[Fedora-directory-users] How can I create a User ID alias?
by Darren Fulton
I have an in production application at our office (Web Calendar) that I
am migrating to LDAP authentication using FDS from application internal
authentication.
Some of the users in the old program have user id's of $firstname and
they don't work because everyone in the ldap server was setup as
$firstinitial$lasthname.
I have not been sucessful at changing the User ID's in the application
from $firstname to $firstinitial$lastname.
Question: Is there a way that I can make aliases in FDS such that User
ID james equals User ID jjones? If so, how can I do it?
Thank you.
Darren
18 years
[Fedora-directory-users] make an attribute default to object class?
by speedy zinc
Ok, I have this weird idea that I want to make a new
attribute an allowed attribute of an existing
objectclass
and all its sub-classes, but without modifying the
definition of the existing class, only thru extension.
For example, if I define a new attribute called
"myWhackyAttr", and I want to make it part of an
allowed
attribute of nsRoleDefinition (or
nsSimpleRoleDefinition),
so that the attribute is available to all sub-classes.
To do that, I can change the definition of
nsRoleDefinition
in 00core.ldif, which everyone would say "stop right
there,
you shouldn't do that".
The other way is, I can create an aux objectclass with
that attribute, and everytime I create a new role,
I have to make sure that I add that object class to
the
new entry. That's tedious, and might forget it.
Is there a third way to enforce that?
thanks for any hint.
sz
__________________________________
Start your day with Yahoo! - Make it your home page!
http://www.yahoo.com/r/hs
18 years
[Fedora-directory-users] numerical prefix of schema file
by speedy zinc
Hi,
I see each schema file is prefixed with a numerical
value, such as:
00core.ldif
50ns-wcal.ldif
51ns-calendar.ldif
60pam-plugin.ldif
99user.ldif
so what does the numerical prefix mean? I just know
that
if I change the schema from the console, it ends up in
99user.ldif. But what about the others? Is it for
loading
orders, or something else?
If I add my own schema files, which value do I use for
the
prefix?
thanks
sz
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
18 years
[Fedora-directory-users] role of uxwdog?
by speedy zinc
What is the role of this watch dog? It would seem more
useful if the watch dog can watch over the slapd
process (and restart it if it dies), but it does not.
So what is it doing? Seems like it's watching over the
ns-httpd instead.
rgds
sz
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
18 years
[Fedora-directory-users] what's wrong with this ACI?
by speedy zinc
I've created two user entries under People:
Test User: uid=testuser
Jane Doe : uid=JDoe
Here's what I'm trying to achieve with access control:
- Turn off anon access to the entry Test User
- Allow full access to Test User on Test User
- Allow (read, search, compare) to JDoe on Test User,
and
no other users
- Allow full access to "cn=Directory Manager" on Test
User.
- Anon access is still allowed on other entries
So, here is the list of ACIs (besides the inherited
ones)
that I've created on the entry Test User:
(targetattr = "*") (version 3.0;acl "self";allow
(all)(userdn = "ldap:///uid=testuser,ou=People,
dc=dummy,dc=com");)
(targetattr != "userPassword") (version 3.0;acl "No
anonymous access";deny (all)(userdn =
"ldap:///anyone");)
(targetattr = "*") (target =
"ldap:///uid=testuser,ou=People, dc=dummy,dc=com")
(version 3.0;acl "Allow JDoe";allow
(read,compare,search)(userdn =
"ldap:///uid=JDoe,ou=People, dc=dummy,dc=com");)
With the ACIs above, it seems that the "No anonymous
access"
is taking precendence over the other two. Even the
"Test
User" does not have access to its own data, and JDoe
certainly does not either. The only user who has
access
is the Directory Manager.
How do I achieve my goals with ACI?
thanks a lot.
sz.
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
18 years, 1 month
[Fedora-directory-users] Extending AD replication
by Daniel Shackelford
Hello All.
I have successfully setup Directory Server on FC4 and am
replicating/syncing with our Active Directory Domain. No problems
there. What I would like to know is if there is a way to replicate more
attributes of the users. We use the employeeID attribute in AD, and I
would like to replicate that to DS. Anybody know if there is a way to
configure what attributes are replicated? Obviously in a DS =>DS
replication environment, all attributes will be replicated, but what
about AD?
--
Daniel Shackelford
Systems Administrator
Technology Services
Spring Arbor University
517 750-6648
18 years, 1 month
[Fedora-directory-users] AD sync
by Darjo Gregoric
Hi,
I have a problem with AD sync. I have established synchronization without
SSL and works fine, but when I use SSL, connection is not established and I
receive error:
Simple bind failed, LDAP sdk error 81 (Can't contact LDAP server), Netscape
Portable Runtime error -8179 (Peer's Certificate issuer is not recognized.)
AD machine name is suzy.
I have exported CA and imported it on Directory server.
Certutil -L -d . gives:
CA certificate CTu,u,u
suzy CT,,
Server-Cert u,u,u
Did i miss something?
Is there any HOW TO for this type of configuration?
Regards
Darjo
18 years, 1 month
[Fedora-directory-users] pass thru authentication
by Derek T. Yarnell
Does the Fedora DS or RHDS support pass thru authentication via SASL?
For example, openldap can use --enable-spasswd at compile time to allow
simple binds be accepted at the LDAP level and then authenticated with
SASL (saslauthd in this example) to kerberos underneath and accept the bind.
I need to have kerberos around for AFS but would like to be able to just
use the LDAP directory as a way to authenticate clients that are not
kerberized.
--
---
Derek T. Yarnell
University of Maryland
Institute for Advanced Computer Studies
derek(a)umiacs.umd.edu
18 years, 1 month
RE: [Fedora-directory-users] Fedora Management Console 7.0
by Tay, Gary
Google LAM, LDAP Account Manager
Gary
-----Original Message-----
From: fedora-directory-users-bounces(a)redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of Anthony
Gabila
Sent: Monday, October 31, 2005 10:56 AM
To: fedora-directory-users(a)redhat.com
Subject: [Fedora-directory-users] Fedora Management Console 7.0
Hi,
Not quite sure how to solve this problem, I'm trying to add a
user via Fedora Management Console,
but I am not able to log in to my Win2k Pro machine using that
username.
I manage to get around this problem by entering the command
"smbpasswd -a testuser"
I was wondering if I could skip this extra step by doing all
these in the Management Console app?
agabila
18 years, 1 month