Hi
Does anyone have a document like an howto that can explain how we can syncronize FDS with AD ? Anyone that have already do this . Thanks.
Pedro Rodrigues wrote:
Hi
Does anyone have a document like an howto that can explain how we can syncronize FDS with AD ? Anyone that have already do this .
http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
Note that you are strongly encouraged to get it working _without_ SSL/TLS first, then go back and enable the use of SSL/TLS, despite what the docs say. Do not run this in a production environment without using SSL/TLS.
Thanks.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
On 9/20/05, Rich Megginson rmeggins@redhat.com wrote:
Pedro Rodrigues wrote:
Hi
Does anyone have a document like an howto that can explain how we can syncronize FDS with AD ? Anyone that have already do this .
http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
Note that you are strongly encouraged to get it working _without_ SSL/TLS first, then go back and enable the use of SSL/TLS, despite what the docs say. Do not run this in a production environment without using SSL/TLS.
Thanks.
Two doubts here I have synced win2k03 group cn=users,dc=domain,dc=tld and FDS group ou=people,dc=domain,dc=tld. (The default groups , i have not touched the schema) 1)Are the attributes for any user in the two servers the same? If there are attributes that are there in AD and not in FDS or vice versa , does it simply ignore it during the sync? 2)When using this setup for Postfix authentication from the FDS , do we need to add any additional attributes in the AD or the FDS (Since i intend to use the AD for user creation) to get the postfix authentication working? 3)Lastly does postfix work with LDAP with the default installation along with RHEL? The documentation in http://www.postfix.org/LDAP_README.htmlspecifies configuration options for use with OpenLDAP .Is it the same for FDS? I hope to put up a full doc wiki entry somewhere once the whole thing once its all done. Thanks in advance Best Regards Nabeel
On Wednesday 21 September 2005 7:53 am, Nabeel Moidu wrote:
On 9/20/05, Rich Megginson rmeggins@redhat.com wrote:
Pedro Rodrigues wrote:
Hi
Does anyone have a document like an howto that can explain how we can syncronize FDS with AD ? Anyone that have already do this .
http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
Note that you are strongly encouraged to get it working _without_ SSL/TLS first, then go back and enable the use of SSL/TLS, despite what the docs say. Do not run this in a production environment without using SSL/TLS.
Thanks.
Two doubts here I have synced win2k03 group cn=users,dc=domain,dc=tld and FDS group ou=people,dc=domain,dc=tld. (The default groups , i have not touched the schema) 1)Are the attributes for any user in the two servers the same? If there are attributes that are there in AD and not in FDS or vice versa , does it simply ignore it during the sync? 2)When using this setup for Postfix authentication from the FDS , do we need to add any additional attributes in the AD or the FDS (Since i intend to use the AD for user creation) to get the postfix authentication working? 3)Lastly does postfix work with LDAP with the default installation along with RHEL? The documentation in http://www.postfix.org/LDAP_README.htmlspecifies configuration options for use with OpenLDAP .Is it the same for FDS? I hope to put up a full doc wiki entry somewhere once the whole thing once its all done. Thanks in advance Best Regards Nabeel
Nabeel,
Not answers to your questions, but a request to you:
For whatever reason, I've struggled to get my win2k3 ADS and FDS to sync properly. Would you be kind enough to share a step-by-step of how you set up the sync? (If others on the list feel that this should be done off-list, please let me know).
Thanks.
Dimitri
For whatever reason, I've struggled to get my win2k3 ADS and FDS to sync properly. Would you be kind enough to share a step-by-step of how you set up the sync?
Search for the word 'step' in this page: http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
On Wednesday 21 September 2005 10:38 am, David Boreham wrote:
For whatever reason, I've struggled to get my win2k3 ADS and FDS to sync properly. Would you be kind enough to share a step-by-step of how you set up the sync?
