Re: [Fedora-directory-users] Administration domain
by Fernando Muñoz
Thanks Richard for the answer,
I registered the configuration directory with a remote server
(delegating administration), but furthermore, i would like to access to
directory administration locally (in a local server without Netscaperoot
after installation), and permit admin when the communications down with
a remote server. It's possible? I have to create a new Netscaperoot in a
local server?.
Other question, it's possible register the configuration directory in
two remote servers?.
Thanks,
El jue, 17-05-2007 a las 12:00 -0400,
fedora-directory-users-request(a)redhat.com escribió:
> Send Fedora-directory-users mailing list submissions to
> fedora-directory-users(a)redhat.com
>
> To subscribe or unsubscribe via the World Wide Web, visit
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> or, via email, send a message with subject or body 'help' to
> fedora-directory-users-request(a)redhat.com
>
> You can reach the person managing the list at
> fedora-directory-users-owner(a)redhat.com
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Fedora-directory-users digest..."
>
>
> Today's Topics:
>
> 1. Re: NSUniqueID (Richard Megginson)
> 2. Administration domain (Fernando Mu?oz)
> 3. Re: Administration domain (Richard Megginson)
> 4. Windows Sync with NT4? (Glenn)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Wed, 16 May 2007 09:58:16 -0600
> From: Richard Megginson <rmeggins(a)redhat.com>
> Subject: Re: [Fedora-directory-users] NSUniqueID
> To: "General discussion list for the Fedora Directory server project."
> <fedora-directory-users(a)redhat.com>
> Message-ID: <464B2A18.2030100(a)redhat.com>
> Content-Type: text/plain; charset="iso-8859-1"
>
> Bjorn Oglefjorn wrote:
> >
> >
> > On 5/16/07, *Richard Megginson* <rmeggins(a)redhat.com
> > <mailto:rmeggins@redhat.com>> wrote:
> >
> > Bjorn Oglefjorn wrote:
> > > <snip>
> > >
> > >
> > > This seems odd - were these attributes originally added with
> > other
> > > values, then changed? Was the original dn uid=auser, or was
> > this
> > > changed?
> > >
> > >
> > > If that is true, that is indeed odd. Looking back through my audit
> > > logs shows only the change to the mail attribute values. Is there
> > > another way I can check and see the change of the posix attributes?
> > You said "audit logs" - do you mean the DS audit log?
> > http://www.redhat.com/docs/manuals/dir-server/ag/7.1/dsstats.html#1092377
> > <http://www.redhat.com/docs/manuals/dir-server/ag/7.1/dsstats.html#1092377>
> > If not, you could enable the audit log to see exactly what
> > modifications
> > are occurring.
> >
> >
> > Yes, I do have audit logging enabled on both of my fedora-ds machines
> > but only as of the end of last month. I only see the modification of
> > the mail attributes in the audit log.
> Ok. The information might still be in the changelog. You can dump the
> contents of the changelog using the perl script
> bin/slapd/admin/scripts/template-cl-dump.pl - cd /opt/fedora-ds ; perl
> bin/slapd/admin/scripts/template-cl-dump.pl -H for usage.
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > <mailto:Fedora-directory-users@redhat.com>
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
> >
> >
> > ------------------------------------------------------------------------
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
>
16 years, 10 months
[Fedora-directory-users] Windows Sync with NT4?
by Glenn
So I have a successful Windows Sync agreement set up between Fedora DS and
Active Directory, but I'm having difficulty setting up a sync agreement with
an NT4 domain. I'm at the point where I've entered the NT server info in the
agreement form. When I click Next, I get an error message:
"Unable to contact Active Directory server. Continue?"
I think this means I've entered something wrong in the form, and I'm hoping
someone can narrow down the possible things that can be entered in the form.
For instance, Windows Domain Name. The example given in the documentation
is "example.com". However, NT domains do not conform to DNS standards. Will
it work if I enter the NT domain name, e.g., "example"? If not, is there a
workaround?
The next item is Windows Subtree. This field gets filled in automatically
with "cn=Users,dc=example" using the example above. Again, can Windows Sync
use this NT domain name, or does it require a DNS name?
For Domain Controller Host, what is expected? If I put in the host name
alone, I get the error message. If I put in the fully qualified DNS host
name, the application locks up and must be terminated with Task Manager (I'm
using the console on a Windows XP machine).
Bind As seems to expect an LDAP distinguished name. How can I translate the
NT replication user name into LDAP terminology, i.e., what in NT corresponds
with cn, ou, dn, etc.?
Thanks for any ideas. -G.
16 years, 10 months
[Fedora-directory-users] Administration domain
by Fernando Muñoz
Hi,
I want to deploy a FDS service in a different geography sites (sharing
the same data), and i have a problem with administration (console
administration of administration server).
I've installed a FDS server in all sites with the same information (by
replication) and i want try administrate with a local console (local
access to fds in each server), and furthermore, administrate all fds
server(access to all server through console) in one central site.
Administration domain are the solution? and why?
or subscribe all administration server to central server?
thanks,
16 years, 10 months
[Fedora-directory-users] NSUniqueID
by Bjorn Oglefjorn
Hello all,
Can someone tell me, does the NSUniqueID attribute ever change for a given
entry in the directory? If so (I've seen it happen), what are the criteria
that prompt NSUniqeID to change?
