389-users July 2016

389-users@lists.fedoraproject.org

13 participants
17 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

MemberOf group restrictions to a client system (server and client running CentOS 7)
by Janet Houser 06 Aug '20

06 Aug '20

Hi, I'm new to 389-ds and last week downloaded and installed the software. I have a running instance of the server, and I've added TLS/SSL. I've configured a CentOS 7 client to be able to query the server using TLS/SSL, and all appears working. I've created users and groups on the 389-ds server successfully. For each user and group, I've enabled posix attributes and my client can see the unix users and groups using the "getent password" or "getent group" commands. Now, here's where I'm getting tripped up.......... I need to limit which users have access to which systems. I've been trying to do this via memberOf group limitations. I found the following online resource (https://thornelabs.net/2013/01/28/aix-restrict-server-login-via-ldap-groups…) which is close enough to CentOS that the initial commands worked. I enabled the MemberOf plugin and changed the attributes per the link, and restarted the system. I created a test group (that I didn't enable a posix GID) and tried to add a single user via: Right click on group -- > click Properties --> then Members --> click Add --> Search for user --> click Add. When I try to go this route (which worked before enabling the memberOf plugin) it worked. Now it seems I get the error: "Cannot save to directory server. netscape.ldap.LDAPException: error resiult(65): Object class violation" And the messages file throws the error (/var/log/dirsrv/slapd-<instancename>/errors: "Entry "uid=test,ou=People,dc=int,dc=com" -- attribute "memberOf" not allowed [17/Feb/2016:11:22:58 -0700] memberof-plugin - memberof_postop_modify: failed to add dn (cn=testgroup,ou=Groups,dc=int,dc=com) to target. Error (65)" So it seems my server isn't quite using the memberOf plugin properly, but I'm not sure what else to enable. I'll have to solve this issue before I even try to filter login access via groups on my client system. I should mention that if I go under the advanced tab for one of the groups I created, I can add the the attribute "uniquemember", but I'm not sure what I should set the "value" to be. I've tried creating new users to see if I could set their "uniquemember" attributes, but no luck. It seems that I don't have the ability to set this attribute on individual users, only groups. This might not be the right road to head down when trying to restrict access to servers via groups, so I'm open to any suggestions. Any suggestions would be appreciated.

6 19

ldapsearch doesn't return the userpassword field
by Janet Houser 14 May '18

14 May '18

Hi, I've been looking through the archives for information, but I haven't stumbled on a solution to my problem. I'm running ds-389 (389-ds-base-1.3.4.0) on a centos 7 box (CentOS Linux release 7.2.1511). I have a centos OS client configured using SSL/TLS which queries the LDAP server. Per a previous thread, I configured the memeberOf plugin and all seems to be working properly. I have a php script that will run on the client and change the LDAP password for the user. The problem is, the script looks for the SSHA has of the password when an ldapsearch is issued. However, when I issue a general ldapsearch (anonymously) I don't get the userpassword field. I read in your archives that I might have to be the "directory manager" user in order to see the hashed password. I've been playing around with the ldapsearch syntax, but I can't quite get it right. Anyway, my question is, can I set a flag in 389-ds that will display the hashed userpassword? I think that will solve my problem with the php script returning an error that it can't retrieve the old password. Thanks,

5 12

Promoting two replicas to master/replica
by Gary Algier 01 Aug '16

01 Aug '16

Hello, I have an old directory server (Sun's) as a master and it is replicating to two slave 389 servers. I want to pull the plug on the old server and promote one of the replicas to a master. Here's what it looks like: - Server A, running old DS. Master. - Server B, running 389 DS. Consumer of A. - Server C, running 389 DS. Consumer of A. I want: - Server B, running 389 DS. Master. - Server C, running 389 DS. Consumer of B. What's the easiest way to make this happen with minimal (0?) downtime? My guess would be I should first make C and consumer of B. But how do I easily "promote" B? All the docs I find talk about multimaster. I don't think I am ready to go there yet. -- Gary Algier

