389-devel February 2007

389-devel@lists.fedoraproject.org

13 participants
35 discussions

[Fedora-directory-devel] Need to configure, but not start fedora-ds
by Andrew Bartlett 28 Feb '07

28 Feb '07

In working to have the Samba4 test environment configure fedora-ds. I'm using ds_newinst.pl, but it starts the DS once it is created. According to that script, I could modify it, but: # if for some reason you do not want the server started after instance creation # the following line can be commented out - NOTE that if you are creating the # Configuration DS, it will be started anyway $cgiargs{start_server} = 1; As I understand it, a new standalone install will create the configuration DS. Aside from wanting a separate configure/start sequence, I would like to be able to modify the dse.ldif to fix up some parameters, and redo the schema, before the slapd process starts. For the parameter modification, another option might be to have a 'modify ldif' in addition to the 'initial ldif', but I still need a way to clean out the schema. Thoughts? Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

3 11

[Fedora-directory-devel] LDAP Authentication
by Michiel van Heukelom - Van Boxtel Software BV 28 Feb '07

28 Feb '07

Problem with authenticate. I've installed fedora-ds-1.0.4-1.RHEL4.i386.opt.rpm and it seems to be working fine. I can manage users by the console. On another machine i want to use the directory, but when ik log in, in /var/log/messages i get the following error: Feb 23 13:07:59 ldap-vm4 remote(pam_unix)[3885]: check pass; user unknown Feb 23 13:07:59 ldap-vm4 remote(pam_unix)[3885]: authentication failure; logname= uid=0 euid=0 tty=pts/2 ruser= rhost=192.168.100.176 Feb 23 13:07:59 ldap-vm4 remote(pam_unix)[3885]: could not identify user (from getpwnam(mvheukelom)) Feb 23 13:07:59 ldap-vm4 login[3885]: User not known to the underlying authentication module On my ldap server the file /opt/fedora-ds/slapd/logs/access [28/Feb/2007:11:27:49 +0100] conn=250 op=0 BIND dn="dc=example,dc=com" method=128 version=3 [28/Feb/2007:11:27:49 +0100] conn=250 op=0 RESULT err=48 tag=97 nentries=0 etime=0 [28/Feb/2007:11:27:51 +0100] conn=251 fd=67 slot=67 connection from 192.168.100.118 to 192.168.100.119 [28/Feb/2007:11:27:51 +0100] conn=251 op=0 BIND dn="dc=example,dc=com" method=128 version=3 [28/Feb/2007:11:27:51 +0100] conn=251 op=0 RESULT err=48 tag=97 nentries=0 etime=0 [28/Feb/2007:11:27:51 +0100] conn=251 op=1 UNBIND [28/Feb/2007:11:27:51 +0100] conn=251 op=1 fd=67 closed - U1 my ldap.conf on my client: host 192.168.100.119 base dc=Example,dc=com rootbinddn dc=example,dc=com In authconfig i've made the changes to: use ladap and user ldap authentication. I've also filled in my server (IP-number) and my base. Can someone advise me what to check please.... Best regards, Michiel van Heukelom Van Boxtel Software B.V. Phone: +31 (0) 492 - 327 357 Fax: +31 (0) 492 - 324 326 E-mail: mvheukelom(a)van-boxtel-software.nl Website: www.van-boxtel-software.nl

3 3

[Fedora-directory-devel] Can't start Fedora DS in test env
by Andrew Bartlett 26 Feb '07

26 Feb '07

I'm having trouble starting Fedora Directory... In my further attempts to run FDS in my Samba4 test environment, using current CVS, I get the following: Fedora-Directory/1.1.0a1 B2007.054.711 <host>:<port> (/data/samba/samba4/svn/source/st/ldap/slapd-samba4) [26/Feb/2007:15:21:31 +1100] - slapi_str2entry: entry has multiple dns "cn=Distributed Numeric Assignment Plugin,cn=plugins,c n=config" and "cn=ldbm database,cn=plugins,cn=config" (second ignored) [26/Feb/2007:15:21:32 +1100] - slapi_str2entry: entry has multiple dns "cn=Distributed Numeric Assignment Plugin,cn=plugins,c n=config" and "cn=ldbm database,cn=plugins,cn=config" (second ignored) [26/Feb/2007:15:21:32 +1100] - 3 duplicate values for attribute type objectclass detected in entry cn=Distributed Numeric Ass ignment Plugin,cn=plugins,cn=config. Extra values ignored. [26/Feb/2007:15:21:32 +1100] - Fedora-Directory/1.1.0a1 B2007.054.711 starting up [26/Feb/2007:15:21:32 +1100] - Warning: Mapping tree node entry for dc=samba,dc=example,dc=com point to an unknown backend : userRoot [26/Feb/2007:15:21:32 +1100] - Warning: Mapping tree node entry for dc=samba,dc=example,dc=com point to an unknown backend : userRoot [26/Feb/2007:15:21:32 +1100] - Warning: Mapping tree node entry for dc=samba,dc=example,dc=com point to an unknown backend : userRoot [26/Feb/2007:15:21:32 +1100] - Warning: Mapping tree node entry for dc=samba,dc=example,dc=com point to an unknown backend : userRoot [26/Feb/2007:15:21:32 +1100] - Error: Failed to resolve plugin dependencies [26/Feb/2007:15:21:32 +1100] - Error: object plugin Legacy Replication Plugin is not started [26/Feb/2007:15:21:32 +1100] - Error: object plugin Multimaster Replication Plugin is not started -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

