[Fedora-directory-users] linux authentication though ds
by lance raymond
Afternoon, I have been reading a lot on this and wish to see if I am on the
right track. I wish to have all employees login information be stored in
DS, and authenticate through him. I have subscribed to the list a few day's
ago and the questions are pretty high level, so it does seem that people are
using fedora's version, so I guess for starters, is this possible.
I already have fedora ds running, added a few people, but I didn't see 2
much on authenticating though DS.
Thanks ...
lr
16 years, 6 months
[Fedora-directory-users] nss_ldap cannot authenticate vs FDS
by Peter Santiago
Hi,
I was able to finally configure FDS to sync with ADS with Winsync.
Thanks a lot to the members here.
Now I ran into another peculiar problem. NSS_LDAP seems not to be
able to authenticate or do a successful query against FDS.
I used ldapsearch to double check, I was able to do a successful query
against FDS.
Attached are two files from doing id and ldapsearch. I have
enabled debugging.
Could someone help explain why ldapsearch can successfully query
FDS whereas NSS_LDAP cannot? Maybe there is a need to patch NSS_LDAP?
I'm using nss_ldap 253 from fedora 6 package.
--
Peter Santiago peters(a)psinergybbs.com
My website: www.psinergybbs.com
My spamtrap address: r34987y(a)psinergybbs.com
----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.
16 years, 6 months
[Fedora-directory-users] problems with post/fedora-ds
by Jeffrey McDonald
Hi,
I'm having some problems with fedora-ds and postfix in a high-rate
environment. First, let me say that we are migrating from openldap-1.2.2 to
Fedora-DS. The configuration with postfix+openldap has to be migrated to
fedora-ds and the postfix+openldap works great in the high-rate
environment. I have a relay_recipient_maps and a alias list which both use
ldap. However, ldaps connections (and ldap) connections to fedora-DS
seem to time out in a high-rate environment. In slow-rate environment were
there are a few 10s of emails an hour, things work fine. In the high-rate
where you receive 1-5 of emails per second, I am seeing lots of temporary
lookup failures. My configuration looks exactly like the POSTFIX Wiki
configuration on the directory.fedoraproject.org/wiki page.
We did some debugging to take a look at postfix, which attempts to open a
connection to the ldap server and does, then it wants to perform multiple
lookups per connection but this doesn't work--it seems for some reason that
postfix is unable to do more than one lookup per connection. The
fedora-DS ends up with many connections from postfix which eventually
time-out.
Any ideas as to what could be wrong?
Thanks,
Jeff
16 years, 6 months
Re: [Fedora-directory-users] fds vs passsync vs AD
by Paolo Barbato
Dear list,
I repost original question on my troubles....anybody has any idea on
why I'm facing such a problem ?
Regards,
Paolo.
>Thanks for reply, but I suspect I'm facing a different problem.
>
>Talking about SSL.
>
>As far as I understand SSL is used both for passync (AD -> FDS) and
>replication agreement (AD <-> FDS). Note two different tasks.
>
>In first case work cert.db8 certificates. I've installed on both AD
>and FDS, my CA certificate and FDS server certificate. Passync works
>without a hic. When I change pasword from windows it's exactly set
>on FDS.
>
>Replication agreement is based on cert.db8 on FDS and MS
>architecture on AD, I mean that I make use of mmc to install CA and
>AD server signed certificate.
>
>Replication seems also work, since I see that AD and FDS users are
>"merged" in one (almost) identical list. So users that were in AD
>are created on FDS and viceversa, with (almost) all parameters
>setted.
>
>My problem arise when from a linux machine authenticated on FDS I
>issue and passwd change password. Really all seems go right, since
>FDS register new password, and also AD tell me that the change has
>been committed :
>
>first event
>User Account Changed:
> Target Account Name: barbato
> Target Domain: TEST
> Target Account ID: TEST\barbato
> Caller User Name: sync manager
> Caller Domain: TEST
> Caller Logon ID: (0x0,0x318F76)
> Privileges: -
> Changed Attributes:
> Sam Account Name: -
> Display Name: -
> User Principal Name: -
> Home Directory: -
>and after a while a second security event:
>
>User Account password set:
> Target Account Name: barbato
> Target Domain: TEST
> Target Account ID: TEST\barbato
> Caller User Name: sync manager
> Caller Domain: TEST
> Caller Logon ID: (0x0,0x318F76)
>
>
>But when I try to log on AD with this new password AD tell me that
>I'm usinig the wrong one. Note that also the previous doesn't work,
>and this confirm that it has been really changed.
>
>Anybody has faced this ? Some other things to look into ?
>
>Regards,
>Paolo.
--
------------------------------------------------------------------------------------------------
Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it
Network Administrator phone: (39-049)-829-5097
(39-049)-829-5000
Corso Stati Uniti,4 www: http://www.igi.cnr.it
35127 Camin-Padova PGP:
http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp
ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org
------------------------------------------------------------------------------------------------
16 years, 6 months
[Fedora-directory-users] How can you monitor replication?
by Ian Meyer
Hello,
We have a decent sized env. (1 master, 16 slaves in different
datacenters across the world) and we're trying to find a way to
effectively monitor the status of replication. When was the last
update? How many changes were made? How long did it take from start to
finish? I know you can get most of this information from the gui, but
we need to tie it in to our monitoring application. Is this
information stored in a db anywhere? In ldap itself? Any insight would
be appreciated.
Thanks in advance!
- Ian
16 years, 6 months