[Fedora-directory-users] migration from 1.0.2 to 1.1
by gregory LAROCHE
I try to migrate my DS from fedora-ds-1.0.2-1.RHEL4 on
fedora core 3 i386, to have a DS
fedora-ds-1.1.0-3.fc6.
First, I upgrade OS to fedora core 6, and install and
update package fedora-ds* and dependencies. I run
the /usr/sbin/setup-ds-admin.pl (express mode), and I
connect myself to the console and the console to the
directory successfully.
Next, erase all packages fedora-ds*, and directory
/etc/dirsrv/*, and reinstall all packages. I run the
/usr/sbin/migrate-ds-admin.pl
General.ConfigDirectoryAdminPwd=mypwd
Here is the migration log :
Beginning migration of Directory and Administration
servers from /opt/fedora-ds . . .
Beginning migration of directory server instances in
/opt/fedora-ds . . .
Your new DS instance 'slapd-host02' was successfully
created.
Beginning migration of Administration server from
/opt/fedora-ds . . .
Creating Admin Server files and directories . . .
The server
'ldaps://host02.domaine.com:636/o=NetscapeRoot' is not
reachable. Error: unknown error
Exiting . . .
And the /var/log/dirsrv/slapd-host02/errors
import userRoot: Finished scanning file
"/tmp/ldifMh1yOw.ldif" (9 entries)
[22/Jan/2008:11:37:38 +0100] - import userRoot:
Workers finished; cleaning up...
[22/Jan/2008:11:37:38 +0100] - import userRoot:
Workers cleaned up.
[22/Jan/2008:11:37:38 +0100] - import userRoot:
Cleaning up producer thread...
[22/Jan/2008:11:37:38 +0100] - import userRoot:
Indexing complete. Post-processing...
[22/Jan/2008:11:37:38 +0100] - import userRoot:
Flushing caches...
[22/Jan/2008:11:37:38 +0100] - import userRoot:
Closing files...
[22/Jan/2008:11:37:38 +0100] - All database threads
now stopped
[22/Jan/2008:11:37:38 +0100] - import userRoot: Import
complete. Processed 9 entries in 1 seconds. (9.00
entries/sec)
[22/Jan/2008:11:37:50 +0100] - Fedora-Directory/1.1.0
B2007.354.1236 starting up
[22/Jan/2008:11:37:51 +0100] - Clean up db environment
and start from archive.
[22/Jan/2008:11:37:51 +0100] - libdb: Program version
4.3 doesn't match environment version
[22/Jan/2008:11:37:51 +0100] - Deleting log file:
(/var/lib/dirsrv/slapd-host02/db/log.0000000313)
[22/Jan/2008:11:37:51 +0100] NSMMReplicationPlugin -
changelog program - Upgrading from
Changelog5/NSMMReplicationPlugin/4 to
bdb/4.3/libreplication-plugin
is successfully done
(/var/lib/dirsrv/slapd-host02/changelogdb)
[22/Jan/2008:11:37:51 +0100] - slapd started.
Listening on All Interfaces port 389 for LDAP requests
[22/Jan/2008:11:37:51 +0100] - Listening on All
Interfaces port 636 for LDAPS requests
No logs in /var/log/dirsrv/admin-serv/errors
Any ideas to solve this ?
Thanks
_____________________________________________________________________________
Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail http://mail.yahoo.fr
16 years, 2 months
[Fedora-directory-users] ConfigFile for silent install
by Gordon Messmer
The documentation doesn't seem to be very clear about the expected
contents of files specified via ConfigFile in the inf files used for
silent installs.
For example, I want to change the aci on the VLV feature, so if I try
this in a ConfigFile:
dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config
objectClass: top
objectClass: directoryServerFeature
oid: 2.16.840.1.113730.3.4.9
cn: VLV Request Control
aci: (targetattr != "aci")(version 3.0; acl "VLV Request Control";
allow( read, search, compare, proxy ) userdn = "ldap:///anyone";)
...the server setup fails. I get this output:
Error adding entry 'oid=2.16.840.1.113730.3.4.9,cn=features,cn=config'.
Error: No such object
Error: Could not create directory server instance 'master1'.
Exiting . . .
If, instead, I use a format suitable for ldapmodify, like this:
dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config
changetype: modify
replace: aci
aci: (targetattr != "aci")(version 3.0; acl "VLV Request Control";
allow( read, search, compare, proxy ) userdn = "ldap:///anyone";)
The server doesn't complain, but it appears to have no effect at all.