2 1

[Fedora-directory-devel] RE: Fedora-directory-devel Digest, Vol 20, Issue 17
by Eswar S 26 Feb '07

26 Feb '07

Hi, How to configure Fedora-ds for other RDBMS databases. Currently I have lbdm database like cn = lbdm database cn=plugins,cn=config If I want PostgresSQL as backend , how can I configure. Please help for this. Thank you Eswar S

2 1

[Fedora-directory-devel] fedora-ds performance report
by Eswar S 26 Feb '07

26 Feb '07

Hi all, I can please tell me , how to tune fedora 7.1 for good Performance. Now it is taking 20,000 records in 4.15 sec using ldapmodify command. >From console import it is around 2min .30 sec. Is there any statistic information for fedora-ds performance? Please tell some configuration setting that can improve performance .. Thanks Eswar s **************************************************************************** **************************** This e-mail and attachments contain confidential information from HUAWEI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient's) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

1 0

[Fedora-directory-devel] Very slow to run dn_newinst.pl
by Andrew Bartlett 25 Feb '07

25 Feb '07

It seems to me that ds_newinst.pl takes a very long time, particularly in various DNS challenged environments. (I presume this is DNS, from earlier hints and because of the length of the timeout) As this should be an automated, scripted process in a tight reproducible testing environment, I'm trying to avoid it doing anything that would cause actual network packets. Is there anything else that could cause ds_newinst.pl to appear to hang? Is there a way to ensure it never does DNS queries? Thanks, Andrew Bartlett -- Andrew Bartlett http://samba.org/~abartlet/ Authentication Developer, Samba Team http://samba.org Samba Developer, Red Hat Inc. http://redhat.com

1 0

Re: [Fedora-directory-devel] Need to configure, but not start fedora-ds
by Howard Chu 24 Feb '07

24 Feb '07

> Date: Sat, 24 Feb 2007 09:02:23 +1100 > From: Andrew Bartlett <abartlet(a)samba.org> > On Fri, 2007-02-23 at 08:49 -0700, Richard Megginson wrote: >> > Andrew Bartlett wrote: >> > I understand where you are coming from. With openldap, you just have to >> > provide your own hand tuned slapd.conf file - nothing else really is >> > required. That also controls what schema is loaded. > Yeah. It really does show that I did this on OpenLDAP first... >> > It's not so easy to do the same thing with fedora ds. For starters, the >> > dse.ldif file is much more complex (but in your case, there are only a >> > few options required to be tweaked). And the schema handling (i.e. >> > include /path/to/core.schema ; include /path/to/posix.schema) is >> > completely out of band with this process (well, not quite - you can >> > override the nsslapd-schemadir in cn=config). > So, yes, I suppose I'm just trying to turn Fedora DS into OpenLDAP, one > step at a time :-) Good man! ;) (But wait, I thought we were turning OpenLDAP's config into ... oh never mind...) I don't know if this will help you guys or not, but we implemented "include:" directives for LDIF, following this discussion: http://www.openldap.org/lists/ietf-ldapext/200504/msg00003.html The current manpage also describes it http://www.openldap.org/software/man.cgi?query=ldif&sektion=5&apropos=0&man… Note that this is already implemented in OpenLDAP 2.3, we just didn't backport the manpage update (oops). Anyway, this lets us create very compact config.ldif's that can be slapadd'd to bootstrap a server, with all relevant schema (in LDIF, not slapd.conf format) referenced as desired. Obviously being able to keep everything under a single config tree makes life a lot easier. -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

