389-users February 2022

389-users@lists.fedoraproject.org

9 participants
7 discussions

OpenLDAP import into 389 Directory Server failing
by Jason W. Lewis 24 Mar '22

24 Mar '22

After RHEL, etc dropped OpenLDAP, I’ve begun testing with 389 Directory Server. Currently, I’m trying to use openldap_to_ds to import slapd.d config and an LDIF export to import my old database into the new server. I’ve created a new instance in 389-ds named terminal-config. I’ve tried the following variations on the idea, all of which gave me the same results: * exported the LDIF from OpenLDAP 2.4 on Oracle Linux 7 and CentOS 6 servers. * Rewrote all files being imported to make sure they weren’t corrupt. * used relative and absolute path names to the files * Tried importing with a new instance (as mentioned above) and no instance at all * When using dscreate to make the new instance, I’ve tried setting it up differently (allowed sample entries and not, etc) No matter what I do, this is what I get when I try: [root@ldaptest ~]# openldap_to_ds terminal-config /root/slapd.d /root/terminals.ldif Examining OpenLDAP Configuration ... Traceback (most recent call last): File "/usr/sbin/openldap_to_ds", line 250, in <module> result = do_migration(inst, log, args, skip_overlays) File "/usr/sbin/openldap_to_ds", line 178, in do_migration config = olConfig(args.slapd_config, log) File "/usr/lib/python3.6/site-packages/lib389/migrate/openldap/config.py", line 305, in __init__ for db in dbs File "/usr/lib/python3.6/site-packages/lib389/migrate/openldap/config.py", line 305, in <listcomp> for db in dbs File "/usr/lib/python3.6/site-packages/lib389/migrate/openldap/config.py", line 112, in __init__ self.suffix = ensure_str(self.config[1]['olcSuffix'][0]) KeyError: 'olcSuffix' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/sbin/openldap_to_ds", line 257, in <module> log.error("Error: %s" % " - ".join(str(val) for val in msg.values())) AttributeError: 'str' object has no attribute 'values' [root@ldaptest ~]# Any thoughts on what could be causing this? -- [Micro Electronics Inc] Jason Lewis Systems Administrator jwlewis(a)microcenter.com<mailto:jwlewis@microcenter.com> | [signature_251198827] 614-777-2728 [Micro Center Secure Email] CONFIDENTIALITY NOTICE: This e-mail message including attachments, if any, is intended exclusively for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient, you are not authorized to read, print, retain, copy or disseminate this message or any part of it. If you receive this message in error, please contact the sender by reply e-mail and destroy all copies of the original message and attachments. Thank you

4 9

Re: SSO and 389
by N R 12 Mar '22

12 Mar '22

Hi, I've done some SAML SSO integrations and work regularly with FreeIPA. SSO is usually handled via a protocol like SAML, OpenID or Shibboleth, FreeIPA only serves as LDAP Identity database in these architectures. Our deployments used a "proxy" to handle these authentications and link them with LDAP, SimpleSAMLPHP. The implementation also depends a lot on the way you want to do SSO, centralized, federated, or cooperative. I would recommend to take a look at simplesamlphp documentation as it supports almost every SSO protocols and can easily be integrated to proxy SSO web requests. Regards, Nicolas Le lun. 10 janv. 2022 à 19:50, Jonathan Aquilina <jaquilina(a)eagleeyet.net> a écrit : > Good Evening, > > > > I am just wondering can 389 along side free ipa be used to offer SSO > capabilities? > > > > Regards, > > Jonathan > _______________________________________________ > 389-users mailing list -- 389-users(a)lists.fedoraproject.org > To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject… > Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure >

