[Fedora-directory-users] Setting up Mutual Authenticated SSL between FDS and RHEL4
by Eric Brown
I have set up SSL communication in FDS, and am able to connect with
Annoymous SSL. I need to set up Authenticated SSL communication from
RHEL4 components (nscd, nss_ldap, etc.) to FDS.
I was just wondering if anyone has tried to do this, if it is even
possible and if anyone had any documentation or links to where I can
find help in doing this.
Thanks,
Eric
16 years, 11 months
[Fedora-directory-users] Renew server certificate
by Renato Ribeiro da Silva
I'm trying to renew a server certificate using Fedora-DS Admin Console but this function seems no working. When I click on renew button is opened the "Request Certificate Window". Can I renew the certificate using command line?
Thanks in advance,
Renato
16 years, 11 months
[Fedora-directory-users] SASL bindings via PLAIN mechanism to FDS
by Jonathan Barber
Hi, I'm trying to get FDS (1.0.4 on Centos 4.4 with Cyrus SASL) to accept
authenticated bindings from clients using the SASL PLAIN mechanism over
SSL/TLS.
This is the first time that I've played with SASL, so I'd appreciate any
pointers to decent documentation if I'm doing something stupid.
My overall aim is too allow SASL PLAIN bindings via the openldap ldapsearch
client.
I've added the following SASL mapping and user entry to my FDS directory:
# SASL mapping
dn: cn=test,cn=mapping,cn=sasl,cn=config
objectClass: top
objectClass: nsSaslMapping
cn: test
nsSaslMapRegexString: \(.*\)
nsSaslMapBaseDNTemplate: ou=people,ou=lifesci,o=dundee
nsSaslMapFilterTemplate: (uid=\1)
# User
dn: uid=jon,ou=people,ou=lifesci,o=dundee
givenName: j
sn: b
uidNumber: 1000
gidNumber: 1000
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: posixAccount
uid: jon
cn: j b
homeDirectory: /tmp/
userpassword: {SSHA}hashedpassword
And restarted the server. I set the nsslapd-errorlog-level to 1 to observe the
bind process in detail, and get the trace in [1] when I try to bind to the LDAP
server with the command:
# ldapsearch -H ldaps://test -Y PLAIN
SASL/PLAIN authentication started
Please enter your password:
ldap_sasl_interactive_bind_s: Invalid credentials (49)
additional info: SASL(-14): authorization failure: Password verification failed
This appears to fail because for some reason SASL tries to look the user up
again thinking that the DN is the the UID, fails, and rejects the bind as the
DN is unknown.
When I add a second mapping (and restart ns-slapd) to try and correct the
second failed search:
dn: cn=test2,cn=mapping,cn=sasl,cn=config
objectClass: top
objectClass: nsSaslMapping
cn: test2
nsSaslMapRegexString: uid=\([^,]*\),
nsSaslMapBaseDNTemplate: ou=people,ou=lifesci,o=dundee
nsSaslMapFilterTemplate: (uid=\1)
I get the trace in [2], and the client returns:
additional info: SASL(-13): authentication failure: Password verification failed
This just looks like SASL failed to authenticate the passwords this time.
So, have I got the wrong end of the stick - and I am trying to do something that
SASL won't let me - or have I just got an error somewhere in my configuration?
I've read both the wiki page:
http://directory.fedora.redhat.com/wiki/Howto:Kerberos
and Chapter 11 of the Admin guide, and neither are particulary useful, looking
at the FDS source isn't shedding much light.
Cheers.