Thanks,
BO
16 years, 10 months
[Fedora-directory-users] matchingRules in FDS.
by Balaji Ganesan
Newbie question -- i downloaded and installed latest FDS and when I run
'ldapsearch -b "cn=schema" -s base objectclass=* matchingrules' I see few
caseIgnoreOrderingMatch-* and caseIgnoreSubstringMatch-*, but I don't see
any other matching rules. Do I have to do anything special for FDS to
support integetMatch, telephonenumberMatch...
thx in advance.
16 years, 10 months
[Fedora-directory-users] ldapsearch results.
by Balaji Ganesan
I have a simple test schema
--
dn: cn=schema
attributeTypes: ( 1.3.6.1.4.1.8918.1.1.1.1 NAME ( 'mailMSISDN' ) DESC
'mailMSISDN' EQUALITY telephoneNumberMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.50 SINGLE-VALUE )
attributeTypes: ( 1.3.6.1.4.1.8918.1.1.1.2 NAME ( 'subscriberId' ) DESC
'subscriberId' EQUALITY integerMatch SYNTAX
1.3.6.1.4.1.1466.115.121.1.27SINGLE-VALUE )
objectClasses: ( 1.3.6.1.4.1.8918.1.1.1.0 NAME 'myUser' DESC 'myUser' SUP
top STRUCTURAL MUST ( mailMSISDN $ subscriberId ) X-ORIGIN 'Test Schema' )
--
ldapsearch on objectclass myUser returns
--
/usr/local/fds/shared/bin/ldapsearch -p 390 -x -D "cn=testing" -w testingpwd
-b "dc=test,dc=com" "obje
ctclass=myUser"
version: 1
dn: mailMSISDN=16502272370,dc=test,dc=com
objectClass: myUser
objectClass: top
mailMSISDN: 16502272370
subscriberId: 6502272370
dn: mailMSISDN=16502272371,dc=test,dc=com
objectClass: myUser
objectClass: top
mailMSISDN: 16502272371
subscriberId: 6502272371
dn: mailMSISDN=16502272372,dc=test,dc=com
objectClass: myUser
objectClass: top
mailMSISDN: 16502272372
subscriberId: 6502272372
--
ldapsearch on mailMSISDN returns expected results
--
/usr/local/fds/shared/bin/ldapsearch -p 390 -x -D "cn=testing" -w testingpwd
-b "dc=test,dc=com" "mailMSISDN=16502272370"
version: 1
dn: mailMSISDN=16502272370,dc=test,dc=com
objectClass: myUser
objectClass: top
mailMSISDN: 16502272370
subscriberId: 6502272370
--
ldapsearch on subscriberId returns odd results.
--
/usr/local/fds/shared/bin/ldapsearch -p 390 -x -D "cn=testing" -w testingpwd
-b "dc=test,dc=com" "subscriberId=6502272370"
version: 1
dn: mailMSISDN=16502272370,dc=test,dc=com
objectClass: myUser
objectClass: top
mailMSISDN: 16502272370
subscriberId: 6502272370
dn: mailMSISDN=16502272371,dc=test,dc=com
objectClass: myUser
objectClass: top
mailMSISDN: 16502272371
subscriberId: 6502272371
dn: mailMSISDN=16502272372,dc=test,dc=com
objectClass: myUser
objectClass: top
mailMSISDN: 16502272372
subscriberId: 6502272372
--
I was expecting to get back 1 entry with matching subscriberId. Why do I get
back 3 entries? Any ideas what I am doing wrong?
thanks in advance.
16 years, 10 months
[Fedora-directory-users] Three-Way Password Sync?
by Glenn
We are planning to use Windows Sync to synchronize FDS with Active
Directory. We will also synchronize passwords using the Pass Sync service.
We will gradually move users from the old NT domain to Active Directory, so
we will need to have both running for a time.
Can you tell me if it is possible to sync user passwords in FDS with separate
AD and NT domains at the same time? Thanks. -G.
16 years, 10 months
[Fedora-directory-users] Windows Sync Password Complexity
by Glenn
We are getting ready to deploy Windows Sync between FDS and Active
Directory. Among key users at our workplace, there is resistance to the
minimum password complexity rules in Active Directory, but the Red Hat
Directory manual says these rules must be applied for the password sync to
work. Is there any way around this? Thanks. -G.
16 years, 10 months
[Fedora-directory-users] disable anonymous binding
by Tony
Hi,
I'm very new to FDS, but I have succeeeded in getting it up and
running on top of CentOS 4.4, and have populated it with a basic list
of users and their details. I've even got SSL working properly. Now
I'd like to open port 636 to the outside world to let my users see the
address list etc while they are outside the LAN. However I don't want
anyone to bind anonymously to then pull out all the staff details -
emails, phone numbers etc - so I'd like to prevent anonymous binds and
make sure that all users authenticate before being allowed to access
the data.
Could some kind person point me at the docs/info in order to do that?
I did find the "Require Client Authentication" check box but I believe
that is something else - or am I wrong?
--
Cheers,
Tony
16 years, 10 months