2 4

Operational attributes
by Mitja Mihelič 27 Jul '16

27 Jul '16

Hi! We have an application, that does not honour the shadowExpire attribute. It does however use a search filter to find users. The idea is, that we would extend the search filter to include an additional attribute. We would then set this attribute to 0 or 1 and the filter would NOT return users that have it set to 0. Missing or set to 1 and the user gets returned. The search filters themselves do not provide any advanced comparisons like: if (shadowExpire =< today) then... Operation attributes seem to provide some more flexibility there. We could solve the problem if we could set up an operational attribute that would do if (shadowExpire =< today) then return 0 else return 1 Is it possible to add one's own operational attributes to 389DS? If it is, how should it be done the right way? Kind regards, Mitja -- Mitja Mihelič ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia tel: +386 1 479 8800, fax: +386 1 479 88 99

3 3

Detected Disorderly Shutdown last time Directory Server was running, recovering database.
by Carlos Barrabes 26 Jul '16

26 Jul '16

Hello, we have a Fedora22 machine running 380 + Dogtag 10.2. Everything has been running smooth until today when we realized the DS was down and wouldn't go up. After checking all the logs, we got this error message: Detected Disorderly Shutdown last time Directory Server was running, recovering database. We have even tried to reboot the entire server but the problem persists. Any suggestions on how to fix this will be really appreciated :D Thanks!

2 5

Announcing 389 Admin Server 1.1.43 and Consoles for EPEL6
by Noriko Hosoi 25 Jul '16