[1] error log output with SASL mapping test
[24/Apr/2007:18:31:38 +0100] - BIND dn="" method=163 version=3
[24/Apr/2007:18:31:38 +0100] - => get_ldapmessage_controls
[24/Apr/2007:18:31:38 +0100] - <= get_ldapmessage_controls no controls
[24/Apr/2007:18:31:38 +0100] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.16)
[24/Apr/2007:18:31:38 +0100] - <= slapi_control_present 0 (NO CONTROLS)
[24/Apr/2007:18:31:38 +0100] - do_bind: version 3 method 0xa3 dn
[24/Apr/2007:18:31:38 +0100] - => ids_sasl_check_bind
[24/Apr/2007:18:31:38 +0100] - => ids_sasl_mech_supported
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - <= ids_sasl_mech_supported
[24/Apr/2007:18:31:38 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:31:38 +0100] - ids_sasl_canon_user(user=jon, realm=)
[24/Apr/2007:18:31:38 +0100] - -> sasl_map_domap
[24/Apr/2007:18:31:38 +0100] - -> sasl_map_check
[24/Apr/2007:18:31:38 +0100] - regex: \(.*\), id: jon, matched
[24/Apr/2007:18:31:38 +0100] - mapped base dn: [BINARY JUNK], filter: [BINARY JUNK]
[24/Apr/2007:18:31:38 +0100] - <- sasl_map_check
[24/Apr/2007:18:31:38 +0100] - <- sasl_map_domap (mapped)
[24/Apr/2007:18:31:38 +0100] - sasl user search basedn="ou=people,ou=lifesci,o=dundee" filter="(uid=jon)"
[24/Apr/2007:18:31:38 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=2
[24/Apr/2007:18:31:38 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:31:38 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=1
[24/Apr/2007:18:31:38 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:31:39 +0100] - => compute_limits: sizelimit=-1, timelimit=-1
[24/Apr/2007:18:31:39 +0100] - Calling plugin 'ACL preoperation' #1 type 403
[24/Apr/2007:18:31:39 +0100] - Calling plugin 'Legacy replication preoperation plugin' #3 type 403
[24/Apr/2007:18:31:39 +0100] - Calling plugin 'Multimaster replication preoperation plugin' #4 type 403
[24/Apr/2007:18:31:39 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=0
[24/Apr/2007:18:31:39 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:31:39 +0100] - => find_entry_internal (dn=ou=people,ou=lifesci,o=dundee) lock 0
[24/Apr/2007:18:31:39 +0100] - => dn2entry "ou=people,ou=lifesci,o=dundee"
[24/Apr/2007:18:31:39 +0100] - <= dn2entry 96034e0
[24/Apr/2007:18:31:39 +0100] - <= find_entry_internal_dn found (ou=people,ou=lifesci,o=dundee)
[24/Apr/2007:18:31:39 +0100] - => filter_candidates
[24/Apr/2007:18:31:39 +0100] - => list_candidates 0xa1
[24/Apr/2007:18:31:39 +0100] - => filter_candidates
[24/Apr/2007:18:31:39 +0100] - => ava_candidates
[24/Apr/2007:18:31:39 +0100] - uid=jon
[24/Apr/2007:18:31:39 +0100] - => keys2idl type uid indextype eq
[24/Apr/2007:18:31:39 +0100] - => index_read( "uid" = "jon" )
[24/Apr/2007:18:31:39 +0100] - bulk fetch buffer nids=1
[24/Apr/2007:18:31:39 +0100] - idl_new_fetch =jon returns nids=1
[24/Apr/2007:18:31:39 +0100] - <= index_read 1 candidates
[24/Apr/2007:18:31:39 +0100] - ival[0] = "jon" => 1 IDs
[24/Apr/2007:18:31:39 +0100] - <= filter_candidates 1
[24/Apr/2007:18:31:39 +0100] - => filter_candidates
[24/Apr/2007:18:31:39 +0100] - => ava_candidates
[24/Apr/2007:18:31:39 +0100] - objectclass=referral
[24/Apr/2007:18:31:39 +0100] - => keys2idl type objectclass indextype eq
[24/Apr/2007:18:31:39 +0100] - => index_read( "objectclass" = "referral" )
[24/Apr/2007:18:31:39 +0100] - <= index_read 0 candidates
[24/Apr/2007:18:31:39 +0100] - ival[0] = "referral" => 0 IDs
[24/Apr/2007:18:31:39 +0100] - <= filter_candidates 0
[24/Apr/2007:18:31:39 +0100] - <= list_candidates 1
[24/Apr/2007:18:31:39 +0100] - <= filter_candidates 1
[24/Apr/2007:18:31:39 +0100] - candidate list has 1 ids
