[Fedora-directory-users] Download package for various FC/RHEL versions?
by Bryan Smith
On the download pages, I noted that the same package should be used for
both FC2 and RHEL3. Is this correct? It was always my assumption that
RHL8, RHL9 and FC1 used the same packages as RHEL3, while FC2 and FC3
were the same as RHEL4.
As such, should it not be that the FC3/RHEL4 version is also what should
be downloaded for FC2? And then the RHEL3 would also be for FC1, not
FC2?
About the only place where FC2 differs from FC3/RHEL4 seems to be GCC
(3.3 for the former instead of 3.4 like the latter two). FC1 actually
ships the same version as FC2, and not the same as FC1/RHEL3 (3.3 for
the former instead of 3.2 like the latter two).
So I'm just curious if the download recommendation is correct for FC2?
-- Bryan
P.S. I've been tracking Kernel, C and GLibC (among other, core ABI
packages) on Red Hat releases over the years. I recently posted a
simplified history table through FC5 on my blog here:
http://thebs413.blogspot.com/2006/05/fedora-red-hat-abi-compatibility.html
--
Bryan J. Smith Professional, technical annoyance
mailto:b.j.smith@ieee.org http://thebs413.blogspot.com
----------------------------------------------------------
The existence of Linux has far more to do with the breakup
of AT&T's monopoly than anything Microsoft has ever done.
16 years, 11 months
[Fedora-directory-users] Migrate to FDS
by David A. Hopkins
Sorry if this is obvious, but I have an existing LDAP directory based on Openldap and the smbldap-tools. Can I simply migrate the existing system to FDS? It is running on an x86_64 architecture. I suspect I could install FDS on a second system, sync with the existing system, then decommission the existing, install FDS, sync, and be good to go? But ... I am not sure.
Thanks,
Dave Hopkins
16 years, 11 months
[Fedora-directory-users] phpldapadmin acl configuration
by Mikael Kermorgant
Hello,
I've tried to setup phpldapadmin but it fails after login with this error :
---
Our attempts to find your SCHEMA for "attributetypes" have FAILED.
---
I've read that Fedora DS works with phpldapadmin and that this error
can be due to wrong acl :
http://wiki.pldapadmin.com/tiki-view_faq.php?faqId=1#q11
I've created a special user phpldapadmin but don't know what rights to
give to him as I haven't found cn=subschema
Would someone have an idea ?
Regards,
--
Mikael Kermorgant
16 years, 11 months
[Fedora-directory-users] Password synchronization error
by Jeff Gamsby
Has anyone ever come across this error:
[15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Received error [0000216C: AtrErr: DSID-031D0AC0, #1: 0:0000216C: DSID-031D0AC0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9005a (unicodePwd) ] when attempting to modify entry
[<GUID=e873f710d5b9394db14c701cf5f11821>]: Please correct the attribute specified in the error message. Refer to the Windows Active Directory docs for more information.
[15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): windows_replay_update: update password returned 1
[15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD" (ad:636): Consumer failed to replay change (uniqueid
3783a101-1dd211b2-802fd24c-a4ed0000, CSN 4492399a000000010000): Constraint violation. Skipping.
I used ldapmodify to change the password. This is the ldif file that I used:
dn: uid=user,ou=people,dc=server,dc=example,dc=com
changetype: modify
replace: userpassword
userpassword:: e2NyeXB0fSQxJHREb0RZV3JxJFE5UDVmMmVnSzc4NHAvVXVKVldnTS4=
It successfully changes the password in FDS, but not in AD
Thanks,
Jeff
16 years, 11 months
[Fedora-directory-users] Password synchronization error
by Jeff Gamsby
Has anyone ever come across this error:
[15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): Received error [0000216C: AtrErr: DSID-031D0AC0, #1:
0:0000216C: DSID-031D0AC0, problem 1005 (CONSTRAINT_ATT_TYPE), data 0,
Att 9005a (unicodePwd) ] when attempting to modify entry
[<GUID=e873f710d5b9394db14c701cf5f11821>]: Please correct the attribute
specified in the error message. Refer to the Windows Active Directory
docs for more information.