2 1

Authorization without Netgroups
by Dudas Tibor ABRAXAS 14 Feb '22

14 Feb '22

Hi Thanks. Access Control works with ldap access filter, but how do we authorize without netgroups? I did not find anything like SUDOers for 389ds. Best regards, Tibor -----Ursprüngliche Nachricht----- Von: William Brown <william.brown(a)suse.com> Gesendet: Donnerstag, 27. Januar 2022 01:27 An: 389-users(a)lists.fedoraproject.org Betreff: [389-users] Re: ssh does not see my access.conf > On 25 Jan 2022, at 18:15, Dudas Tibor ABRAXAS <Tibor.Dudas(a)abraxas.ch> wrote: > > Thanks, you are right: It works with the memberof-Plugin and ldap access filter. > > Is there a way to make it work with netgroups? We have it set up like that in our OpenLDAP and would have to migrate everything, otherwise. > > According to the documentation it should work: > https://directory.fedoraproject.org/docs/389ds/howto/howto-netgroups.h > tml I've honestly not touched netgroups in a long long time. I think SSSD might have a way to emulate them? But honestly you may want to consider this as a good time to start to migrate away from them ... But on the ldap side, there is no reason that the data in ldap will be any different between openldap and 389, it's just ldap. > > > Thanks for your answer, > Tibor > > > -----Ursprüngliche Nachricht----- > Von: William Brown <william.brown(a)suse.com> > Gesendet: Dienstag, 25. Januar 2022 00:24 > An: 389-users(a)lists.fedoraproject.org > Betreff: [389-users] Re: ssh does not see my access.conf > > > >> On 25 Jan 2022, at 02:36, Dudas Tibor ABRAXAS <Tibor.Dudas(a)abraxas.ch> wrote: >> >> Hi, >> >> I can resolve my netgroup user via getent and can login with her on my 389ds client via ssh. >> >> What does not work, yet, is to exclude all other users. >> >> The Config is: >> getent netgroup sysadmin >> sysadmin ( ,eve,) >> >> cat /etc/security/access.conf >> +:root:LOCAL >> +:root:ALL >> +:@sysadmin:ALL >> -:ALL:ALL EXCEPT LOCAL >> >> Cat /etc/pam.d/system-auth >> … >> account required pam_access.so >> accessfile=/etc/security/access.netgroup.conf >> >> cat =/etc/security/access.netgroup.conf >> +:root:LOCAL >> +:root:ALL >> +:@sysadmin:ALL >> -:ALL:ALL EXCEPT LOCAL >> >> The client logs say, when I try to login with user alice from my 389ds, not belonging to my netgroup sysadmin: >> (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] >> [sdap_get_groups_next_base] (0x0400): Searching for groups with base [ou=groups,dc=example,dc=com] (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(gidNumber=1002)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))][ou=groups, dc=example,dc=com]. >> (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] >> [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [sdap_get_groups_process] (0x0400): Search for groups, returned 0 results. >> (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] >> [sysdb_search_group_by_gid] (0x0400): No such entry (Mon Jan 24 >> 17:19:31 2022) [sssd[be[LDAP]]] [sysdb_delete_group] (0x0400): Error: >> 2 (No such file or directory) (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [dp_req_done] (0x0400): DP Request [Account #48]: Request handler finished [0]: Success (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [_dp_req_recv] (0x0400): DP Request [Account #48]: Receiving request data. >> (Mon Jan 24 17:19:31 2022) [sssd[be[LDAP]]] [dp_req_reply_list_success] (0x0400): DP Request [Account #48]: Finished. Success. >> >> The client does not even look for netgroups, but lets everyone pass. What did I miss? > > You probably don't want pam_access here, since netgroups are not an LDAP thing. > > You can have the same effect with ldap access filter in sssd.conf, and then using pam_sss in the account line of pam. > >> >> Any help is appreciated. >> >> Kind regards, Tibor >> >> >> _______________________________________________ >> 389-users mailing list -- 389-users(a)lists.fedoraproject.org To >> unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org >> Fedora Code of Conduct: >> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: >> https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/389-users@lists.fedorap >> r oject.org Do not reply to spam on the list, report it: >> https://pagure.io/fedora-infrastructure > > -- > Sincerely, > > William Brown > > Senior Software Engineer, Identity and Access Management SUSE Labs, > Australia > > _______________________________________________ > 389-users mailing list -- 389-users(a)lists.fedoraproject.org To > unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/389-users@lists.fedorapr > oject.org Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure > _______________________________________________ > 389-users mailing list -- 389-users(a)lists.fedoraproject.org To > unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: > https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/389-users@lists.fedorapr > oject.org Do not reply to spam on the list, report it: > https://pagure.io/fedora-infrastructure -- Sincerely, William Brown Senior Software Engineer, Identity and Access Management SUSE Labs, Australia _______________________________________________ 389-users mailing list -- 389-users(a)lists.fedoraproject.org To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject… Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure

2 1

Re: diff behaviours between version with "unindex search" error
by Ghiurea, Isabella 03 Feb '22

03 Feb '22

Thank you Pierre for reply please elaborate this part from your answer : " Now the fact that you get or not an unindexed note in search result will depends on the number of descendants of ou=Users,ou=ds,dc=xxxx,dc=xxxx If the number is below the allies threshold the search is indexed by the ancestorid index." Isabella

2 1

Announcing 389 Directory Server 2.1.0
by Mark Reynolds 02 Feb '22

02 Feb '22

389 Directory Server 2.1.0 The 389 Directory Server team is proud to announce 389-ds-base version 2.1.0 Fedora packages are available on Fedora Rawhide (f36) Rawhide: https://koji.fedoraproject.org/koji/taskinfo?taskID=81773299 - Koji The new packages and versions are: * 389-ds-base-2.1.0-1 Source tarballs are available for download at Download 389-ds-base Source <https://github.com/389ds/389-ds-base/archive/389-ds-base-2.1.0.tar.gz> Highlights in 2.1.0 * Bug and Security fixes * Transition from BDB(libdb) to LMDB begun. BDB is still the default backend, but it can be changed to LMDB for early testing. Installation and Upgrade See Download <https://www.port389.org/docs/389ds/download.html> for information about setting up your yum repositories. To install the server use *dnf install 389-ds-base* To install the Cockpit UI plugin use *dnf install cockpit-389-ds* After rpm install completes, run *dscreate interactive* For upgrades, simply install the package. There are no further steps required. There are no upgrade steps besides installing the new rpms See Install_Guide <https://www.port389.org/docs/389ds/howto/howto-install-389.html> for more information about the initial installation and setup See Source <https://www.port389.org/docs/389ds/development/source.html> for information about source tarballs and SCM (git) access. Feedback We are very interested in your feedback! Please provide feedback and comments to the 389-users mailing list: https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject.o… If you find a bug, or would like to see a new feature, file it in our GitHub project: https://github.com/389ds/389-ds-base * Bump version to 2.1.0 * Issue 5135 - UI - Disk monitoring threshold does update properly * Issue 5129 - BUG - Incorrect fn signature in add_index (#5130) * Issue 5132 - Update Rust crate lru to fix CVE * Issue 3555 - UI - fix audit issue with npm nanoid * Issue 4299 - UI - Add ACI editing features * Issue 5127 - run restorecon on /dev/shm at server startup * Issue 5124 - dscontainer fails to create an instance * Issue 5098 - Multiple issues around replication and CI test test_online_reinit_may_hang (#5109) * Issue 4939 - Redesign LMDB import (#5071) * Issue 5113 - Increase timestamp precision for development builds * Issue 5115 - AttributeError: type object ‘build_manpages’ has no attribute ‘build_manpages’ * Issue 5117 - Revert skipif line from CI test (#5118) * Issue 5102 - BUG - container may fail with bare uid/gid (#5110) * Issue 5077 - UI - Add retrocl exclude attribute functionality (#5078) * Issue 5105 - During a bind, if the target entry is not reachable the operation may complete without sending result (#5107) * Issue 5074 - retro changelog cli updates (#5075) * Issue 3584 - Add is_fips check to password tests (#5100) * Issue 5095 - sync-repl with openldap may send truncated syncUUID (#5099) * Issue 5032 - Fix OpenLDAP version check (#5091) * Issue 5080 - BUG - multiple index types not handled in openldap migration (#5094) * Issue 2929 - Fix github warnings * Issue 5053 - Improve GitHub Actions debugging * Issue 5088 - dsctl dblib broken because of a merge issue (#5089) * Issue 5079 - BUG - multiple ways to specific primary (#5087) * Issue 5085 - Race condition about snmp collator at startup (#5086) * Issue 5082 - slugify: ModuleNotFoundError when running test cases * Issue 4959 - Invalid /etc/hosts setup can cause isLocalHost to fail (#5003) * Issue 5037 - in OpenQA changelog trimming can crashes (#5070) * Issue 5049 - ns-slapd crash in replication/acceptance_test.py (#5063) * Issue 4890 - Need cli to easely get simple performance statistics (#4891) * Issue 5011 - test_replica_backup_and_restore random failure (#5066) * Issue 4299 - UI LDAP editor - add “edit” and “rename” functionality * Issue 5018 - RFE - openSUSE systemd hardening (#5019) * Issue 4962 - Fix various UI bugs - Database and Backups (#5044) * Issue 5055 - Improve core dump detection and collection in PR CI * Issue 4994 - Revert retrocl dependency workaround (#4995) * Issue 5046 - BUG - update concread (#5047) * Issue 5043 - BUG - Result must be used compiler warning (#5045) * Issue 4312 - performance search rate: contention on global monitoring counters (#4940) * Issue 5034 - is_dbi contains an invalid debug message that trigger failure in import_tests (#5035) * Issue 5029 - Unbind generates incorrent closed error message (#5030) * Issue 4165 - Don’t apply RootDN access control restrictions to UNIX connections * Issue 4931 - RFE: dsidm - add creation of service accounts * Issue 5024 - BUG - windows ro replica sigsegv (#5027) * Issue 4758 - Add tests for WebUI * Issue 5032 - OpenLDAP