389-users December 2007

389-users@lists.fedoraproject.org

55 participants
59 discussions

[Fedora-directory-users] LDAP Accounts for large website
by Jared B. Griffith 13 Dec '07

13 Dec '07

I was wondering if anyone here has ever used LDAP for a website, that will potentially have millions of LDAP accounts. If so, are you experiencing slow query responses or other issues? If you were experiencing slow query responses, and were able to rectify the issue, how did you do this? We are currently using FDS for our main website for customer accounts. We currently have over 52,000 accounts in LDAP and have only been using this for 3 months. We are now experiencing extreme slow down in query response when getting customer data into and out of the LDAP servers. Any help would be greatly appreciated. -- - Thank you, - Jared B. Griffith - Farheap Solutions, Inc. - Lead Systems Administrator - California IT Department - Email - jared.griffith(a)farheap.com - Phone - 949.417.1500 ext. 266 - Cell Phone - 949.910.6542

5 9

[Fedora-directory-users] master-master replication issues after restore
by James Deuchar 13 Dec '07

13 Dec '07

hello, I've got a pair of masters replicating happily. I restore a db backup to master01 and reinitialise the master01->master02 replication agreement. On master02 I see: [13/Dec/2007:17:55:34 +0100] NSMMReplicationPlugin - replica_reload_ruv: Warning: new data for replica ou=x,dc=y,dc=com does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized So I do reinitialize the amster02-master02 agreement on master02. On master01 I see: [13/Dec/2007:17:57:03 +0100] NSMMReplicationPlugin - replica_reload_ruv: Warning: new data for replica ou=x,dc=y,dc=com does not match the data in the changelog. Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized. I do this for a while, adding/deleting entries occasionally to see if replication is back - there seems to be no repeatable procedure... What is the best correct way to restore a pair of replicating masters? thanks! _________________________________________________________________ Fancy some celeb spotting? https://www.celebmashup.com

1 0

[Fedora-directory-users] Integrating LDAP tools with Fedora Directory Server
by Jimmy Stewpot 13 Dec '07

13 Dec '07

Hello, I am currently researching the implementation of an LDAP server and I have some questions regarding compatibility. - Is it possible to integrate software which is compatible with openldap with Fedora Directory Server. For example tacplus has the ability to use openldap. Can I compile it with openldap support but have the FDS backend? - If its not possible to use other ldap client libraries does any one know of a list of software which out of the box supports FDS for things like RADIUS, TACACS etc. Any additional feedback would be most welcome. Regards, Jimmy.

1 0

[Fedora-directory-users] err=65 for ldap entry modify question
by Scott Ding 12 Dec '07

12 Dec '07

Hi all, Can anyone tell me what err=65 means for op=3 in the following log? [12/Dec/2007:11:47:43 -0800] conn=0 op=3 MOD dn="dn=Scott133133Y,dc=vdb,dc=sprintam,dc=autodesk,dc=com" [12/Dec/2007:11:47:43 -0800] conn=0 op=3 RESULT err=65 tag=103 nentries=0 etime=0 Thanks in advance, Scott [12/Dec/2007:11:47:43 -0800] conn=0 fd=64 slot=64 connection from 144.111.12.135 to 144.111.12.135 [12/Dec/2007:11:47:43 -0800] conn=0 op=0 BIND dn="cn=Directory Manager" method=128 version=2 [12/Dec/2007:11:47:43 -0800] conn=0 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [12/Dec/2007:11:47:43 -0800] conn=0 op=1 SRCH base="dn=Scott133133Y,dc=vdb,dc=sprintam,dc=autodesk,dc=com" scope=0 filter="(objectClass=*)" attrs=ALL [12/Dec/2007:11:47:43 -0800] conn=0 op=1 RESULT err=0 tag=101 nentries=1 etime=0 [12/Dec/2007:11:47:43 -0800] conn=0 op=2 ADD dn="dn=Scott133133N20071212194431Z,dc=vdb,dc=sprintam,dc=autodesk,dc=com" [12/Dec/2007:11:47:43 -0800] conn=0 op=2 RESULT err=0 tag=105 nentries=0 etime=0 [12/Dec/2007:11:47:43 -0800] conn=0 op=3 MOD dn="dn=Scott133133Y,dc=vdb,dc=sprintam,dc=autodesk,dc=com" [12/Dec/2007:11:47:43 -0800] conn=0 op=3 RESULT err=65 tag=103 nentries=0 etime=0 [12/Dec/2007:11:47:43 -0800] conn=0 op=4 UNBIND [12/Dec/2007:11:47:43 -0800] conn=0 op=4 fd=64 closed - U1

