389-users April 2022

389-users@lists.fedoraproject.org

10 participants
6 discussions

Meta directory plugin in 389ds?
by Alex 18 Apr '22

18 Apr '22

Dear List-Members. Please can you help me to find the right plugin, if there is any, in 386ds which can be used similar to the slapd-meta and slapo-rwm? https://www.openldap.org/software/man.cgi?query=slapd-meta&sektion=5&manpat… https://www.openldap.org/software/man.cgi?query=slapo-rwm&sektion=5&apropos… What I try to achieve is to create a meta directory in front on MS Active Directory for different AD Groups and propagate this group via 386ds. I have seen this plugins but I don't know the wording in 386ds therefore I hope anybody can help me to find the right wording and plugins in 386ds if this is possible. https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/h… Thank you for any help. Regards Alex

2 5

AD to 389ds sync problem
by Tornóci László 11 Apr '22

11 Apr '22

Hello, we have tried to set up a synchronization from AD to our directory server, but we have a problem. We have RHEL 8.5, 389-ds-base-1.4.3.23-14 We have followed the docs here: https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/h… We have created this agreement: dsconf dirsrv_inst repl-winsync-agmt create --suffix="dc=example,dc=hu" --host="our.ad.server.hu" --port=636 --conn-protocol="LDAPS" --bind-dn="CN=_sync_user,DC=exmaple,DC=local" --bind-passwd="passwd" --win-subtree="OU=Felhasználók,DC=example,DC=local" --ds-subtree="ou=People1,dc=example,dc=hu" --win-domain=example --one-way-sync=fromWindows --init users-sync (some data have been masked). The agreement gets accepted, init status is okay. However, no users get created on the directory server, even after setting the --sync-users option to "on" in the replication agreement as suggested by the docs. In AD, there are test users, for example this: dn:: Q049VGVzenQgVXNlciAxLE9VPUZlbGhhc3puw6Fsw7NrLERDPWV4YW1wbGUsREM9bG9jYWw= objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn:: VGVzenQgVXNlciAx sn:: UG9ydMOhbA== title:: VGVzenRlbMWR telephoneNumber: +3612345679 givenName: User distinguishedName:: Q049VGVzenQgVXNlciAxLE9VPUZlbGhhc3puw6Fsw7NrLERDPWV4YW1wbGUsREM9bG9jYWw= instanceType: 4 whenCreated: 20220324073810.0Z whenChanged: 20220405072514.0Z displayName:: VGVzenQgVXNlciAx uSNCreated: 654581 uSNChanged: 731702 department: Development name:: VGVzenQgVXNlciAx objectGUID:: ZYcqiTPzVkCifL7rP8qGlg== userAccountControl: 512 codePage: 0 countryCode: 0 pwdLastSet: 132935477968356837 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAGOXkLRHqLIUsJtYXDBAAAA== accountExpires: 9223372036854775807 sAMAccountName: portal.user2 sAMAccountType: 805306368 userPrincipalName: portal.user2(a)example.local objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=example,DC=local dSCorePropagationData: 20220405072514.0Z dSCorePropagationData: 20220401092451.0Z dSCorePropagationData: 20220401092431.0Z dSCorePropagationData: 20220401092408.0Z dSCorePropagationData: 16010101000417.0Z lastLogonTimestamp: 132925820675992048 mail: portaluser2(a)example.hu homePhone: +3687654321 In the error log we get these lines about the replication of this particular test user: Received entry from dirsync: CN=Teszt User 1,OU=Felhaszn<C3><A1>l<C3><B3>k,OU=Example> (test2:637) - Looking for local entry matching AD entry [CN=Teszt User> (test2:637) - Looking for local entry by guid [65872a8933f35640a27cbeeb3fca8696] (test2:637) - Problem looking for guid: -1 (test2:637) - Looking for local entry by uid [portal.user2] (test2:637) - problem looking for username: -1 What could be the problem? Yours: Laszlo

2 5

Posible bug in Schema Reload plug-in validator?
by Jan Tomasek 08 Apr '22

08 Apr '22

Hello, I'm running 389DS version 1.4.4.11-2 on Debian Bullseye and when I try dynamic schema reload I get this error: > [08/Apr/2022:09:50:38.481339672 +0200] - INFO - schemareload - schemareload_thread - Schema reload task starts (schema dir: default) ... > [08/Apr/2022:09:50:38.528960187 +0200] - ERR - parse_attr_str - Cannot find parent attribute type "certSubjectDN" > [08/Apr/2022:09:50:38.534608629 +0200] - ERR - dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-ldap33/schema/96radoc.ldif (lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type raOfficerSubjectDN: Missing parent attribute syntax OID > [08/Apr/2022:09:50:38.539912128 +0200] - ERR - schema_reload - slapi_validate_schema_files failed > [08/Apr/2022:09:50:38.544588257 +0200] - ERR - schemareload - schemareload_thread - Schema validation failed. raOfficerSubjectDN is defined this way: attributeTypes: ( raOfficerSubjectDN-oid NAME 'raOfficerSubjectDN' DESC 'RA office subject DN; KDO' SUP certSubjectDN SINGLE-VALUE X-ORIGIN 'CESNET RA DOC' ) and certSubjectDN is defined: attributeTypes: ( certSubjectDN-oid NAME 'certsubjectdn' DESC 'CESNET Attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'CESNET' ) It is interesting that when I restart whole server it starts correctly and in schema is attribute present: ldapsearch -H ldaps://ldap33 -x -b 'cn=schema' -o ldif-wrap=no + ... attributeTypes: ( raOfficerSubjectDN-oid NAME 'raOfficerSubjectDN' DESC 'RA office subject DN; KDO' SUP certSubjectDN SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'CESNET RA DOC' ) I was looking for attributeType syntax and in RFC 2252 is written: > ... Servers SHOULD provide at least one of the "SUP" and "SYNTAX" > fields for each AttributeTypeDescription. Isn't there a bug in validator which is used by Schema Reload plug-in? Best regards -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

2 1

multimaster replcation port used
by Ghiurea, Isabella 01 Apr '22

01 Apr '22

Hi Please I need to know to know if we can block port 389 presently used for replication multimaster replication and replaced with port 636 will this work ?

3 2

passwordExpirationTime vs password admin
by Mike Wohlgemuth 01 Apr '22

01 Apr '22

Hi! We are running Red Hat Enterprise Linux release 8.3 with 389-ds-base-1.4.3.16-19.module+el8.4.0+11894+f5bb5c43.x86_64 installed. We have configured password expiration, and passwordExpirationTime is getting updated properly when the end user binds and changes the password, or when cn=directory manager changes the password. We have an API that is invoked to allow the users to change their password when they have forgotten it, so it cannot bind as the end user, but we also do not want it to have to bind as cn=directory manager. However, we haven't had any luck getting any other user to update passwordExpirationTime when updating the password. Looking at the code, it looks like password admins should be allowed to update passwordExpirationTime, but we have those configured and it's not working. Is there something we are missing? Thanks!

3 7

389DS + Ubuntu
by iyagomailru Alexander Yakovlev 01 Apr '22

01 Apr '22

Good afternoon. I installed 389-ds on Ubuntu. I need to use mdb instead of bdb. But the installed dconf utility does not contain the 'config' option: # dsconf usage: dsconf [-h] [-v] [-D BINDDN] [-b BASEDN] [-Z] instance {{backend,schema,healthcheck,plugin,memberof,usn,rootdn,whoami,referint} ... dsconf: error: the following arguments are required: instance Tell me what are the possible solutions, please.

6 10

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2022