[24/Apr/2007:18:31:39 +0100] - => id2entry( 5 )
[24/Apr/2007:18:31:39 +0100] - => str2entry_fast
[24/Apr/2007:18:31:39 +0100] - <= str2entry_fast 0x95b2578
[24/Apr/2007:18:31:39 +0100] - -> attrcrypt_decrypt_entry
[24/Apr/2007:18:31:39 +0100] - <- attrcrypt_decrypt_entry
[24/Apr/2007:18:31:39 +0100] - <= id2entry( 5 ) 9638cc8 (disk)
[24/Apr/2007:18:31:39 +0100] - => send_ldap_search_entry (uid=jon,ou=people,ou=lifesci,o=dundee)
[24/Apr/2007:18:31:39 +0100] - <= send_ldap_search_entry
[24/Apr/2007:18:31:39 +0100] - => send_ldap_result 0::
[24/Apr/2007:18:31:39 +0100] - <= send_ldap_result
[24/Apr/2007:18:31:39 +0100] - sasl user search found dn=uid=jon,ou=people,ou=lifesci,o=dundee
[24/Apr/2007:18:31:39 +0100] - sasl user search found this entry: dn:uid=jon,ou=people,ou=lifesci,o=dundee, matching filter=
[24/Apr/2007:18:31:39 +0100] - ids_sasl_getopt: plugin= option=canon_user_plugin
[24/Apr/2007:18:31:39 +0100] - ids_sasl_getopt: plugin= option=auxprop_plugin
[24/Apr/2007:18:31:39 +0100] - ids_sasl_getopt: plugin= option=pwcheck_method
[24/Apr/2007:18:31:39 +0100] - ids_sasl_canon_user(user=uid=jon,ou=people,ou=lifesci,o=dundee, realm=)
[24/Apr/2007:18:31:40 +0100] - -> sasl_map_domap
[24/Apr/2007:18:31:40 +0100] - -> sasl_map_check
[24/Apr/2007:18:31:40 +0100] - regex: \(.*\), id: uid=jon,ou=people,ou=lifesci,o=dundee, matched
[24/Apr/2007:18:31:40 +0100] - mapped base dn: [BINARY JUNK], filter: [BINARY JUNK]
[24/Apr/2007:18:31:40 +0100] - <- sasl_map_check
[24/Apr/2007:18:31:40 +0100] - <- sasl_map_domap (mapped)
[24/Apr/2007:18:31:40 +0100] - sasl user search basedn="ou=people,ou=lifesci,o=dundee" filter="(uid=uid=jon,ou=people,ou=lifesci,o=dundee)"
[24/Apr/2007:18:31:40 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=2
[24/Apr/2007:18:31:40 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:31:40 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=1
[24/Apr/2007:18:31:40 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:31:40 +0100] - => compute_limits: sizelimit=-1, timelimit=-1
[24/Apr/2007:18:31:40 +0100] - Calling plugin 'ACL preoperation' #1 type 403
[24/Apr/2007:18:31:40 +0100] - Calling plugin 'Legacy replication preoperation plugin' #3 type 403
[24/Apr/2007:18:31:40 +0100] - Calling plugin 'Multimaster replication preoperation plugin' #4 type 403
[24/Apr/2007:18:31:40 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=0
[24/Apr/2007:18:31:40 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:31:40 +0100] - => find_entry_internal (dn=ou=people,ou=lifesci,o=dundee) lock 0
[24/Apr/2007:18:31:40 +0100] - => dn2entry "ou=people,ou=lifesci,o=dundee"
[24/Apr/2007:18:31:40 +0100] - <= dn2entry 96034e0
[24/Apr/2007:18:31:40 +0100] - <= find_entry_internal_dn found (ou=people,ou=lifesci,o=dundee)
[24/Apr/2007:18:31:40 +0100] - => filter_candidates
[24/Apr/2007:18:31:40 +0100] - => list_candidates 0xa1
[24/Apr/2007:18:31:40 +0100] - => filter_candidates
[24/Apr/2007:18:31:40 +0100] - => ava_candidates
[24/Apr/2007:18:31:40 +0100] - uid=uid=jon,ou=people,ou=lifesci,o=dundee
[24/Apr/2007:18:31:40 +0100] - => keys2idl type uid indextype eq
[24/Apr/2007:18:31:40 +0100] - => index_read( "uid" = "uid=jon,ou=people,ou=lifesci,o=dundee" )
[24/Apr/2007:18:31:40 +0100] - <= index_read 0 candidates
[24/Apr/2007:18:31:40 +0100] - ival[0] = "uid=jon,ou=people,ou=lifesci,o=dundee" => 0 IDs
[24/Apr/2007:18:31:40 +0100] - <= filter_candidates 0
[24/Apr/2007:18:31:40 +0100] - => filter_candidates
[24/Apr/2007:18:31:40 +0100] - => ava_candidates
[24/Apr/2007:18:31:40 +0100] - objectclass=referral
