389-users April 2018

389-users@lists.fedoraproject.org

16 participants
19 discussions

Is it possible to show user only groups he belongs to via ACI
by Mariusz Gronczewski 17 Apr '18

17 Apr '18

Hi, Each of our users have DN like uid=xani,ou=users,dc=root,dc=example,dc=com There is also group hierarchy with POSIX groups having users as memberUid I have aci (at the ou=groups): (targetattr = "*") (targetfilter = (|(memberUid=xani)(ou=groups))) (version 3.0;acl "test auth";allow (read,compare,search)(userdn = "ldap:///anyone");) that allows a certain user to see only POSIX groups where they belong by filtering them by (memberUid=xani). Is it possible to make a filter that would do same but dynamically take current binded user uid in the filter. Basically I'd like to filter by (memberUid=$binded_user_uid), is that possible ?

2 2

Help with ldapsearch query
by Sergei Gerasenko 16 Apr '18

16 Apr '18

Hi, I need to get a list of hosts from 389-ds that have ipaSshPubKey set and I’m having trouble contructing that. I’ve tried this: ldapsearch -h HOST -b cn=computers,cn=accounts,dc=cnvr,dc=net 'ipaSshPubKey=*’ … but that doesn’t seem to work. Am I missing something simple? Thanks, Sergei

3 4

sd_notify called before 389-ds really ready?
by dave_horton2001＠hotmail.com 15 Apr '18

15 Apr '18

I have a service on my 389-ds host that is configured in systemd to depend on 389-ds and start after dirsrv.target. However, unless I add a sleep (ExecStartPre systemd stanza) to the startup of that other service it fails to start as 389 is not fully ready. I can see that systemd is respecting the dependencies, but the client starts before 389 is able to accept its connection. 389-ds appears to use the notify systemd service type. Is it possible that sd_notify is being called before the services are truly ready to accept client connections?

2 1

Announcing 389 Directory Server 1.4.0.7
by Mark Reynolds 13 Apr '18

13 Apr '18

389 Directory Server 1.4.0.7 The 389 Directory Server team is proud to announce 389-ds-base version 1.4.0.7 Fedora packages are available on Fedora 28 and 29(rawhide). Rawhide(F29) https://koji.fedoraproject.org/koji/taskinfo?taskID=26347575 <https://koji.fedoraproject.org/koji/taskinfo?taskID=26347575> F28 https://koji.fedoraproject.org/koji/taskinfo?taskID=26348320 <https://koji.fedoraproject.org/koji/taskinfo?taskID=26348320> https://bodhi.fedoraproject.org/updates/FEDORA-2018-7082fefd2e <https://bodhi.fedoraproject.org/updates/FEDORA-2018-7082fefd2e> The new packages and versions are: * 389-ds-base-1.4.0.7-1 Source tarballs are available for download at Download 389-ds-base Source <https://releases.pagure.org/389-ds-base/389-ds-base-1.4.0.7.tar.bz2> Highlights in 1.4.0.7 * Bug fixes and merging of srvcore package Installation and Upgrade See Download <http://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install, use *yum install 389-ds* yum install 389-ds After install completes, run *setup-ds-admin.pl* if you have 389-admin installed, otherwise please run *setup-ds.pl* to set up your directory server. To upgrade, use *yum upgrade* yum upgrade After upgrade completes, run *setup-ds-admin.pl -u* if you have 389-admin installed, otherwise please run *setup-ds.pl* to update your directory server/admin server/console information. See Install_Guide <http://www.port389.org/docs/389ds/legacy/install-guide.html> for more information about the initial installation, setup, and upgrade See Source <http://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our Pagure project: https://pagure.io/389-ds-base * Bump version to 1.4.0.7 * Ticket 49477 - Missing pbkdf python * Ticket 49552 - Fix the last of the build issues on F28/29 * Ticket 49522 - Fix build issues on F28 * Ticket 49631 - same csn generated twice * Ticket 49585 - Add py3 support to password test suite : part-3 * Ticket 49585 - Add py3 support to password test suite : part-2 * Ticket 48184 - revert previous patch around unuc-stans shutdown crash * Ticket 49585 - Add py3 support to password test suite * Ticket 46918 - Fix compiler warnings on arm * Ticket 49601 - Replace HAVE_SYSTEMD define with WITH_SYSTEMD in svrcore * Ticket 49619 - adjustment of csn_generator can fail so next generated csn can be equal to the most recent one received * Ticket 49608 - Add support for gcc/clang sanitizers * Ticket 49606 - Improve lib389 documentation * Ticket 49552 - Fix build issues on F28 * Ticket 49603 - 389-ds-base package rebuilt on EPEL can’t be installed due to missing dependencies * Ticket 49593 - NDN cache stats should be under the global stats * Ticket 49599 - Revise replication total init status messages * Ticket 49596 - repl-monitor.pl fails to find db tombstone/RUV entry * Ticket 49589 - merge svrcore into 389-ds-base * Ticket 49560 - Add a test case for extract-pemfiles * Ticket 49239 - Add a test suite for ds-replcheck tool RFE * Ticket 49369 - merge svrcore into 389-ds-base

1 0

status of the LDAP REST API
by Stephen Osella 12 Apr '18

12 Apr '18

What is the status of the LDAP REST API? As described at: http://directory.fedoraproject.org/docs/389ds/design/ldap-rest-api.html

2 1

DNA Plugin Troubles
by Sergei Gerasenko 10 Apr '18

10 Apr '18

Hi guys, I’ve replaced all of my environment with new hardware and everything is working except that I can’t add users/groups due to a DNA error saying: "Operations error: Allocation of a new value for range cn=posix ids,cn=distributed numeric assignment plugin,cn=plugins,cn=config failed! Unable to proceed." It seems that no replicas have a range defined because (I think) the original master on which users used to be creared got decommissioned as well :( So I think that’s SOMEHOW the root of the problem. What’s the best way to proceed? Thanks, Sergei

1 0

389 DS Time Skew Error
by Paul Whitney 10 Apr '18

10 Apr '18

Hi guys, I have been reading up on a fix for this and only found one set of procedures to repair this issue. (http://directory.fedoraproject.org/docs/389ds/howto/howto-fix-and-reset-tim…). Would removing/recreating the replication agreement resolve this issue instead of the steps in the above URL? Paul M. Whitney E-mail: paul.whitney(a)mac.com Sent from my browser.

3 2

Configuring TLS/SSL Enabled 389 Directory Server
by Jeremy Tourville 02 Apr '18

02 Apr '18

Hello, I used this guide to help setup 389 DS : https://www.unixmen.com/install-and-configure-ldap-server-in-centos-7/ Presently, I am following the guide: http://directory.fedoraproject.org/docs/389ds/howto/howto-ssl.html I configured a certificate from my CA and imported the certificate to my server. I confirmed that the server correctly imported the certificate into my database. So basically, all the certificate work is done and working. Now I am trying to modify the settings of my dse.ldif file. I can modify the file without issue. If I restart the service all my file edits are lost. Why are my edits lost when restarting the service? Thanks for your advice!

3 2

Using PBKDF2_SHA256 Hashes
by Joe Cooter 01 Apr '18

01 Apr '18

Hi, I’m attempting to build an application using the userPassword attribute, with hashes stored using PBKDF2_SHA256. However, using the passlib hash library for pbkdf2_sha256 is complaining about a malformed hash. Looking at the hash, it appears that there aren’t any delimiters between the salt, iterations, etc. Is there some additional encoding happening on the userPassword attribute?

3 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2018