[Fedora-directory-users] Usersync Error
by Glenn
I'm still trying to get Fedora Directory to contact an NT4 server for
replication. After I fill out the Windows Sync agreement form and
click "Next", the console freezes. If I go to the NT4 machine and stop the
User Sync service, the console unfreezes and gives the dreaded "Unable to
contact Active Directory server" message. I appear to have SSL set up
correctly.
An error message appears in the wrapper.log on the NT machine when I stop the
User Sync service while FD is trying to make the sync agreement:
java.lang.NoSuchMethodError: javax.net.ssl.SSLContext.createSSLEngine()
Ljavax/net/ssl/SSLEngine;
Is the Windows Sync function known to work with FDS 1.0.3 and NT4? Hoping
someone can help. Thanks. -Glenn.
16 years, 9 months
[Fedora-directory-users] FDS, Kerberos, SASL confusion
by Hintermayer Johannes
Hi all,
currently I'm battling with FDS, Kerberos and SASL to get a working
Single-Sign-On setup.
At the moment I have a working Kerberos Realm to which I can
successfully connect. I also have a working FDS with one user for
testing purposes. Saslauthd is also configured and executing
testsaslauthd is ok.
But now I have problems to convince FDS to authenticate users via
Kerberos. I have read
http://directory.fedoraproject.org/wiki/Howto:Kerberos and
http://www.redhat.com/docs/manuals/dir-server/ag/7.1/ssl.html#1083165
but I don't think it's that simple. At least it's not yet working for
me.
When I try to bind to FDS via GSSAPI the following error occurs:
#klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: bsmith(a)AFB.LAN
#ldapsearch -Y GSSAPI -D "uid=bsmith,ou=People,dc=afb,dc=lan" -v
ldap_initialize( <DEFAULT> )
SASL/GSSAPI authentication started
ldap_sasl_interactive_bind_s: Invalid credentials (49)
additional info: SASL(-1): generic failure: GSSAPI Error:
Miscellaneous failure (Permission denied)
I have tried several combinations of config files and password entries
but none worked.
So first of all I'd like to ask a few questions to shed light on a few
things:
1. Do I need saslauthd on every client which I want to authenticate via
FDS/Kerberos?
2. Do I need a host principal for every client?
Here is my current configuration, please correct me if there are some
unneeded files (these were built together from several tutorials):
/etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = AFB.LAN
dns_lookup_realm = false
dns_lookup_kdc = false
[realms]
AFB.LAN = {
kdc = vafbkrb01.afb.lan:88
admin_server = vafbkrb01.afb.lan:749
default_domain = afb.lan
}
[domain_realm]
.afb.lan = AFB.LAN
afb.lan = AFB.LAN
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[appdefaults]
pam = {
debug = true
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
/etc/ldap.conf
host 172.16.50.2
base dc=afb,dc=lan
ssl no
tls_cacertdir /etc/openldap/cacerts
pam_password md5
SASL_MECH GSSAPI
SASL_REALM AFB.LAN
use_sasl on
sasl_auth_id ldap/vafbds01.afb.lan
/etc/sysconfig/saslauthd
SOCKETDIR=/var/run/saslauthd
MECH=kerberos5
FLAGS=
/usr/lib/sasl2/slapd.conf
mech_list: plain gssapi digest-md5 cram-md5 external
pwcheck_method: saslauthd
saslauthd_path: /var/run/saslauthd/mux
keytab: /etc/krb5.keytab
SASL Mapping:
nssaslmapfiltertemplate: (uid=\1)
nssaslmapregexstring: \(.*\)(a)\(.*\)
/opt/fedora-ds/slapd-vafbds01/start-slapd contains:
"export KRB5_KTNAME=/etc/krb5.keytab"
The password entry for bsmith in FDS contains:
{SASL}bsmith(a)AFB.LAN
FDS supports the following SASLMechanisms
#ldapsearch -x -D "uid=bsmith,ou=People,dc=afb,dc=lan" -b "" -s base
supportedSASLMechanisms
# extended LDIF
#
# LDAPv3
# base <> with scope base
# filter: (objectclass=*)
# requesting: supportedSASLMechanisms
#
#
dn:
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: ANONYMOUS
supportedSASLMechanisms: DIGEST-MD5
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: PLAIN
supportedSASLMechanisms: LOGIN
supportedSASLMechanisms: CRAM-MD5
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
DNS (forward & reverse) as well as NTP settings are correct on all
hosts.