2 1

[Fedora-directory-users] New problem - Mandriva Linux - Administration Server Not Working
by Chris G. Sellers 12 Dec '07

12 Dec '07

I switched form Solarisx86 to MDK on x86 to do my testing. I've compiled the source (after having to link some directories to match the kernel path) and it appears all is working but the Administration Server will not work in the GUI. I noticed the jar files were not installed for the admin server, so I copied those over manually, but now the Admin Console hang when I click open the Server group. At on the console I get [admin@localhost fd]$ ./startconsole Uncaught error fetching image: java.lang.NullPointerException at java.io.FileInputStream.<init>(FileInputStream.java:103) at java.io.FileInputStream.<init>(FileInputStream.java:66) at sun.awt.image.FileImageSource.getDecoder(FileImageSource.java:35) at sun .awt.image.InputStreamImageSource.doFetch(InputStreamImageSource.java: 240) at sun.awt.image.ImageFetcher.fetchloop(ImageFetcher.java:172) at sun.awt.image.ImageFetcher.run(ImageFetcher.java:136) Nothing in the error logs. I'm guessing that something didn't get installed. In order to get the build to work, there were a few times that I had to symlink : n -s /var/tmp/dsbuild-fds104/ds/adminserver/work/fedora- adminserver-1.0.3/built/package/Linux2.6.22_x86_glibc_PTH_OPT.OBJ/ / var/tmp/dsbuild-fds104/ds/adminserver/work/fedora-adminserver-1.0.3/ built/package/Linux2.6_x86_glibc_PTH_OPT.OBJ because it got the linux kernel version off by a subrevision. But once I did that all was okay. Any ideas anyone? I don't want to spend too much time on this because my final deployment will probably be on a RHEL or CENTOS server so I'm not expecting to have to compile. Thanks Sellers ______________________________________________ Chris G. Sellers | NITLE Technology 734.661.2318 | chris.sellers(a)nitle.org AIM: imthewherd | GTalk: cgseller(a)gmail.com

2 2

[Fedora-directory-users] Questions about setting up replication by modifying ldap directly.
by Ryan Braun 12 Dec '07