Search for the word 'step' in this page: http://www.redhat.com/docs/manuals/dir-server/ag/7.1/sync.html#2836267
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
David,
Thanks for pointing me to the manual - I've read it. I'm sure it's my own stupidity that has caused me to misconfigure something regarding sync. I was hoping that someone who had gone through the process of setting up winsync might share that with me; perhaps that would help me catch my error. Obviously, the manual didn't work for a non-genius like me.
Dimitri
Thanks for pointing me to the manual - I've read it. I'm sure it's my own stupidity that has caused me to misconfigure something regarding sync. I was hoping that someone who had gone through the process of setting up winsync might share that with me; perhaps that would help me catch my error. Obviously, the manual didn't work for a non-genius like me.
The step by step guide in the manual was written by someone that had gone through the steps themselves (a non-developer). Anyway, could you try the steps listed in the 'troubleshooting' section of the winsync manual chapter, in particular enable replication logging ? That will probably produce some useful error log output, which you can post here and we'll attempt to determine what's not working.
Dimitri Can you tell us where u got stuck or what is the error. For me the sync was pretty straight through except for finding the passsync.msi file which was in the installation package itself( i wasted a lot of time googling for it). By the way i used the default windows administrator user and setup the sync without the ssl stuff. Regards Nabeel
On 9/21/05, David Boreham david_list@boreham.org wrote:
Thanks for pointing me to the manual - I've read it. I'm sure it's my own stupidity that has caused me to misconfigure something regarding sync. I
was
hoping that someone who had gone through the process of setting up
winsync
might share that with me; perhaps that would help me catch my error. Obviously, the manual didn't work for a non-genius like me.
The step by step guide in the manual was written by someone that had gone through the steps themselves (a non-developer). Anyway, could you try the steps listed in the 'troubleshooting' section of the winsync manual chapter, in particular enable replication logging ? That will probably produce some useful error log output, which you can post here and we'll attempt to determine what's not working.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
On Wednesday 21 September 2005 11:38 am, Nabeel Moidu wrote:
Dimitri Can you tell us where u got stuck or what is the error. For me the sync was pretty straight through except for finding the passsync.msi file which was in the installation package itself( i wasted a lot of time googling for it). By the way i used the default windows administrator user and setup the sync without the ssl stuff. Regards Nabeel
On 9/21/05, David Boreham david_list@boreham.org wrote:
Thanks for pointing me to the manual - I've read it. I'm sure it's my own stupidity that has caused me to misconfigure something regarding sync. I
was
hoping that someone who had gone through the process of setting up
winsync
might share that with me; perhaps that would help me catch my error. Obviously, the manual didn't work for a non-genius like me.
The step by step guide in the manual was written by someone that had gone through the steps themselves (a non-developer). Anyway, could you try the steps listed in the 'troubleshooting' section of the winsync manual chapter, in particular enable replication logging ? That will probably produce some useful error log output, which you can post here and we'll attempt to determine what's not working.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
Nabeel,
Thanks for your response!
I'm not sure where I'm getting stuck (and, at this point, I'm just totally confused). If using the default administrator for sync purposes works, then that's what I'll do. Do I need to create a corresponding user anywhere on the FDS box (in FDS or in the underlying OS [actually, the underlying OS doesn't like the user "administrator"]). I don't care just yet about password synchronization, so do I need to use the Windows sync program? Is it really just a matter of creating the proper sync agreement?
Thanks.
Dimitri
On 9/21/05, Dimitri Yioulos dyioulos@firstbhph.com wrote:
On Wednesday 21 September 2005 11:38 am, Nabeel Moidu wrote:
Dimitri Can you tell us where u got stuck or what is the error. For me the sync was pretty straight through except for finding the passsync.msi file which was in the installation package itself( i wasted a lot of time googling for it). By the way i used the default windows administrator user and setup the sync without the ssl stuff. Regards Nabeel
On 9/21/05, David Boreham david_list@boreham.org wrote:
Thanks for pointing me to the manual - I've read it. I'm sure it's my own stupidity that has caused me to misconfigure something regarding sync. I
was
hoping that someone who had gone through the process of setting up
winsync
might share that with me; perhaps that would help me catch my error. Obviously, the manual didn't work for a non-genius like me.