Are there any obvious mistakes in my configuration or am I on the right
track?
Thanks in advance!
Best regards,
Johannes Hintermayer
16 years, 9 months
[Fedora-directory-users] db2bak Question
by Steve Rigler
We use Netbackup for our backup environment and I'd like to incorporate
"db2bak" into our bpstart_notify script (which is run every time a
backup starts). The one thing I've noticed is these messages that
appear syslog when db2bak is run:
ns-slapd: sql_select option missing
ns-slapd: auxpropfunc error no mechanism available
Are these messages indicative of a problem? This is on RHEL4 U4 on an
AMD64 system using Fedora DS 1.0.4.
Thanks,
Steve
16 years, 9 months
RE: [Fedora-directory-users] Configuration Directory Question
by James Deuchar
Thanks for the swift response - size depends on the success of the project - am tempted to go with external config directory assuming I can get it working...I tried to the procedure I listed below i.e. installed the RPM, ran setup to create a 'dsconfig' instance on port 5555.Then I created a master.inf file for inputing into the ds_newinst.pl script:[General]FullMachineName= server1.jamesd.comSuiteSpotUserID= ldapServerRoot= /opt/fedora-dsConfigDirectoryAdminID= adminConfigDirectoryAdminPwd= blahConfigDirectoryLdapURL= ldap://server1.jamesd.com:5555/o=NetscapeRootAdminDomain= jamesd.com[slapd]ServerPort= 389ServerIdentifier= master01Suffix= dc=jamesd,dc=comRootDN= cn=Directory ManagerRootDNPwd= blahUserExistingMC=1When I ran that it seemed to work - instance called master01 was created and is running.When running the console though, it's not listed - only the Administration Server and 'dsconfig' Directory Server instance. How can I make the master01 instance appear in the admin console and also verify that master01 is using dsconfig to stores is configuration data?Thanks again> Date: Thu, 26 Jul 2007 09:33:37 -0600> From: rmeggins(a)redhat.com> To: fedora-directory-users(a)redhat.com> Subject: Re: [Fedora-directory-users] Configuration Directory Question> > James Deuchar wrote:> > Hi,> >> > I've got a what I thought was a relatively simple DS setup with two > > master DS servers doing master-master replication. In the future > > slaves may be added into the equation.> >> > Initially I installed both servers the same - as standalone DS' each > > with it's own admin server and 'in-house' o=NetscapeRoot configuration > > directory.> >> > Reading some of the Redhat docs on 'Configuration decisions' it talks > > about having the configuration directory in a separate directory > > instance - based on what I've seen from the DS setup script this > > implies supplying those details during the install of the real DS > > instances that will contain the data.> >> > Is my understanding correct? Does this mean I should be installing an > > independent configuration directory on both masters and setup > > replication between them to provide a redundant configuration > > directory alongside the redundant data directories?> For small deployments, you can have your config DS and data DS be the same.> >> > If so is the install procedure reasonable?:> >> > - install fedora RPM on server 1> > - Run setup script to create server 1 config directory> > - Run ds_newinst.pl to create data directory on the same server > > pointing it to the local config directory during setup> > - Repeat on server 2> > - Setup replication on data masters and on config directories> Sure.> >> > Many thanks!> >> > ------------------------------------------------------------------------> > Are you the Quizmaster? Play BrainBattle with a friend now! > > <http://specials.uk.msn.com/brainbattle>> > ------------------------------------------------------------------------> >> > --> > Fedora-directory-users mailing list> > Fedora-directory-users(a)redhat.com> > https://www.redhat.com/mailman/listinfo/fedora-directory-users> > >
_________________________________________________________________
Feel like a local wherever you go with BackOfMyHand.com
http://www.backofmyhand.com
16 years, 9 months
[Fedora-directory-users] Configuration Directory Question
by James Deuchar
Hi,I've got a what I thought was a relatively simple DS setup with two master DS servers doing master-master replication. In the future slaves may be added into the equation.Initially I installed both servers the same - as standalone DS' each with it's own admin server and 'in-house' o=NetscapeRoot configuration directory.Reading some of the Redhat docs on 'Configuration decisions' it talks about having the configuration directory in a separate directory instance - based on what I've seen from the DS setup script this implies supplying those details during the install of the real DS instances that will contain the data.Is my understanding correct? Does this mean I should be installing an independent configuration directory on both masters and setup replication between them to provide a redundant configuration directory alongside the redundant data directories?If so is the install procedure reasonable?: - install fedora RPM on server 1 - Run setup script to create server 1 config directory - Run ds_newinst.pl to create data directory on the same server pointing it to the local config directory during setup - Repeat on server 2 - Setup replication on data masters and on config directoriesMany thanks!