25 Jul '16

389 Admin Server 1.1.43 and Consoles for EPEL6 The 389 Directory Server team is proud to announce 389-admin version 1.1.42, 389-adminutil version 1.1.22, 389-console version 1.1.16, 389-ds-console version 1.2.12, 389-admin-console version 1.1.11, and idm-console-framework version version 9.1.2. Fedora packages are available from the EPEL6. The new packages and versions are: * 389-admin-1.1.43-1 * 389-adminutil-1.1.22-1.el6 * 389-console-1.1.17-1.el6 * 389-ds-console-1.2.12-2.el6 * 389-admin-console-1.1.11-1.el6 * idm-console-framework-1.1.15-1.el6 Source tarballs are available for download at Download Admin Source <http://www.port389.org/binaries/389-admin-1.1.43.tar.bz2>, Download Adminutil Source <http://www.port389.org/binaries/389-adminutil-1.1.22.tar.bz2>, Download 389-console Source <http://www.port389.org/binaries/389-console-1.1.17.tar.bz2>, Download 389-ds-console Source <http://www.port389.org/binaries/389-ds-console-1.2.12.tar.bz2>, Download 389-admin-console Source <http://www.port389.org/binaries/389-admin-console-1.1.11.tar.bz2>, and Download idm-console-framework Source <http://www.port389.org/binaries/idm-console-framework-1.1.15.tar.bz2>. Highlights in 389-admin-1.1.43, 389-adminutil-1.1.22, 389-console-1.1.17, 389-ds-console-1.2.12, 389-admin-console-1.1.11, and idm-console-framework-1.1.15 * Releasing the latest versions for EPEL6 Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* to set up your directory server. setup-ds-admin.pl To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* to update your directory server/admin server/console information. setup-ds-admin.pl -u See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… and following pages: * https://admin.fedoraproject.org/updates/389-admin-1.1.43-1.el6 <https://admin.fedoraproject.org/updates/389-admin-1.1.43-1.el6> * https://admin.fedoraproject.org/updates/389-adminutil-1.1.22-1.el6 <https://admin.fedoraproject.org/updates/389-adminutil-1.1.22-1.el6> * https://admin.fedoraproject.org/updates/389-console-1.1.17-1.el6 <https://admin.fedoraproject.org/updates/389-console-1.1.17-1.el6> * https://admin.fedoraproject.org/updates/389-ds-console-1.2.12-2.el6 <https://admin.fedoraproject.org/updates/389-ds-console-1.2.12-2.el6> * https://admin.fedoraproject.org/updates/389-admin-console-1.1.11-1.el6 <https://admin.fedoraproject.org/updates/389-admin-console-1.1.11-1.el6> * https://admin.fedoraproject.org/updates/idm-console-framework-1.1.15-1.el6 <https://admin.fedoraproject.org/updates/idm-console-framework-1.1.15-1.el6> If you find a bug, or would like to see a new feature, file it in our Trac instance: https://fedorahosted.org/389 Detailed Changelog since 389-admin-1.1.35 * Ticket 48762 - 389-admin uses 389-admin-git.sh which uses HTTP to download content from git (should use HTTPS) * Ticket 48429 - running remove-ds-admin.pl multiple times will make it so you cannot inst all DS * Ticket 48409 - RHDS upgrade change Ownership of certificate files upon upgrade. * Ticket 47548 - register-ds-admin - silent file incorrectly processed * Ticket 47493 - Configuration Tab does not work with FIPS mode enabled * Ticket 48186 - register-ds-admin.pl script prints clear text password in the terminal * Ticket 47548 - register-ds-admin.pl fails to set local bind DN and password * Ticket 47467 - Improve Add CRL/CKL dialog and errors * Ticket 48171 - remove-ds-admin.pl removes files in the rpm * Ticket 48153 - “Manage certificates” crashes admin server * Ticket 48024 - repl-monitor invoked from adminserver cgi fails * Ticket 47995 - multiple /tmp/ file vulnerabilities [directory_server_10] * Ticket 47901 - Admin Server reconfig breaks SSL config * Ticket 47929 - Admin Server - disable SSLv3 by default * Ticket 201 - nCipher HSM cannot be configured via the console * Ticket 47493 - Configuration Tab does not work with FIPS mode enabled * Ticket 47697 - Resource leak in lib/libdsa/dsalib_updown.c * Ticket 47860 - register-ds-admin.pl problem when following steps to replicate o=netscaperoot * Ticket 47548 - register-ds-admin does not register into remote config ds * Ticket 47893 - Admin Server should use Sys::Hostname instead Net::Domain * Ticket 47891 - Admin Server reconfig breaks SSL config * Ticket 47300 - Update man page for remove-ds-admin.pl * Ticket 47850 - “nsslapd-allow-anonymous-access: rootdse” makes login as “admin” fail at the first time * Ticket 47497 - Admin Express - remove “Security Level” * Ticket 47495 - admin express: wrong instance creation time * Ticket 47665 - Create new instance results in setting wrong ACI for the “cn=config” entry * Ticket 47478 - No groups file? error restarting Admin server * Ticket 47300 - [RFE] remove-ds-admin.pl: redesign the behaviour * Ticket 434 - admin-serv logs filling with “admserv_host_ip_check: ap_get_remote_host could not resolve “ * Ticket 47563 - cannot restart directory server from console * Ticket 222 - Admin Express issues “Internal Server Error” when the Config DS is down. * Ticket 418 - Error with register-ds-admin.pl * Ticket 47498 - Error Message for Failed to create the configuration directory server Detailed Changelog since 389-adminutil-1.1.19 * Ticket 48152 - “Manage certificates” crashes admin server * Ticket 47929 - adminutil - future proof getSSLVersion * Ticket 47929 - Adminutil - do not use SSL3 by default * Ticket 47850 - “nsslapd-allow-anonymous-access: rootdse” makes login as “admin” fail at the first time * Ticket 47881 - crash during debug session in adminutil * Ticket 47680 - Upgraded 389-admin rpms and now I can’t start dirsrv-admin * Ticket 47415 - “Manage certificates” crashes admin server * Ticket 47486 - compiler warnings in adminutil, admin, dsgw * Ticket 47343 - 389-adminutil: Does not support aarch64 in f19 and rawhide Detailed Changelog since 389-console-1.1.7 * Bug 1304595 - Console – Update Java dependency to 1.8 * Bug 1022104 - Remove versioned jar files Detailed Changelog since 389-ds-console-1.2.6 * Bug 1234441 - Security info from Help should be removed * Console – Update Java dependency to 1.8 * Ticket 48417 - Security info from Help should be removed (partial) * Ticket 48139 - drop support for legacy replication * Ticket 48130 - Add “+all” and “-TLS_RSA_WITH_AES_128_GCM_SHA256” to Console Cipher Preference for TLS * Ticket 47994 - DS Console always sets nsSSL3 to “on” when a security setting is adjusted * Ticket 47380 - RFE: Winsync loses connection with AD objects when they move from the console. * Ticket 135 - DS console - right clicking an object does not select that object * Ticket 47887 - DS Console does not correctly disable SSL * Ticket 47485 - DS instance cannot be restored from remote console * Ticket 47886 - DS Console - mouse wheel speed very slow * Ticket 176 - DS Console should timeout when mismatched port and protocol combination is chosen * Ticket 47883 - DS Console - java exception when refreshing schema * Ticket 96 - Window too large for Manage password policy * Ticket 370 - Opening merge qualifier CoS entry using RHDS console changes the entry Detailed Changelog since 389-admin-console-1.1.8 * Bug 723126 - Configure Admin Server -> Connection Restriction –> Add Screen is flicking consistently. * Bug 1022104 - Remove versioned jarfiles from _javadir * Ticket 48417 - Security info from Help should be removed * Ticket 362 - Directory Console generates insufficient key strength * Ticket 47467 - Improve online help for Add CRL dialog * Ticket 47477 - Cannot restart SSL-admin server from console Detailed Changelog since idm-console-framework-1.1.7 * Ticket 48811 - Console window could be hidden after login via consoles on multiple hosts * Console – Update Java dependency to 1.8 * Ticket 48187 - Adding an OU from console is throwing missing attribute aliasedObjectName error * Ticket 48134 - Directory Server Admin Console: plaintext password logged in debug mode * Ticket 47946 - Adding an ACI from the GUI removes broken ACIs * Ticket 47946 - Need to revise console aci syntax checking * Ticket 97 - 389-console should provide usage options, help, and man pages * Ticket 48130 - Add “+all” and “-TLS_RSA_WITH_AES_128_GCM_SHA256” to Console Cipher Preference for TLS * Ticket 48134 - Directory Server Admin Console: plaintext password logged in debug mode * Ticket 47929 - idm-console-framework - set default min to tls1.0 * Ticket 47946 - ACI’s are replaced by “ACI_ALL” after editing group of ACI’s including invalid one * Ticket 47929 - Console - add tls1.1 support * Ticket 47472 - Entries cannot be highlighted in the “Edit Aci” Rights panel * Ticket 47364 - Console does not support passwords containing 8-bit characters * Ticket 47604 - idm-console-framework: remove versioned jars from %{_javadir} * Ticket 47480 - Admin Console “server restart dialog” disappears after clicking OK * Ticket 47467 - Improve CRL import dialog text * Ticket 362 - Directory Console generates insufficient key strength * Bug 1022104 - Do not use versioned jars * using new upstream git repo at fedorahosted.org