The step by step guide in the manual was written by someone that had gone through the steps themselves (a non-developer). Anyway, could you try the steps listed in the 'troubleshooting' section of the winsync manual chapter, in particular enable replication logging ? That will probably produce some useful error log output, which you can post here and we'll attempt to determine what's not working.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
Nabeel,
Thanks for your response!
I'm not sure where I'm getting stuck (and, at this point, I'm just totally confused). If using the default administrator for sync purposes works, then that's what I'll do. Do I need to create a corresponding user anywhere on the FDS box (in FDS or in the underlying OS [actually, the underlying OS doesn't like the user "administrator"]). I don't care just yet about password synchronization, so do I need to use the Windows sync program? Is it really just a matter of creating the proper sync agreement?
Dimitri I'll tell you the way i did in mine.I don't know if its the perfect way or if it will bug me later.But so far it has worked. In the windows part of the passsync.msi configuration (just run the msi file again to reconfigure , for some reason the modify option never comes in the windows 2003 services.msc tool as said in the tutorial) give the options for user name as cn=sync manager , cn =config and the search base ou=people,dc=domain,dc=com ( try going by what the tutorial says as far as possible). In the FDS create under the config a new Rolewith name sync manager and the bind user in the sync agreement should be cn=Administrator,cn=users,dc=domain,dc=com(the windows domain administrator). I didn't do anything further .I just started the sync and it worked. As i told i am a beginner in LDAP , and have not completely read the FDS schema docs ( I will do them before i finish this work) .When it all goes into production once i get postfix also working with this then i will have to plan which user with what privilege to use where and all that stuff. I am in India and my timings is different from most of yours , thats why i couldn't reply yesterday. Regards Nabeel
Thanks.
Dimitri
On Wednesday 21 September 2005 11:32 am, David Boreham wrote:
Thanks for pointing me to the manual - I've read it. I'm sure it's my own stupidity that has caused me to misconfigure something regarding sync. I was hoping that someone who had gone through the process of setting up winsync might share that with me; perhaps that would help me catch my error. Obviously, the manual didn't work for a non-genius like me.
The step by step guide in the manual was written by someone that had gone through the steps themselves (a non-developer). Anyway, could you try the steps listed in the 'troubleshooting' section of the winsync manual chapter, in particular enable replication logging ? That will probably produce some useful error log output, which you can post here and we'll attempt to determine what's not working.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
David,
I read my reply to your previous post, and it did sound a bit testy - apologies. But this has been very frustrating. I've had fairly long conversations with you and others via irc about this. I've uploaded verbose error log files, tried to see what might be happening on the ADS side, tried your modified ldapsearch tool (does that now ring a bell), and ... nada. It's killing me that it seems like a rather trivial setup that others have accomplished, but I can't. The troubleshooting section of the winsync manual doesn't contain anything that applies to me.
But, I'm loathe to quit.
Dimitri
I read my reply to your previous post, and it did sound a bit testy - apologies. But this has been very frustrating. I've had fairly long conversations with you and others via irc about this. I've uploaded verbose error log files, tried to see what might be happening on the ADS side, tried your modified ldapsearch tool (does that now ring a bell),
Ok, so we were already working on your problem. I've been out of the office for a few days, hence the lack of progress. We already know that you haven't made a simple configuration error. There's some problem with interaction between winsync on the FDS side and your particular Win2003's AD.
The next thing I was going to ask you if you have the capability to take ethereal or tcpdump traces of the LDAP traffic between FDS and AD under the conditions we tried earlier (restart the server then initiate a re-sync)? Those traces would be useful in figuring out which side (AD or FDS) has caused the transmission of entries to halt.