is not shipped with non-threaded version of libldap (#5033) * Issue 5038 - BUG - dsconf tls may fail due to incorrect cert path (#5039) * Issue 5020 - BUG - improve clarity of posix win sync logging (#5021) * Issue 5011 - test_replica_backup_and_restore random failure (#5028) * Issue 5025 - RFE - remove useless logging (#5026) * Issue 5008 - If a non critical plugin can not be loaded/initialized, bootstrap should succeeds (#5009) * Issue 4962 - Fix various UI bugs - Settings and Monitor (#5016) * Issue 4976 - Failure in suites/import/import_test.py::test_fast_slow_import (#5017) * Issue 5014 - UI - Add group creation to LDAP editor * Issue 5006 - UI - LDAP editor tree not being properly updated * Issue 4923 - issue about LMDB dbi versus txn handling (#4924) * Issue 5001 - Update CI test for new availableSASLMechs attribute * Issue 4959 - Invalid /etc/hosts setup can cause isLocalHost to fail. * Issue 5001 - Fix next round of UI bugs: * Issue 4962 - Fix various UI bugs - dsctl and ciphers (#5000) * Issue 4734 - ldif2db - import of entry with no parent doesnt generate a warning * Issue 4778 - [RFE] Schedule execution of “compactdb” at specific date/time * Issue 4978 - use more portable python command for checking containers * Issue 4990 - CI tests: improve robustness of fourwaymmr (#4991) * Issue 4992 - BUG - slapd.socket container fix (#4993) * Issue 4984 - BUG - pid file handling (#4986) * Issue 4460 - python3-lib389 ignore the configuration parameters from … (#4906) * Issue 4982 - BUG - missing inttypes.h (#4983) * Issue 4758 - Add tests for WebUI * Issue 4972 - gecos with IA5 introduces a compatibility issue with previous (#4981) * Issue 4096 - Missing perl dependencies for logconv.pl * Issue 4758 - Add tests for WebUI * Issue 4978 - make installer robust * Issue 4898 - Implement bdb to lmdb CLI migration tools (#4952) * Issue 4976 - Failure in suites/import/import_test.py::test_fast_slow_import * Issue 4973 - update snmp to use /run/dirsrv for PID file * Issue 4973 - installer changes permissions on /run * Issue 4959 - BUG - Invalid /etc/hosts setup can cause isLocalHost (#4960) * Issue 4962 - Fix various UI bugs - Plugins (#4969) * Issue 4092 - systemd-tmpfiles warnings * Issue 4956 - Automember allows invalid regex, and does not log proper error * Issue 4731 - Promoting/demoting a replica can crash the server * Issue 4962 - Fix various UI bugs part 1 * Issue 3584 - Fix PBKDF2_SHA256 hashing in FIPS mode (#4949) * Issue 4943 - Fix csn generator to limit time skew drift (#4946) * Issue 4954 - pytest is killed by OOM killer when the whole test suite is executed * Issue 2790 - Set db home directory by default * Issue 4299 - Merge LDAP editor code into Cockpit UI * Issue 4938 - max_failure_count can be reached in dscontainer on slow machine with missing debug exception trace * Issue 4921 - logconv.pl -j: Use of uninitialized value (#4922) * Issue 4896 - improve CI tests report in case of SERVER_DOWN exception (#4897) * Issue 4678 - RFE automatique disable of virtual attribute checking (#4918) * Issue 4847 - BUG - potential deadlock in replica (#4936) * Issue 4513 - fix ACI CI tests involving ip/hostname rules * Issue 4925 - Performance ACI: targetfilter evaluation result can be reused (#4926) * Issue 4916 - Memory leak in ldap-agent * Issue 4656 - DS Remove problematic language from CLI tools and UI (#4893) * Issue 4908 - Updated several dsconf –help entries (typos, wrong descriptions, etc.) * Issue 4912 - Account Policy plugin does not set the config entry DN * Issue 4863 - typoes in logconv.pl * Issue 4796 - Add support for nsslapd-state to CLI & UI * Issue 4894 - IPA failure in ipa user-del –preserve (#4907) * Issue 4914 - BUG - resolve duplicate stderr with clang (#4915) * Issue 4912 - dsidm command crashing when account policy plugin is enabled * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index * Issue 4577 - Add GitHub actions * Issue 4901 - Add COPR integration * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks * Issue 4889 - bdb lock deadlock while reindex/import vlv index (#4892) * Issue 4773 - Extend CI tests for DNA interval assignment * Issue 4887 - UI - fix minor regression from camelCase fixup * Issue 4887 - UI - Update webpack.config.js and package.json * Issue 4725 - [RFE] DS - Update the password policy to support Temporary Password Rules (#4853) * Issue 4149 - UI - Migrate the remaining components to PF4 * Issue 4169 - Migrate Replication & Schema tabs to PF4 * Issue 4875 - CLI - Add some verbosity to installer * Issue 4884 - server crashes when dnaInterval attribute is set to zero * Issue 4699 - backend redesign phase 4 - db-mdb plugin implementation (#4716) * Issue 4877 - RFE - EntryUUID to validate UUIDs on fixup (#4878) * Issue 4872 - BUG - entryuuid enabled by default causes replication issues (#4876) * Issue 4775 - Add entryuuid CLI and Fixup (#4776) * Issue 4763 - Attribute Uniqueness Plugin uses wrong subtree on ModRDN (#4871) * Issue 4851 - Typos in “dsconf pwpolicy set –help” (#4867) * Issue 4096 - Missing perl dependencies for logconv.pl * Issue 4736 - lib389 - fix regression in certutil error checking -- Directory Server Development Team