[15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): windows_replay_update: update password returned 1
[15/Jun/2006:21:54:25 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): Consumer failed to replay change (uniqueid
3783a101-1dd211b2-802fd24c-a4ed0000, CSN 4492399a000000010000):
Constraint violation. Skipping.
I used ldapmodify to change the password. This is the ldif file that I used:
dn: uid=user,ou=people,dc=server,dc=example,dc=com
changetype: modify
replace: userpassword
userpassword:: (cut and paste from userpassword attribute after ldapsearch)
It successfully changes the password in FDS, but not in AD
Thanks,
Jeff
16 years, 11 months
[Fedora-directory-users] Fedora DS installation on Ubuntu Dapper Drake
by Olivier Brugman
Hi all,
Thank you for the FDS software!
This morning I installed the Fedora Directory Server (FDS) on Ubuntu
Dapper Drake (6.06 LTS). This procedure seems to work for me in order to
get FDS running on the Dapper platform:
The procedure is almost equal to the existing howto for Ubuntu Breezy
Badger and Debian GNU/Linux Sarge which is available at
http://directory.fedora.redhat.com/wiki/Howto:DebianUbuntu
I'll just describe the parts that deviate.
I installed the FDS on a clean minimal installation of Ubuntu Dapper
Drake server-version (x86), which is available at
http://www.ubuntu.com/download
As Dapper uses libc6 version 2.3.6 I took the Fedora Core 4-rpm (version
1.0.2) as a base for conversion to '.deb'. You can download the rpm at
http://directory.fedora.redhat.com/wiki/Download
The necessary termcap-compat package does not seem to be available for
'Dapper', so I just used the 'Breezy' version of that package.
termcap-compat depends on the 'libc5' and 'ldso' packages which aren't
available for 'Dapper' eighter. You can get the Breezy-version of these
packages at http://packages.ubuntu.com/
BTW, I used the Sun jdk 1.5.0_02.
After the installation of the fedora-ds .deb-package I used the
setuputil and an existing 'install.inf' file (see example hereunder) to
do a silent install of the FDS.
You can invoke the silent install like so:
sudo /opt/fedora-ds/setup/setup -s -f /opt/install.inf
Example install.inf:
[General]
FullMachineName= xenfds.intra.example.com
SuiteSpotUserID= fds
SuiteSpotGroup= fds
ServerRoot= /opt/fedora-ds
AdminDomain= intra.example.com
ConfigDirectoryAdminID= admin
ConfigDirectoryAdminPwd= yourpasswordhere
ConfigDirectoryLdapURL= ldap://xenfds.intra.example.com:389/o=NetscapeRoot
UserDirectoryAdminID= admin
UserDirectoryAdminPwd= yourpasswordhere
UserDirectoryLdapURL=
ldap://xenfds.intra.example.com:389/dc=intra,dc=example,dc=com
[slapd]
SlapdConfigForMC= Yes
SecurityOn= No
UseExistingMC= No
UseExistingUG= No
ServerPort= 389
ServerIdentifier= xenfds
Suffix= dc=intra, dc=example, dc=com
RootDN= cn=Directory Manager
AddSampleEntries= No
InstallLdifFile= suggest
AddOrgEntries= Yes
DisableSchemaChecking= No
RootDNPwd= hannibal
[admin]
SysUser= root
Port= 7777
ServerIpAddress=
ServerAdminID= admin
ServerAdminPwd= yourpasswordhere
ApacheDir= /usr/sbin
ApacheRoot= /usr/lib/apache2
HTH,
Olivier Brugman
16 years, 11 months
[Fedora-directory-users] PassSync only working one way
by Jeff Gamsby
I thought that I had the PassSync working until I ran into this problem:
Passwords are not synchronized from FDS to AD. When accounts are added
to FDS, they do show up in AD ( Although sometimes the cn attribute gets
base64 encoded ), but I cannot authenticate to AD. When I change
passwords in the FDS side, they are not changed ( or not sent ) to AD.
If I change passwords in AD, they are changed in the FDS.