[24/Apr/2007:18:31:40 +0100] - => keys2idl type objectclass indextype eq
[24/Apr/2007:18:31:40 +0100] - => index_read( "objectclass" = "referral" )
[24/Apr/2007:18:31:40 +0100] - <= index_read 0 candidates
[24/Apr/2007:18:31:40 +0100] - ival[0] = "referral" => 0 IDs
[24/Apr/2007:18:31:40 +0100] - <= filter_candidates 0
[24/Apr/2007:18:31:40 +0100] - <= list_candidates 0
[24/Apr/2007:18:31:40 +0100] - <= filter_candidates 0
[24/Apr/2007:18:31:40 +0100] - candidate list has 0 ids
[24/Apr/2007:18:31:40 +0100] - => send_ldap_result 0::
[24/Apr/2007:18:31:40 +0100] - <= send_ldap_result
[24/Apr/2007:18:31:40 +0100] - sasl user search found no entries matching filter=:#w
[24/Apr/2007:18:31:41 +0100] - sasl(2): Password verification failed
[24/Apr/2007:18:31:41 +0100] - => send_ldap_result 49::SASL(-14): authorization failure: Password verification failed
[24/Apr/2007:18:31:41 +0100] - <= send_ldap_result
[2] error log output with SASL mapping test and test2
[24/Apr/2007:18:42:40 +0100] - => ids_sasl_server_new (lsd_test.lifesci.dundee.ac.uk)
[24/Apr/2007:18:42:40 +0100] - ids_sasl_getopt: plugin= option=log_level
[24/Apr/2007:18:42:40 +0100] - ids_sasl_getopt: plugin= option=auto_transition
[24/Apr/2007:18:42:40 +0100] - <= ids_sasl_server_new
[24/Apr/2007:18:42:40 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b598a8, handle=3
[24/Apr/2007:18:42:40 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:40 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b59808, handle=3
[24/Apr/2007:18:42:40 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:40 +0100] - add_pb
[24/Apr/2007:18:42:40 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b59808, handle=3
[24/Apr/2007:18:42:40 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:40 +0100] - get_pb
[24/Apr/2007:18:42:42 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b598a8, handle=3
[24/Apr/2007:18:42:42 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:42 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b59808, handle=3
[24/Apr/2007:18:42:42 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:42 +0100] - add_pb
[24/Apr/2007:18:42:42 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b59808, handle=3
[24/Apr/2007:18:42:42 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:42 +0100] - get_pb
[24/Apr/2007:18:42:42 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b598a8, handle=3
[24/Apr/2007:18:42:42 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:42 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b59808, handle=3
[24/Apr/2007:18:42:42 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:42 +0100] - do_bind
[24/Apr/2007:18:42:42 +0100] - BIND dn="" method=163 version=3
[24/Apr/2007:18:42:42 +0100] - => get_ldapmessage_controls
[24/Apr/2007:18:42:42 +0100] - <= get_ldapmessage_controls no controls
[24/Apr/2007:18:42:42 +0100] - => slapi_control_present (looking for 2.16.840.1.113730.3.4.16)
[24/Apr/2007:18:42:42 +0100] - <= slapi_control_present 0 (NO CONTROLS)
[24/Apr/2007:18:42:42 +0100] - do_bind: version 3 method 0xa3 dn
[24/Apr/2007:18:42:42 +0100] - => ids_sasl_check_bind
[24/Apr/2007:18:42:42 +0100] - => ids_sasl_mech_supported
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - <= ids_sasl_mech_supported
[24/Apr/2007:18:42:43 +0100] - ids_sasl_getopt: plugin= option=mech_list
[24/Apr/2007:18:42:43 +0100] - ids_sasl_canon_user(user=jon, realm=)
[24/Apr/2007:18:42:43 +0100] - -> sasl_map_domap
[24/Apr/2007:18:42:43 +0100] - -> sasl_map_check
[24/Apr/2007:18:42:43 +0100] - regex: uid=\([^,]*\),, id: jon, didn't match
[24/Apr/2007:18:42:43 +0100] - <- sasl_map_check