1 0

[Fedora-directory-devel] (no subject)
by Eswar S 24 Feb '07

24 Feb '07

1 0

[Fedora-directory-devel] Redux: Please review: Bug 229077: Rename fedora-ds to fedora-ds-base (The package breaks an previous installation of the Fedora DS!!)
by Rich Megginson 23 Feb '07

23 Feb '07

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229077 Resolves: bug 229077 Bug Description: Rename fedora-ds to fedora-ds-base (The package breaks an previous installation of the Fedora DS!!) Reviewed by: ??? Files: configure.ac and all generated autotool files Branch: HEAD Fix Description: As it turns out, only the spec file will have to change. It is ok that we have a package named pkgname-base that uses paths like /etc/pkgname and service pkgname. So this diff has been revised to simply bump the version in the code to differentiate it from the previously withdrawn fedora-ds in Fedora Extras. Platforms tested: RHEL4, FC6 Flag Day: No. Doc impact: No. https://bugzilla.redhat.com/bugzilla/process_bug.cgi#c5 -- Fedora-directory-devel mailing list Fedora-directory-devel(a)redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-devel

2 1

[Fedora-directory-devel] Re: Please Review: Add LDAPI (LDAP over unix domain sockets)
by Howard Chu 23 Feb '07

23 Feb '07

> Date: Wed, 21 Feb 2007 12:16:04 -0800 > From: Pete Rowley <prowley(a)redhat.com> Sorry, I don't mean to beat too much on a dead horse, but ... > Howard Chu wrote: >> > Yes. But again, the Heimdal KDC does an explicit SASL/EXTERNAL Bind to >> > request this privilege. There is no assumption of automagic >> > authorization. > I guess we can add that. Rich and I have already talked about that as a TBD. > While observing RFC4513 is a good thing, and this implementation does so > when auto-bind is switched off, I believe these kinds of decisions are > the domain of site administrative policy and not of standards documents. > Further, a client in the anonymous bind state has no practical knowledge > of the effects of that state on server responses in any case, nor can it > be sure that binding as a non-anonymous user has any effect on those > responses, nor indeed does auto-bind necessarily remove or add any > privilege for the client - that is all administrative policy and > undefined by any RFC. This is just one more administrative policy option. Certainly it's true that LDAP has nothing specific to say about authorization. But don't confuse authorization with authentication; they're two separate things. A client can easily determine that it's in an anonymous state, using the WhoAmI extended op. If "ldapwhoami -x -H ldapi:///" doesn't return a zero-length ID, then your server is broken. > In addition, LDAP is defined as it is in no small part to the underlying > assumption of TCP and designed around the practical methods of > authentication given that assumption, strictly speaking LDAPI isn't LDAP > (it's not even platform agnostic), and LDAPI has other methods at its > disposal. And again, don't confuse the protocol with the transport. Fuzzy thinking like that is one of the reasons we have LDAP today, instead of just DAP over TCP. Sure the RFCs only define LDAP in terms of TCP, but obviously any reliable, ordered, stream transport will work just as well. And in a proper library implementation, such a transport can be substituted between any client and server without needing to alter any other code in the client or server. > While I understand your concern, the feature is an option, not a > requirement. Yes, but it shouldn't be an option at all. You provide the option in the expectation that someone will use it. The presence of such an option therefore encourages client writers to depend on non-standard behaviors. You might say "this is a site-local policy decision" but it doesn't just affect a single site. You implicitly create lock-in with features like this, and you have no idea what other servers such clients will eventually be talking to. I would expect thinking like this from Microsoft or Sun, but not from an open source developer. And no matter how much we may think our respective server is the best in the world, and that no one would ever have any reason to talk to any other server, one need only look at SunOne to see that nothing lasts forever. Providing options that break standards like this *hurts* your users, it doesn't help them. The standard mechanism for using an LDAP session with previously established credentials is to use a SASL/EXTERNAL Bind. Encouraging any other behavior is flat out wrong. Yes, it's OK to provide options that completely change the behavior of the server. But it's only OK to do that *when the client explicitly asks for it*. I could define a control that causes all strings to be returned in Morse code, and that would be perfectly fine, because a client has to use the control before it gets such an outlandish behavior. Some folks may be wondering why I'm spending so much time on this point, since it's your server and I'm not contributing to its code. Just remember that network protocols are about interoperability; nothing you do exists in a vacuum. Every mistake anyone makes affects everyone - just look at the dynamic group mess if you need an example... -- -- Howard Chu Chief Architect, Symas Corp. http://www.symas.com Director, Highland Sun http://highlandsun.com/hyc Chief Architect, OpenLDAP http://www.openldap.org/project/

3 5

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-devel February 2007