12 Dec '07

I'm working on a perl script that will allow you to setup replication agreements from the commandline using Net::LDAP. I've pretty much taken most of the ideas out of the existing mmr.pl and added some more functionality ( and made the code look alot worse lol :) I have a couple questions about a few attributes involved in the various object classes used in replication, and a couple logic questions to boot. First off, I've been using the sun docs from 6.1 here http://docs.sun.com/app/docs/doc/820-0384 for some of the attribute and object class info. I hope it still applies :P 1. When using the console, and you right click the replication agreement, you have the option to "Send Updates Now". Which attribute does that set? I'm assuming its not nsds5BeginReplicaRefresh, but that looks like the closest item from either nsDS5Replica or nsDS5ReplicationAgreement object classes. Now for some logic questions. When creating a Supplier -> dedicated consumer replication. Here's a rough outline of what I'm doing 1. Supplier -> create replication user 2. Consumer -> create replication user 3. Supplier -> add changelog object ("cn=changelog5,cn=config") 4. Consumer -> add changelog object ("cn=changelog5,cn=config") 5. Supplier -> add replica object ("cn=replica,cn=\"$config{BASE_DN}\",cn=mapping tree,cn=config") 6. Consumer -> add replica object ("cn=replica,cn=\"$config{BASE_DN}\",cn=mapping tree,cn=config") (consumer and supplier rep objects do have their own specific settings in these objects) 7. Supplier -> create rep agreement object ("cn=\"Replication to $to\",cn=replica,cn=\"$base\",cn=mapping tree,cn=config") 8. Consumer -> update referral information in dn: cn=$config{BASE_DN},cn=mapping tree,cn=config (nsslapd-referral attribute) and dn: cn=replica,cn="$config{BASE_DN}",cn=mapping tree,cn=config (nsDS5ReplicaReferral attribute) 9. Consumer -> modify dn: cn=$config{BASE_DN},cn=mapping tree,cn=config attribute nsslapd-state to "referral on update" I *think* thats it. From what I can when dumping cn=config the 3 objects on the consumer end up something like this. Also there's an empty value for nsslapd-referralmode: is that normal? # dc\3Dxxx\2Cdc\3Dec\2Cdc\3Dgc\2Cdc\3Dca, mapping tree, config dn: cn="dc=xxx,dc=ec,dc=gc,dc=ca",cn=mapping tree,cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree cn: "dc=xxx,dc=ec,dc=gc,dc=ca" nsslapd-state: referral on update nsslapd-backend: userRoot nsslapd-referral: ldap://SRVR1:389/dc=xxx,dc=ec,dc=gc,dc=ca nsslapd-referral: ldap://SRVR2:389/dc=xxx,dc=ec,dc=gc,dc=ca # replica, dc\3Dxxx\2Cdc\3Dec\2Cdc\3Dgc\2Cdc\3Dca, mapping tree, config dn: cn=replica,cn="dc=xxx,dc=ec,dc=gc,dc=ca",cn=mapping tree,cn=config objectClass: nsDS5Replica objectClass: top nsDS5ReplicaRoot: dc=xxx,dc=ec,dc=gc,dc=ca nsDS5ReplicaType: 2 nsDS5Flags: 0 nsds5ReplicaPurgeDelay: 604800 nsDS5ReplicaBindDN: uid=RManager,cn=config cn: replica nsDS5ReplicaId: 65535 nsState:: //8AABRQWEcAAAAAAgAAAAEAAAA= nsDS5ReplicaName: 60c64002-1dd211b2-8039bd5e-680e0000 nsDS5ReplicaReferral: ldap://SRVR1:389/dc=xxx,dc=ec,dc=gc,dc=ca nsDS5ReplicaReferral: ldap://SRVR2:389/dc=xxx,dc=ec,dc=gc,dc=ca nsds5ReplicaChangeCount: 2 nsds5replicareapactive: 0 # changelog5, config dn: cn=changelog5,cn=config objectClass: top objectClass: extensibleObject cn: changelog5 nsslapd-changelogdir: /opt/fedora-ds/slapd-srvr3/changelogdb Now for setting up an MMR agreement between 2 suppliers 1. Source -> create rep user 2. Target -> create rep user 3. Source -> create changelog object 4. Target -> create changelog object 5. Source -> create replica object 6. Target -> create replica object 7. Source -> create rep agreement 8. Target -> create rep agreement 9. Source -> set nsDS5BeginReplicaRefresh in the rep agreement on the source to init the target. 10. Source -> update dn: cn="$config{BASE_DN}",cn=mapping tree,cn=config attribute nsslapd-referral with the ldap://target:PORT/$config{BASE_DN} 11. Target -> update dn: cn="$config{BASE_DN}",cn=mapping tree,cn=config attribute nsslapd-referral with the ldap://source:PORT/$config{BASE_DN} How does that look? Should the multi-valued attribute nsslapd-referral contain entries for each server for which it has a MMR agreement with? One other question, it seems that sometimes the value has the escape codes for the comma while sometimes it has the actual comma. ryan@infinity:~/fds-tools$ grep -i Referral * xxxoff-config:nsslapd-referral: ldap://xxxoff0.xxx.ec.gc.ca:389/dc%3Dxxx%2Cdc%3Dec%2Cdc%3Dgc xxxsrvr4-config:nsslapd-referral: ldap://srvr1:389/dc=xxx,dc=ec,dc=gc,dc=ca I assume either way will work and not break anything? (which seems to be the case as it's running :) Ryan Braun Informatics Operations Aviation and Defence Services Division Chief Information Officer Branch, Environment Canada CIV: (204) 833-2500x2824 CSN: 257-2824 FAX: (204) 833-2524 E-Mail: Ryan.Braun(a)ec.gc.ca