_________________________________________________________________
Try Live.com - your fast, personalised homepage with all the things you care about in one place.
http://www.live.com/?mkt=en-gb
16 years, 9 months
[Fedora-directory-users] Windows Sync NT4 Search Base?
by Glenn
I finally can communicate with the ldap service on my NT4 test machine,
although without SSL. Now I need to know what search base to use.
dc=mydomain,dc=edu doesn't work, and I have a feeling it is something unique
to Windows NT rather than something unique to my installation. Anyone got a
clue? Thanks. -Glenn.
# ldapsearch -v -H ldap://nt4testbox.mydomain.edu -D "uid=admin,ou=system" -
b "dc=mydomain,dc=edu"
ldap_initialize( ldap://nt4testbox.mydomain.edu )
ldap_sasl_interactive_bind_s: No such attribute (16)
16 years, 9 months
[Fedora-directory-users] Problem with Massive Replication Agreements
by Fernando Muñoz
Hi all,
I have a distributed Directory Service on 25 servers with FDS 1.0.4. The
replication configuration it's some complex:
- One HUB server with 26 Databases(26 enabled Replicas)-> 25
HUB-Replicas with 24 replication agreements and one Multimaster-Replica
with 26 replication agreements. Total replication agreements in this
server it's 626 replication agreements.
- 25 Supplier (on our database) with Hub server and consummers (for
others databases) of Hub server.
When i try to configure (automatically by script) this 626 replication
agreements (on HUB server) i show this
errorlog(/opt/fedora-ds/slapd-prueba/logs/errors) for each new
replication agreement after 250 replication agreements aprox.:
[22/Jul/2007:20:55:52 +0200] NSMMReplicationPlugin -
agmt="cn=prueba1-prueba2" (prueba1:636): Unable to create protocol
thread; NSPR error - -5974, Insufficient system resources.
Exist some FDS limitation about massive replication agreements? or some
FDS performance settings (maximun entries, caché,look-through limit,
size limit, file descriptors,connection management...)?
How can i solved this problem?
thanks,
16 years, 9 months
[Fedora-directory-users] NT4 Sync Hassle
by Glenn
I can't seem to contact my NT4 server to create a sync agreement with Fedora
DS. I tried ldapsearch and it just hangs:
# ldapsearch -v -H ldaps://nt4testbox.mydomain.edu -D "uid=admin,ou=system" -
w password -b "dc=mydomain,dc=edu"
ldap_initialize( ldaps://nt4testbox.mydomain.edu )
On the NT server, the wrapper.log reports:
java.lang.NoSuchMethodError: javax.net.ssl.SSLContext.createSSLEngine()
Ljavax/net/ssl/SSLEngine;
It shows a lot of additional stuff with the same time stamp, ending with:
org.apache.mina.util.BaseThreadPool$Worker.run(BaseThreadPool.java:279)
Any idea what is wrong or how I can narrow it down? Thanks. -Glenn.
16 years, 9 months
[Fedora-directory-users] FDS / HR synchronization
by Robert Ludvik
Hi
Where should I start to read/look for if I'd like to achieve that user
data in FDS (username and passwd for domain logon, email address, group
membership (based on some employee data) ...) is synchronized with data
of our HR application, which stores data in SQL (Oracle)? HR application
and database are outsourced, FDS is at our company.
For example, when a new employee comes and his data in entered in HR
application, generated username, password, email address ... should be
somehow synchronized to FDS.
And, when some employee leave our company, his account in FDS becomes
inactive.
One way is to export date from SQL to CSV, use csv2ldif and import this
LDIF to FDS. This can be done manually (or maybe even automated in some
strange way).
Is there a more elegant way?
Thanks
Robert Ludvik
16 years, 9 months
[Fedora-directory-users] Performance
by Vampire D
As I understand it, OpenLDAP doesn't perform all that well under a high
load. How does FDS perform in comparison to other LDAP implmentations like
OpenLDAP and Sun?
--
"Do the actors on Unsolved Mysteries ever get arrested because they look
just like the criminal they are playing?"
Christopher
16 years, 9 months