1 0

advice for multiple domains
by Adrian HY 25 Jul '16

25 Jul '16

Hi folks, I need to centralize the authentication of three different domains with 389-DS. It is possible?

1 0

advice for multiple domains
by Adrian HY 25 Jul '16

25 Jul '16

Hi folks, I need to centralize the authentication of three different domains with 389-DS. It is possible?

1 0

Multi Master Replication with SSL Error when creating replication agreement
by dannyboy10177＠hotmail.com 25 Jul '16

25 Jul '16

Hi I have tried to follow http://directory.fedoraproject.org/docs/389ds/howto/howto-walkthroughmultim… to setup a multimaster setup with 389 LDAP servers. I have 2 servers and I have clients connected to both using SSL to authenticate. Both servers are from the same certificate chain. When I try and set up the replication agreement between the LDAP instances I get an error "Consumer server unreachable or invalid credentials supplied. Unable to perform subtree duplication verfication." At this point I have followed the instructions and have a consumer with 636 use TLS/SSL selected and the correct simple bind DN set to cn=replication manager, cn=config. If I ignore this message and continue and try and initialize the agreement I see errors under /var/log/dirsrv/sldapd-xxxx/ SSL connection from x.x.x.x to x.x.x.x closed peer cannot verify your certificate. Now as I am using simple bind does it still need to use certificates? and if both are from the same CA should this just work?

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users July 2016