[24/Apr/2007:18:42:43 +0100] - -> sasl_map_check
[24/Apr/2007:18:42:43 +0100] - regex: \(.*\), id: jon, matched
[24/Apr/2007:18:42:43 +0100] - mapped base dn: [BINARY JUNK], filter: [BINARY JUNK]
[24/Apr/2007:18:42:43 +0100] - <- sasl_map_check
[24/Apr/2007:18:42:43 +0100] - <- sasl_map_domap (mapped)
[24/Apr/2007:18:42:43 +0100] - sasl user search basedn="ou=people,ou=lifesci,o=dundee" filter="(uid=jon)"
[24/Apr/2007:18:42:43 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=2
[24/Apr/2007:18:42:43 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:43 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=1
[24/Apr/2007:18:42:43 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:43 +0100] - => compute_limits: sizelimit=-1, timelimit=-1
[24/Apr/2007:18:42:43 +0100] - Calling plugin 'ACL preoperation' #1 type 403
[24/Apr/2007:18:42:43 +0100] - Calling plugin 'Legacy replication preoperation plugin' #3 type 403
[24/Apr/2007:18:42:43 +0100] - Calling plugin 'Multimaster replication preoperation plugin' #4 type 403
[24/Apr/2007:18:42:43 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=0
[24/Apr/2007:18:42:43 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:43 +0100] - => find_entry_internal (dn=ou=people,ou=lifesci,o=dundee) lock 0
[24/Apr/2007:18:42:43 +0100] - => dn2entry "ou=people,ou=lifesci,o=dundee"
[24/Apr/2007:18:42:43 +0100] - <= dn2entry 8851fa0
[24/Apr/2007:18:42:43 +0100] - <= find_entry_internal_dn found (ou=people,ou=lifesci,o=dundee)
[24/Apr/2007:18:42:43 +0100] - => filter_candidates
[24/Apr/2007:18:42:43 +0100] - => list_candidates 0xa1
[24/Apr/2007:18:42:43 +0100] - => filter_candidates
[24/Apr/2007:18:42:43 +0100] - => ava_candidates
[24/Apr/2007:18:42:43 +0100] - uid=jon
[24/Apr/2007:18:42:43 +0100] - => keys2idl type uid indextype eq
[24/Apr/2007:18:42:43 +0100] - => index_read( "uid" = "jon" )
[24/Apr/2007:18:42:43 +0100] - bulk fetch buffer nids=1
[24/Apr/2007:18:42:43 +0100] - idl_new_fetch =jon returns nids=1
[24/Apr/2007:18:42:44 +0100] - <= index_read 1 candidates
[24/Apr/2007:18:42:44 +0100] - ival[0] = "jon" => 1 IDs
[24/Apr/2007:18:42:44 +0100] - <= filter_candidates 1
[24/Apr/2007:18:42:44 +0100] - => filter_candidates
[24/Apr/2007:18:42:44 +0100] - => ava_candidates
[24/Apr/2007:18:42:44 +0100] - objectclass=referral
[24/Apr/2007:18:42:44 +0100] - => keys2idl type objectclass indextype eq
[24/Apr/2007:18:42:44 +0100] - => index_read( "objectclass" = "referral" )
[24/Apr/2007:18:42:44 +0100] - <= index_read 0 candidates
[24/Apr/2007:18:42:44 +0100] - ival[0] = "referral" => 0 IDs
[24/Apr/2007:18:42:44 +0100] - <= filter_candidates 0
[24/Apr/2007:18:42:44 +0100] - <= list_candidates 1
[24/Apr/2007:18:42:44 +0100] - <= filter_candidates 1
[24/Apr/2007:18:42:44 +0100] - candidate list has 1 ids
[24/Apr/2007:18:42:44 +0100] - => id2entry( 5 )
[24/Apr/2007:18:42:44 +0100] - <= id2entry 8ab8d90 (cache)
[24/Apr/2007:18:42:44 +0100] - => send_ldap_search_entry (uid=jon,ou=people,ou=lifesci,o=dundee)
[24/Apr/2007:18:42:44 +0100] - <= send_ldap_search_entry
[24/Apr/2007:18:42:44 +0100] - => send_ldap_result 0::
[24/Apr/2007:18:42:44 +0100] - <= send_ldap_result
[24/Apr/2007:18:42:44 +0100] - sasl user search found dn=uid=jon,ou=people,ou=lifesci,o=dundee
[24/Apr/2007:18:42:44 +0100] - sasl user search found this entry: dn:uid=jon,ou=people,ou=lifesci,o=dundee, matching filter=p
[24/Apr/2007:18:42:44 +0100] - ids_sasl_getopt: plugin= option=canon_user_plugin
[24/Apr/2007:18:42:44 +0100] - ids_sasl_getopt: plugin= option=auxprop_plugin
[24/Apr/2007:18:42:44 +0100] - ids_sasl_getopt: plugin= option=pwcheck_method
