I have upgraded 3 servers to 1.0.4, and multimaster syncing is simply
not working for me. I've wiped everything, re-initialized
repeatedly, and I still get no syncing or one-way syncing and a lot
of logged errors about
NSMMReplicationPlugin - repl_set_mtn_referrals: could not set
referrals for replica ou=nia,o=nih,c=us: 1
I have had pretty bad luck with multimaster replication for the past
year with the various versions of FDS. I had it working for about 6
months, until I rebooted one the the servers, and it hasn't worked
since. I've reverted to single master syncing, but even then when I
issue a modify to one of the replicas I get an error of:
[Cannot save to directory server:]
[netscape.ldap.LDAPException:error result (1); Mapping tree node for
ou=nia,o=nih,c=us is set to return a referral, but no referral is
configured for it; Operations error]
The referrals option appears to be set automatically once the replica
is initialized, and I've also tried setting it manually, but I get
the same error either way. JXPlorer complains with the same message.
Any tips on what to try next? My goal is multimaster syncing
> On the same panel where the global option is, there is a checkbox for
> grained policies. The server will not enforce fine-grained policies
unless this box is > checked.
Yes, this is turned on. We are talking about the same place I hope - the
Config tab and the properties of the Data node?
I was wondering if anyone can help me with setting up a single sign on
system. I want my users to be able to sign on once and have access to all
areas of our site. Ie Forum, wiki, Trac, SVN, etc. From what I've read it
looks like Kerberos will be needed for this.
Is there a way to do this without Kerberos?
Is there a single tool that I can use to manage user passwords and FDS? Ie
User account creation, deletion, updating, password resets, etc.
How do I force FDS to ask Kerberos if a user's passwords is correct?
> Yes. The global setting must be enabled to use any sort of password
syntax checking. > You can then override it at the subtree or user
Hmm, doesn't seem to make any difference - I enabled password syntax
checking at the global level and it works, if I try to override it with
different checking at the subtree/user level, it's ignored, although the
global settings are enforced.
I tried the referential integrity plug-in and it worked as expected with
single master environment and groupofnames and groupofuniquenames groups.
I read the admin guide but there were some things that I did not fully
1. How about multimaster environment, if I have servers A and B and I enable
plug-in to server A. When change is done to the server B, server A shoud make
deletions ar modifications to the directory.
But what if the server A is down for maintenance and user is deleted from
server B, what happends? Does the server A do anything when it is started
2. How to enable referential integrity to the memberUid attribute?
I have user cn=user,c=fi that has uid=user and that user is added to group
example so that there is attribute memberUid=user.
When user is deleted, uid should be removed from example group. How to achieve
I tried to add nsslapd-pluginarg7=memberUid to the plugin but it did not work.
I'm testing this with FC4 and FDS 1.0.4.
is there any way how to log changes to selected attribute only? I would
need to monitor changes of user password (users claim that their
password sometimes stops working and I have to reset them). It would be
enough to audit LDAP modifications on all attributes, I think that retro
changelog plugin would help, but I do not know how to configure it... Is
there any documentation for this plugin?
While trying to enable SSL on a v1.0.4 FDS directory instance, an
attempt to click on "Manage Certificates" results in the above error
In v1.0.2, the certificate database was in /opt/fedora-ds/alias, and in
this case the database was created in this directory and is owned by
ldap:ldap (the user running the ldap server).
No indication is given as to why the file could not be opened, nor is an
indication given of which path is being used to find the database.
Does anyone have any ideas?
In the past I always used the 'older' Netscape 4.1 directory servers
on our servers containing more then hundred thousands of users and
groups. And the Netscape/i-planet mailservers, collabra servers,
webservers, proxy servers, etc integrated perfectly with that.
That's why I'm happy that Redhat now has the LDAP server from
Netscape. I hope they (Redhat) will maybe also buy the mailserver etc,
because then it will really be used in the enterprises.
And now I tried the fedora-ds on my linux box, and it works fine.
Now , I have a small question. In the past, when I deleted a user from
LDAP, that user was automatically deleted from all groups. I did the
same test with the fedora-ds, but he doesn't remove that users from
the groups , so leaving the group in an unhealthy state.
Did I forgot to configure something, or is this a known issue?
Many thanks for the reply, helpful as always!
> I'm not sure what PAM is doing here. You can always verify that you
are being properly > restricted on password syntax by using ldapmodify
or ldappasswd from the command line.
It seems not - ldappasswd doesn't enforce the policy whether I bind with
the user in question or Directory Manager. I've tried with subtree
policies and also user-only policies. If I try to change the password in
the GUI, the password policy works ok.
> This entry has objectclass ldapSubEntry, which means it is hidden from
Hmm, I wonder if PAM and ldappasswd are not finding the policies as a
result of this? There is nothing interesting in the access log - I can
see the extop password operation line but it doesn't say anything about
the filter used to look for password policy objects? Is there perhaps a
way to include ldapSubEntry objects in normal searches?