3 10

[Fedora-directory-users] ACIs Don't Work?
by Glenn 12 Dec '07

12 Dec '07

I'm trying to establish an ACI for directory administrators in Fedora Directory 1.0.3. In the directory console, I right-click the OU and select "Set Access Permissions". I visit each tab in the visual editor and enter the correct users, rights, targets, hosts and times. After saving, the OU shows one ACI. Then I log in to the web-based Directory Server Gateway as one of the users specified in the ACI, but I am unable to edit another user's directory attributes. The error message is: "An error occurred while contacting the LDAP server. (Insufficient access - Insufficient 'write' privilege to the 'roomNumber' attribute of entry 'uid=tsmith,ou=main,ou=people,dc=txwes,dc=edu'. ) You do not have sufficient privileges to perform the operation." I checked all the inherited ACIs on the OU, and no rights are denied. What else should I look at? Thanks. -Glenn.

2 3

[Fedora-directory-users] (no subject)
by audunroe＠tihlde.org 12 Dec '07

12 Dec '07

Hi, I've been trying to install Fedora DS 1.0.4-1. Tried using both fedora-ds-1.0.4-1.RHEL3.i386.opt.rpm and fedora-ds-1.0.4-1.RHEL4.i386.opt.rpm. Installation seems to be successful. After completing /opt/fedora-ds/setup/setup, I get this output: [slapd-testldap]: starting up server ... [slapd-testldap]: Fedora-Directory/1.0.4 B2006.312.435 [slapd-testldap]: testldap.test.somehost.com:3389 (/opt/fedora-ds/slapd-testldap) [slapd-testldap]: [slapd-testldap]: [11/Dec/2007:14:35:42 +0100] - Fedora-Directory/1.0.4 B2006.312.435 starting up [slapd-testldap]: [11/Dec/2007:14:35:43 +0100] - slapd started. Listening on All Interfaces port 3389 for LDAP requests Your new directory server has been started. Created new Directory Server Start Slapd Starting Slapd server configuration. Success Slapd Added Directory Server information to Configuration Server. Configuring Administration Server... Setting up Administration Server Instance... Configuring Administration Tasks in Directory Server... Configuring Global Parameters in Directory Server... Can't start Admin server [/opt/fedora-ds/start-admin > /tmp/fileihS5jQ 2>&1] (error: No such file or directory) You can now use the console. Here is the command to use to start the console: cd /opt/fedora-ds ./startconsole -u admin -a http://testldap.test.somehost.com:2002/ INFO Finished with setup, logfile is setup/setup.log I can now connect to the ldap-server with an ldap-browser, but as you can see, the admin server doesn't launch properly. If I then try to re-run the start-admin script, I get the following errs: ERROR: ld.so: object '/opt/fedora-ds/bin/admin/lib/libssl3.so' from LD_PRELOAD cannot be preloaded: ignored. ERROR: ld.so: object '/opt/fedora-ds/bin/admin/lib/libldap60.so' from LD_PRELOAD cannot be preloaded: ignored. httpd.worker: Syntax error on line 151 of /opt/fedora-ds/admin-serv/config/httpd.conf: Cannot load /opt/fedora-ds/bin/admin/lib/libmodrestartd.so into server: /opt/fedora-ds/bin/admin/lib/libmodrestartd.so: wrong ELF class: ELFCLASS32 Any suggestions? -- Regards, Audun

