canada Phone: 250 363-3446 fax: 250 363-0045

2 1

LDAP host standby solution
by ghiureai 14 Jul '14

14 Jul '14

Hi LDAPUSERS, I would like a design cfg suggestionfor implementing a hot standby LDAP solution, would multimmaster configuration be sufficient? I need some cfg which will switch the clients instantaneous to a second master , transparent to clients, no downtime and "0" loss of transactions. Thank you Isabella --

4 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2014