[Fedora-directory-users] resource limits for replication manager
by George Holbert
Just curious if anyone knows:
Would there ever be a need to extend search resource limits for
cn=replication manager,cn=replication,cn=config ?
For example, set higher-than-default values for replication manager on
any of:
nsSizeLimit
nsLookThroughLimit
nsTimeLimit
nsIdleTimeout
Or is the replication manager immune to resource limits, like
cn=directory manager?
Thanks,
-- George
16 years, 1 month
[Fedora-directory-users] fedora-ds 1.1.0 on fedora core 5
by sigid@JINLab
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Is there any posibilities to install fedora-ds 1.1.0 on fedora core 5?
thanks
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQFHnUlOqiPNNgPlDu0RAlz/AJ4rOGny1yvJy+s1L7bObQfM4HywbwCgyf7R
LVNIWqIPqrLeAJRJad9RR38=
=cWFf
-----END PGP SIGNATURE-----
16 years, 1 month
Re: [Fedora-directory-users] ldap commands require "-Y GSSAPI". Fixable with "Identity Mapping" ?
by Howard Chu
> Date: Fri, 25 Jan 2008 12:57:55 -0700
> From: Rich Megginson<rmeggins(a)redhat.com>
> Listbox wrote:
>> Hi folks,
>>
>> I have sasl-gssapi installed. But to use any ldap clients like ldapsearch or
>> ldapmodify, I must specify "-Y GSSAPI" , else I get a "no mechanism
>> available" error. Is this an "Identity Mapping" problem, an ldap.conf
>> problem, or is it "as designed"?
>>
> OpenLDAP ldapsearch, ldapmodify, etc. (/usr/bin/ldapsearch etc.) attempt
> to use SASL by default. If you use the -x argument, it will use simple
> userDN/password bind.
It sounds like, since he went to the effort of installing sasl-gssapi, that he
actually wants to use SASL Binds though.
When no mechanism is specified, the client library tries to read the
supportedSASLMechanisms attribute from the server's rootDSE. If the rootDSE is
unreadable (due to ACLs most likely) then you'll get this type of failure.
>> My ldap.conf man page says that "SASL_MECH" is a per-user setting in
>> .ldaprc, so I worry that my services without a login will not use LDAP
>> correctly.
>> I read
>> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Introduction_to_SASL-SA
>> SL_Identity_Mapping.html
>> and the next section on "Realms" but the docs don't say if one should
>> actually put "cn=gssapi,cn=auth" into the SASL map.
--
-- Howard Chu
Chief Architect, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/
16 years, 1 month
[Fedora-directory-users] ldap commands require "-Y GSSAPI". Fixable with "Identity Mapping" ?
by Listbox
Hi folks,
I have sasl-gssapi installed. But to use any ldap clients like ldapsearch or
ldapmodify, I must specify "-Y GSSAPI" , else I get a "no mechanism
available" error. Is this an "Identity Mapping" problem, an ldap.conf
problem, or is it "as designed"?
My ldap.conf man page says that "SASL_MECH" is a per-user setting in
.ldaprc, so I worry that my services without a login will not use LDAP
correctly.
I read
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Introduction_to_SASL-SA
SL_Identity_Mapping.html
and the next section on "Realms" but the docs don't say if one should
actually put "cn=gssapi,cn=auth" into the SASL map.
Thanks!
***************************
***************************
***************************
[installer@trixter ~]$ ldapsearch -V
ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.34 (Nov 2 2007 08:16:21) $
kojibuilder@xenbuilder2.fedora.redhat.com:/builddir/build/BUILD/openldap-2.3
.34/openldap-2.3.34/build-clients/clients/tools
(LDAP library: OpenLDAP 20333)
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available:
***************************
***************************
***************************
[installer@trixter ~]$ ldapsearch -V -Y GSSAPI > /dev/null
ldapsearch: @(#) $OpenLDAP: ldapsearch 2.3.34 (Nov 2 2007 08:16:21) $
kojibuilder@xenbuilder2.fedora.redhat.com:/builddir/build/BUILD/openldap-2.3
.34/openldap-2.3.34/build-clients/clients/tools
(LDAP library: OpenLDAP 20333)
SASL/GSSAPI authentication started
SASL username: installer(a)HYMESRUZICKA.ORG
SASL SSF: 56
SASL installing layers
16 years, 1 month
[Fedora-directory-users] Can't create users, time for complete wipe and re-install?
by Listbox
Hi folks,
I'm really stumped by this "Insufficient 'add' privilege" problem.
I can create all the "Administrators" I want for the netscaperoot directory,
but none of those users can:
A) Create new users for my hymesruzicka directory
B) Create a new "Directory Administrator" for my hymesruzicka directory
C) Grant "'add' privilege" to my existing "Configuration Administrator"
my hymesruzicka directory
D) Add a user from the netscaperoot users to my hymesruzicka directory
"Directory Administrator" group
E) Modify or add the existing ACLs for my hymesruzicka directory
Is there a way to create a new "Directory Administrator" and other users? If
not, and we have to wipe and re-install from scratch, what must we do to
ensure that we can create users and administrators for our directory?
Thanks!
16 years, 1 month
[Fedora-directory-users] Issue with Fedora DS Client Setup on HP???/
by Singh Raina, Ajeet
Hello,
I have installed Fedora DS Client on RHEL machine. I was trying to setup
Client on HP-UX and am able to list all the DS users created through
ldapsearch command.but am not able to see any output through nsquery or
pwget command .Even the id command is not working/showing any output.
Earlier I upgraded my machine from HP-UX 11.00 to 11.11 PA RISC System
and downloaded and installed the patches needed and listed in hp website
documentation but am finding only a single change in ldap.conf file
that's it. I modified the nsswitch.conf as follows:
#
# /etc/nsswitch.hp_defaults:
#
# @(#)B.11.11_LR
#
# An example file that could be copied over to /etc/nsswitch.conf; it
# uses NIS (YP) in conjunction with files.
#
passwd: files ldap
group: files ldap
hosts: dns
networks: files
protocols: nis [NOTFOUND=return] files
rpc: nis [NOTFOUND=return] files
publickey: nis [NOTFOUND=return] files
netgroup: nis [NOTFOUND=return] files
automount: files nis
aliases: files nis
services: nis [NOTFOUND=return] files
~
This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you.
16 years, 1 month
[Fedora-directory-users] Authenticate before querying ldap.
by shivaraj.shivanna@wipro.com
Hi,
Our organization has an AD server running which requires you to bind to
it first before querying the server.
For example commands like
ldapsearch -x -h "some ip" "(cn=abcd)" -b "some base" would fail
with LdapErr: DSID-0C090627, comment: In order to perform this
operation a successful bind must be completed on the connection.
but commands like
ldapsearch -x -h "some ip" "(cn=abcd)" -b "some base" -D "some user
dn" -W would work on entering correct password.
How can we replicate this behavior with the fedora directory server ?
Regards,
Shivraj
16 years, 1 month