[24/Apr/2007:18:42:44 +0100] - ids_sasl_canon_user(user=uid=jon,ou=people,ou=lifesci,o=dundee, realm=)
[24/Apr/2007:18:42:44 +0100] - -> sasl_map_domap
[24/Apr/2007:18:42:44 +0100] - -> sasl_map_check
[24/Apr/2007:18:42:44 +0100] - regex: uid=\([^,]*\),, id: uid=jon,ou=people,ou=lifesci,o=dundee, matched
[24/Apr/2007:18:42:44 +0100] - mapped base dn: [BINARY JUNK] filter: [BINARY JUNK]
[24/Apr/2007:18:42:44 +0100] - <- sasl_map_check
[24/Apr/2007:18:42:44 +0100] - <- sasl_map_domap (mapped)
[24/Apr/2007:18:42:44 +0100] - sasl user search basedn="ou=people,ou=lifesci,o=dundee" filter="(uid=jon)"
[24/Apr/2007:18:42:44 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=2
[24/Apr/2007:18:42:44 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:44 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=1
[24/Apr/2007:18:42:44 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:44 +0100] - => compute_limits: sizelimit=-1, timelimit=-1
[24/Apr/2007:18:42:44 +0100] - Calling plugin 'ACL preoperation' #1 type 403
[24/Apr/2007:18:42:44 +0100] - Calling plugin 'Legacy replication preoperation plugin' #3 type 403
[24/Apr/2007:18:42:44 +0100] - Calling plugin 'Multimaster replication preoperation plugin' #4 type 403
[24/Apr/2007:18:42:44 +0100] - => slapi_reslimit_get_integer_limit() conn=0x0, handle=0
[24/Apr/2007:18:42:45 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:45 +0100] - => find_entry_internal (dn=ou=people,ou=lifesci,o=dundee) lock 0
[24/Apr/2007:18:42:45 +0100] - => dn2entry "ou=people,ou=lifesci,o=dundee"
[24/Apr/2007:18:42:45 +0100] - <= dn2entry 8851fa0
[24/Apr/2007:18:42:45 +0100] - <= find_entry_internal_dn found (ou=people,ou=lifesci,o=dundee)
[24/Apr/2007:18:42:45 +0100] - => filter_candidates
[24/Apr/2007:18:42:45 +0100] - => list_candidates 0xa1
[24/Apr/2007:18:42:45 +0100] - => filter_candidates
[24/Apr/2007:18:42:45 +0100] - => ava_candidates
[24/Apr/2007:18:42:45 +0100] - uid=jon
[24/Apr/2007:18:42:45 +0100] - => keys2idl type uid indextype eq
[24/Apr/2007:18:42:45 +0100] - => index_read( "uid" = "jon" )
[24/Apr/2007:18:42:45 +0100] - bulk fetch buffer nids=1
[24/Apr/2007:18:42:45 +0100] - idl_new_fetch =jon returns nids=1
[24/Apr/2007:18:42:45 +0100] - <= index_read 1 candidates
[24/Apr/2007:18:42:45 +0100] - ival[0] = "jon" => 1 IDs
[24/Apr/2007:18:42:45 +0100] - <= filter_candidates 1
[24/Apr/2007:18:42:45 +0100] - => filter_candidates
[24/Apr/2007:18:42:45 +0100] - => ava_candidates
[24/Apr/2007:18:42:45 +0100] - objectclass=referral
[24/Apr/2007:18:42:45 +0100] - => keys2idl type objectclass indextype eq
[24/Apr/2007:18:42:45 +0100] - => index_read( "objectclass" = "referral" )
[24/Apr/2007:18:42:45 +0100] - <= index_read 0 candidates
[24/Apr/2007:18:42:45 +0100] - ival[0] = "referral" => 0 IDs
[24/Apr/2007:18:42:45 +0100] - <= filter_candidates 0
[24/Apr/2007:18:42:45 +0100] - <= list_candidates 1
[24/Apr/2007:18:42:45 +0100] - <= filter_candidates 1
[24/Apr/2007:18:42:45 +0100] - candidate list has 1 ids
[24/Apr/2007:18:42:45 +0100] - => id2entry( 5 )
[24/Apr/2007:18:42:45 +0100] - <= id2entry 8ab8d90 (cache)
[24/Apr/2007:18:42:45 +0100] - => send_ldap_search_entry (uid=jon,ou=people,ou=lifesci,o=dundee)
[24/Apr/2007:18:42:45 +0100] - <= send_ldap_search_entry
[24/Apr/2007:18:42:45 +0100] - => send_ldap_result 0::
[24/Apr/2007:18:42:45 +0100] - <= send_ldap_result
[24/Apr/2007:18:42:45 +0100] - sasl user search found dn=uid=jon,ou=people,ou=lifesci,o=dundee
[24/Apr/2007:18:42:45 +0100] - sasl user search found this entry: dn:uid=jon,ou=people,ou=lifesci,o=dundee, matching filter=:.