Ok, so we were already working on your problem. I've been out of the office for a few days, hence the lack of progress. We already know that you haven't made a simple configuration error. There's some problem with interaction between winsync on the FDS side and your particular Win2003's AD.
The next thing I was going to ask you if you have the capability to take ethereal or tcpdump traces of the LDAP traffic between FDS and AD under the conditions we tried earlier (restart the server then initiate a re-sync)? Those traces would be useful in figuring out which side (AD or FDS) has caused the transmission of entries to halt.
OK, I'm happy to do that. I've used both ethereal and tcpdump. Is there a filter I should add to capture just the ldap traffic?
BTW, did you see my post on irc vis-a-vis the ldapsearch results?
Dimitri
OK, I'm happy to do that. I've used both ethereal and tcpdump. Is there a filter I should add to capture just the ldap traffic?
Everything on port 389 will be fine (disable SSL if you have been using it).
BTW, did you see my post on irc vis-a-vis the ldapsearch results?
I saw that the modified ldapsearch produced correct results, which is why I'm asking for a packet trace now.
On Wednesday 21 September 2005 12:59 pm, David Boreham wrote:
OK, I'm happy to do that. I've used both ethereal and tcpdump. Is there a filter I should add to capture just the ldap traffic?
Everything on port 389 will be fine (disable SSL if you have been using it).
BTW, did you see my post on irc vis-a-vis the ldapsearch results?
I saw that the modified ldapsearch produced correct results, which is why I'm asking for a packet trace now.
David,
I ran tcpdump -s 0 port 389 and redirected the output to a file. I fired off tcpdump just prior to starting the FDS server. Then, I started the console, and did a full re-sync. If I interpret the results correctly, the FDS and ADS boxes communicate on server start-up, buy sync dies immediately. Shall I send the output to you off-list (I have the address)?
Dimitri
I ran tcpdump -s 0 port 389 and redirected the output to a file. I fired off tcpdump just prior to starting the FDS server. Then, I started the console, and did a full re-sync. If I interpret the results correctly, the FDS and ADS boxes communicate on server start-up, buy sync dies immediately. Shall I send the output to you off-list (I have the address)?
Yes please.
in the Red Hat bugbase and not visable to me ...
Has this been fixed? Is there a build available somewhere that I can download?
Thanks.
William Francis wrote:
in the Red Hat bugbase and not visable to me ...
I'm not sure. It was entered as a Red Hat DS bug and not a Fedora DS bug.
Has this been fixed?
Not yet.
Is there a build available somewhere that I can download?
Not yet, but very soon.
Thanks.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
I have synced win2k03 group cn=users,dc=domain,dc=tld and FDS group ou=people,dc=domain,dc=tld. (The default groups , i have not touched the schema) 1)Are the attributes for any user in the two servers the same? If there are attributes that are there in AD and not in FDS or vice versa , does it simply ignore it during the sync?
The attributes listed in the documentation are sync'ed. Others are ignored. (the list is slightly different for groups vs. users).
2)When using this setup for Postfix authentication from the FDS , do we need to add any additional attributes in the AD or the FDS (Since i intend to use the AD for user creation) to get the postfix authentication working?
Dunno. Obviously postfix will expect some schema. You can either try to sync that over from AD, in which case it'd need to conform to the sync'ed attributes list mentioned above. Or you'd need to add the postfix-specific attributes on the FDS side.
3)Lastly does postfix work with LDAP with the default installation along with RHEL? The documentation in http://www.postfix.org/LDAP_README.html specifies configuration options for use with OpenLDAP .Is it the same for FDS?
Not sure, but this may help: http://www.ldapsource.com/content/ldap_postfix.html It seems that Postfix can be configured to use whatever attribute names you want, so you may be able to use standard schema at least in the case that you aren't doing virtual domains.
389-users@lists.fedoraproject.org
-
David Boreham -
Dimitri Yioulos -
Nabeel Moidu -
Pedro Rodrigues -
Rich Megginson -
William Francis