2 3

[Fedora-directory-users] Newb question about Solaris X86
by Chris G. Sellers 12 Dec '07

12 Dec '07

I've searched some of the lists and was unable to find much of anything on this topic. I have a Solaris X86 (openSolaris) environment that I would like to use FDS on. I've tried to compile the environment (using GCC as well as SunC) and got all the way to the 'adminutil' section where it can not find prio.h Has anyone been able to get FDS going on Solaris x86 and if so what was the recipe for success. mkdir -p /var/tmp/dsbuild-fds104/ds/adminutil/work/fedora- adminutil-1.0.4/built/SunOS5.11_i86pc_OPT.OBJ/lib/libadminutil cc -DSOLARIS -c -DSVR4 -D__svr4 -D__svr4__ -D_SVID_GETTOD - DOSVERSION=5011 -DNO_NODELOCK -DXP_UNIX -DSOLARISx86 -xO2 -DNET_SSL - DSPAPI20 -DBUILD_NUM=\"2007.345.1339\" -DNET_SSL -DSPAPI20 -DBUILD_NUM= \"2007.345.1339\" -I/var/tmp/dsbuild-fds104/ds/adminutil/work/fedora- adminutil-1.0.4/include -I/var/tmp/dsbuild-fds104/ds/mozilla/work/ mozilla/dist/OPT.OBJ/include -I/var/tmp/dsbuild-fds104/ds/mozilla/work/ mozilla/dist/public/nss -I/var/tmp/dsbuild-fds104/ds/mozilla/work/ mozilla/dist/public/ldap -I/var/tmp/dsbuild-fds104/ds/icu/work/icu-3.4/ built/include psetc.c -o /var/tmp/dsbuild-fds104/ds/adminutil/work/ fedora-adminutil-1.0.4/built/SunOS5.11_i86pc_OPT.OBJ/lib/libadminutil/ psetc.o "psetc.c", line 30: cannot find include file: <prio.h> Thank you (and congratulations) to anyone who can assist. --- Chris G. Sellers Lead Internet Engineer National Institute for Technology & Liberal Ed. 535 West William Street, Ann Arbor, MI 48103 chris.sellers(a)nitle.org 734.661.2318

3 8

[Fedora-directory-users] Question about ACI
by Chun Tat David Chu 11 Dec '07

11 Dec '07

Hi guys, I am trying to create an organizational unit and an user with ACI, but it looks like my ACI is not defined correctly. Below is my ldif. dn: ou=serviceaccounts,dc=test,dc=example,dc=com changetype: add objectclass: top objectclass: organizationalunit aci: (targetattr = "*") (version 3.0; acl "default aci for service accounts"; allow (all) (userdn="ldap:///anyone") ;) dn: cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com changetype: add objectclass: top objectclass: person sn: tscei.obs userPassword: testing123 description: This is a test aci: (targetattr = "*") (version 3.0; acl "user1"; deny (all) (userdn="ldap:///self") ;) I create an organizational unit that allows all users to modify it, then I create user1 that denies everything. I then use the below LDIF to perform a LDAP add operation. dn: cn=testing123,cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com changetype: add objectclass: top objectclass: room I use this ldapmodify command to perform the add operation ldapmodify -h hostname -p 1389 -D "cn=user1,ou=serviceaccounts,dc=test,dc=example,dc=com" -w testing123 -f my_test.ldif -x The add operation succeeded unexpectedly. The result that I'm looking for should be not enough privilege to perform add operation. Anyone knows what's wrong with my ACI setup? Thanks! David

2 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users December 2007