[24/Apr/2007:18:42:45 +0100] - ids_sasl_getopt: plugin= option=canon_user_plugin
[24/Apr/2007:18:42:45 +0100] - ids_sasl_getopt: plugin= option=auxprop_plugin
[24/Apr/2007:18:42:45 +0100] - ids_sasl_getopt: plugin= option=auxprop_plugin
[24/Apr/2007:18:42:45 +0100] - sasl(2): Password verification failed
[24/Apr/2007:18:42:45 +0100] - => send_ldap_result 49::SASL(-13): authentication failure: Password verification failed
[24/Apr/2007:18:42:45 +0100] - <= send_ldap_result
[24/Apr/2007:18:42:45 +0100] - add_pb
[24/Apr/2007:18:42:45 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b59808, handle=3
[24/Apr/2007:18:42:45 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:45 +0100] - get_pb
[24/Apr/2007:18:42:45 +0100] - => slapi_reslimit_get_integer_limit() conn=0xb6b59808, handle=3
[24/Apr/2007:18:42:45 +0100] - <= slapi_reslimit_get_integer_limit() returning NO VALUE
[24/Apr/2007:18:42:46 +0100] - => ids_sasl_check_bind
--
Jonathan Barber
High Performance Computing Analyst
Tel. +44 (0) 1382 386389
16 years, 11 months
[Fedora-directory-users] AD and FDS sync problem
by Сафонов Алексей
Hello!
I have a problem at synchronization AD and FDS. I do not manage to synchronize completely domain AD mup-example.vrn.ru. The tree of the domain mup-example.vrn.ru is made as follows: in him exist OU (these are departments of the enterprise). In everyone OU there are users of a department and group into which these users enter. Certainly, besides this, in the domain there are system users, groups and OU.
At me users and groups which are directly in the container mup-example.vrn.ru (dc=mup-example, dc=vrn, dc=ru) are synchronized only. OU (for example, ou=GIS, dc=mup-example, dc=vrn, dc=ru) which are in the container mup-example.vrn.ru - are not synchronized. If manually to create OU GIS in this container the group (cn=GIS, ou=GIS, dc=mup-example, dc=vrn, dc=ru is created), but users are not sync.
Here a error in a log-file:
[23/Apr/2007:13:53:33 +0400] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=win2003" (srv-vm1:636)".
[23/Apr/2007:13:53:34 +0400] - Entry "uid=Guest,CN=Users,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] - Entry "uid=SUPPORT_388945a0,CN=Users,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] - Entry "uid=Alex_Saf,OU=GIS,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] - Entry "uid=Administrator,CN=Users,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] - Entry "uid=krbtgt,CN=Users,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] - Entry "uid=IUSR_SRV-VM1,CN=Users,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] - Entry "uid=IWAM_SRV-VM1,CN=Users,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] - Entry "uid=SRV-VM1$,OU=Domain Controllers,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] - Entry "uid=asd,OU=GIS,dc=mup-example,dc=vrn,dc=ru" missing attribute "sn" required by object class "person"
[23/Apr/2007:13:53:34 +0400] NSMMReplicationPlugin - Finished total update of replica "agmt="cn=win2003" (srv-vm1:636)". Sent 7 entries.
I Ask to help(assist) with the decision of a problem.
16 years, 11 months
[Fedora-directory-users] Fedora DS, Kerberos, Active Directory - HOWTO?
by Howard Wilkinson
I am new to Fedora DS and have installed 1.0.4 onto a Fedora Core 6 (+
enhancements) build. I have built the install using the dsbuild
operation and all seems to be working. I can authenticate to the system
using the 'admin' user and the "CN=Directory Manager" identity. I have
SSL working and now want to use our Kerberos environment to provide SSO
to the server.