The logs show that something is happening (changed host names and dn's)
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): No linger to cancel on the connection
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin -
windows_acquire_replica returned success (101)
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): State: ready_to_acquire_replica -> sending_updates
[13/Jun/2006:15:03:41 -0700] - _cl5PositionCursorForReplay (agmt="cn=AD"
(ad:636)): Consumer RUV:
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): {replicageneration} 448f18ae000000010000
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): {replica 1 ldap://fds:389} 448f18e4000100010000
448f363d03d400010000 448f363d
[13/Jun/2006:15:03:41 -0700] - _cl5PositionCursorForReplay (agmt="cn=AD"
(ad:636)): Supplier RUV:
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): {replicageneration} 448f18ae000000010000
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): {replica 1 ldap://fds:389} 448f18e4000100010000
448f363d03d700010000 448f363d
[13/Jun/2006:15:03:41 -0700] agmt="cn=AD" (ad:636) - session start:
anchorcsn=448f363d03d400010000
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - changelog program -
agmt="cn=AD" (ad:636): CSN 448f363d03d400010000 found, position set for
replay
[13/Jun/2006:15:03:41 -0700] agmt="cn=AD" (ad:636) - load=1 rec=1
csn=448f363d03d600010000
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): windows_replay_update: Looking at modify operation local
dn="uid=user,ou=people,dc=server,dc=,dc=" (ours,user,not group)
[13/Jun/2006:15:03:41 -0700] NSMMReplicationPlugin - agmt="cn=AD"
(ad:636): windows_replay_update: Processing modify operation local
dn="uid=user,ou=people,dc=server,dc=,dc=" remote
dn="<GUID=16f869dcfdde3d42bcb075fd4a1c7980>"
I'm not sure what is going on, I can talk via SSL from FDS to AD, and
I'm assuming that the PassSync service is working properly since the
changes from AD to FDS work.
Any suggestions?
16 years, 12 months
[Fedora-directory-users] data design for inactive users?
by Scott Roberts
In our ldap we do not delete users, we deactivate them
with nsaccountlock. All user entries are in the same
branch of the tree. In this data structure, all uid's
are unique and are not used again.
Ok well now our ldap is getting large and I would like
active users separate from inactive users to provide
better search performance. AFAIK lot of services keep
uid's so they cannot be used again. What's a good
design approach? Do inactive users move to another
tree? Maybe move to another server and use a referral
somehow. What do ldap admins do with all this dead
weight? :)
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
16 years, 12 months
[Fedora-directory-users] Sync problem
by Atr0pos
Hi list,
I'm running FDS on FC4 and have configure windows sync (not password
sync for the moment - just groups and accounts) against my AD.
All is working well (add - delete) but when I move an AD account from an
OU to another one OU (ie. from ou=service,ou=people to ou=people), he
is not replicated on FDS (account still on the old OU -
ou=service,ou=people).
Have you ever seen that ?
16 years, 12 months
[Fedora-directory-users] Person object unable to update their own attributes
by Paul Clayton
I have set up a special user with the details
Cn=nextuid,ou=Cape Town,dc=mycompany,dc=com
The main attribute is "uid".
In this is attribute, is a number for example "500"
My PHP program uses this person object to determine the next "uid" to use when creating a new user.
Problem I am experiencing, is that I am not able to update or modify this person object using the person objects (cn=nextuid) own credentials.
I get a "Insufficient 'write' privilege to the 'uid' attribute of entry" (error 50)
The ACL allows self write and targets the attribute. Any ideas were I am going wrong.
Regards
Paul Clayton
--------------------------------------------------------
This e-mail and any attachments are confidential and may also be legally
privileged and/or copyright material of Intec Telecom Systems PLC (or its
affiliated companies). If you are not an intended or authorised recipient
of this e-mail or have received it in error, please delete it immediately
and notify the sender by e-mail. In such a case, reading, reproducing,
printing or further dissemination of this e-mail or its contents is strictly
prohibited and may be unlawful.
Intec Telecom Systems PLC does not represent or warrant that an attachment
hereto is free from computer viruses or other defects. The opinions
expressed in this e-mail and any attachments may be those of the author and
are not necessarily those of Intec Telecom Systems PLC.
16 years, 12 months