1 0

diff behaviours between version with "unindex search" error
by Ghiurea, Isabella 02 Feb '22

02 Feb '22

Hello List , I start seeing the following error in ldap error log , DS cfg for fractional muiltimaster replication with member plugin enabled local in each host and excluded from replication . There is no index on email attribute but nsAccounlock is indexed for equality, presence and substring. NOTICE - ldbm_back_search - Unindexed search: search base="ou=Users,ou=ds,dc=xxxx,dc=xxxx" scope=1 filter="(&(&(!(nsAccountLock=*))(!(nsAccountLock=true)))(email=xxxxxxxxxx.com))" conn=xxx op= xxx DS version : 89-ds-base-1.3.10.2-14.el7_9.x86_64 389-ds-console-1.2.16-1.el7.noarch 389-ds-base-snmp-1.3.10.2-14.el7_9.x86_64 389-ds-base-libs-1.3.10.2-14.el7_9.x86_64 BUT same ldapsearch for a DS cfg with same index cfg returns no errors in this ldap version, please explain what's going on . 389-ds-base-libs-1.3.9.1-10.el7.x86_64 389-ds-console-1.2.16-1.el7.noarch 389-ds-base-1.3.9.1-10.el7.x86_64 Thank you Isabella

2 1

Re: Replication Problem
by Mansoor Raeesi 01 Feb '22

01 Feb '22

Server A is ldapserver1 & Server B is ldapserver2 this is log of server B: https://pastebin.ubuntu.com/p/f8SRb6kYn9/

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users February 2022