Our Kerberos environment is based on an AD KDC and is supporting other
application successfully. We have created the 'ldap/...' service
principal and imported it into the system keytab.
First test with ldapsearch using GSSAPI fails with permission denied
from the GSSAPI function. So I thought I would try the mapping facility
as documented in the administration manual and set up to map the
Kerberos identity to the correct search DN for the AD. As we only have
the one Domain/Forest I set up a simple map that takes any name and maps
to this DN. I then set up a referral inside the DS to point to the AD
controllers in the hope that this would activate the necessary logic. No
joy.
Looking in the code for 'saslbind.c' it looks like the code only allows
for locally registered users. If I am reading this right does this mean
my next step is to remove the referral and add a replica for the AD into
my DS using the procedure outlined in the Administration Guide section
"Windows Sync". In doing this will I have then enabled GSSAPI/Kerberos
authentication or will I still be missing something? If I do this will I
be causing problems in the future with other parts of the AD as I want
to get referrals when the data is not held in the DS? (Given that I will
be syncing users (and groups?) only). I can use OU trees for this and
tie the referrals there of course but then I will need to sync the
entire CN=Users tree.
I understand that I will need to create a separate DIT (root) for the AD
data to ensure that I can sync to multiple domains in the future, is
this correct?
Any advice or even a description of the set of steps that will make this
dance work would be much appreciated.
--
Howard Wilkinson
Phone:
+44(20)76907075
Coherent Technology Limited
Fax:
23 Northampton Square,
Mobile:
+44(7980)639379
United Kingdom, EC1V 0HL
Email:
howard(a)cohtech.com
16 years, 11 months
[Fedora-directory-users] How can I check other user info in non-privileged mode?
by Yu Joe
Dear all
I've just set up fedora directory server for centrailizing my system
accounts . I could log in the system by any of my ldap accounts, but
suddently found I cannot get other user info by "id" or "getent passwd"
command when I was in the non-privileged user mode. Does anyone know why?
Because I can do this in root-user or nis enviornment. Somebody helps,
please. Thanks anyway.
Joe Yu
One of the RHCEs in Taiwan.
16 years, 11 months
[Fedora-directory-users] ldap and certificate
by Paolo Ercolani
I want my linux box logging in using ldap on ssl with self-signed
certificate. I read a lot of documents, but i can't get over a problem.
I created my own CA on my ldap server and i'm signing my certificates.
Then i requested a certificate for my client using fedora directory
browser, manage certificate's option. I signed it with my CA and then i
put it on my client. I installed my CA in DS using the gui.
My DS seems to recognize, now, my certificate. Infact, it doesn't tell
me anymore he doesn't recognize peer. It seems to go, on server side. I
increased log level on client and now i can see these messages:
TLS certificate verification: Error, self signed certificate in
certificate chain
TLS certificate verification: Error, invalid CA certificate
TLS certificate verification: Error, unsupported certificate purpose
TLS: unable to get peer certificate.
request done: ld 0x83f2ee0 msgid 1
I don't know what it is and i wanna tell you i used the howto on fedora
directory server's site for making and importing the self signed
certificate, but maybe i don't understand something....
Can anyone help me with this please??
Thanks in advance.
Paolo
16 years, 11 months
[Fedora-directory-users] How to achieve load balancing in multi-master set-up?
by Ankur Agarwal
Hi,
We have a 2 LDAP servers multi-master set-up. Procuring hardware load balancing is not an option hence would request to pass on any information you may have to achieve load-balancing through either :
1) Some config in LDAP to achieve load balancing
2) Software load balancer
3) Some logic in custom application that people use frequently when connecting to multi-master setup
regards,
Ankur
---------------------------------
Ahhh...imagining that irresistible "new car" smell?
Check outnew cars at Yahoo! Autos.
16 years, 11 months
[Fedora-directory-users] FDS on redhat 5
by Paulo Estrela - Suporte LabInfo UNIFACS
Hi,
What binary package should I install on RH5?
fedora-ds-1.0.4-1.FC6.i386.opt.rpm
fedora-ds-1.0.4-1.FC5.i386.opt.rpm
fedora-ds-1.0.4-1.FC4.i386.opt.rpm
fedora-ds-1.0.4-1.RHEL4.i386.opt.rpm
Thanks,
Paulo Estrela
16 years, 11 months