What should the ConfigFile look like?
16 years, 2 months
[Fedora-directory-users] ACLPB_MAX_SELECTED_ACLS and aci cache overflows
by audunroe@tihlde.org
Hello,
A bit unsure whether this should be posted to the user- or dev- list, but
landed on the former.
We've recently been attempting to move an existing ldap-structure from a
Sun 5.2 server, to Fedora DS 1.1. The move itself was relatively painless
apart from one thing: When running certain searches, we'd see loads of
"aci cache overflown" messages in the logs, and performance would slow to
a crawl. This is probably due to parts of the structure making very heavy
use of ACIs.
A C/C++ proficient coworker tracked down acl.c and the constant
ACLPB_MAX_SELECTED_ACLS in acl.h. By bumping this from the original 200 to
something higher, the cache overflows stopped, and searches completed
normally. There doesn't seem to be any bad side-effects.
For my own peace of mind, however, I'd be interested in hearing thoughts
on bumping this value, and the reason it's 200.
- Any chance this value might become configurable in future versions?
- Can you think of any unfortunate side-effects down the road from bumping
this value, aside from increased memory-usage?
- Is '200' a more or less arbitrarily chosen round number deemed
sufficient, or is there a very specific reason it isn't higher? Ie: a size
of 200 should be sufficient for any structure, and overflows might
indicate excessive use of ACIs and a structure that should be reworked?
(actually not excluding that last one possibility anyway, as evaluating an
ACI at every node probably is a performance-killer as far as searches go)
I'm interested in hearing any thoughts on this, even wild tangents :)
--
Regards,
Audun
16 years, 2 months
[Fedora-directory-users] excessive clock skew problem with MMR
by Jeremiah Coleman
My 2 FDS systems will no longer replicate, due to excessive clock skew.
Specifically, this is what I get in the log:
[21/Jan/2008:11:03:53 -0600] NSMMReplicationPlugin - conn=15 op=3
replica="dc=cctechnol,dc=com": Unable to acquire replica: error:
excessive clock skew
[21/Jan/2008:11:03:53 -0600] - csngen_adjust_time: adjustment limit
exceeded; value - 1872704, limit - 86400
[21/Jan/2008:11:03:53 -0600] NSMMReplicationPlugin - conn=16 op=3
replica="dc=cctechnol,dc=com": Unable to acquire replica: error:
excessive clock skew
[21/Jan/2008:11:03:55 -0600] - csngen_adjust_time: adjustment limit
exceeded; value - 1872702, limit - 86400
[21/Jan/2008:11:03:55 -0600] NSMMReplicationPlugin - conn=17 op=3
replica="dc=cctechnol,dc=com": Unable to acquire replica: error:
excessive clock skew
I found a discussion of this problem in the archives, but the solution I
found there did not work for me. I removed the replication agreements,
shutdown the servers, exported the userRoot database from one and
imported it to the other. Deleted everything in changelogdb. Restarted
the servers and added the replication agreement. Same error.
Anyone know of something else to try?
Thanks,
Jay
--
Jeremiah Coleman
Systems Administrator
C & C Technologies
337-261-0660 x3421
jcoleman(a)cctechnol.com
16 years, 2 months
[Fedora-directory-users] unsubscribe
by Sascha Wilde
unsubscribe
fedora-directory-users-request(a)redhat.com writes:
> Welcome to the Fedora-directory-users(a)redhat.com mailing list!
>
> To post to this list, send your email to:
>
> fedora-directory-users(a)redhat.com
>
> General information about the mailing list is at:
>
> https://www.redhat.com/mailman/listinfo/fedora-directory-users
>
> If you ever want to unsubscribe or change your options (eg, switch to
> or from digest mode, change your password, etc.), visit your
> subscription page at:
>
> https://www.redhat.com/mailman/options/fedora-directory-users/wilde%40int...
>
>
> You can also make such adjustments via email by sending a message to:
>
> Fedora-directory-users-request(a)redhat.com
>
> with the word `help' in the subject or body (don't include the
> quotes), and you will get back a message with instructions.
>
> You must know your password to change your options (including changing
> the password, itself) or to unsubscribe. It is:
>
> q/slci
>
> Normally, Mailman will remind you of your redhat.com mailing list
> passwords once every month, although you can disable this if you
> prefer. This reminder will also include instructions on how to
> unsubscribe or change your account options. There is also a button on
> your options page that will email your current password to you.
>
>
<#secure method=pgpmime mode=sign>
--
Sascha Wilde OpenPGP key: 4BB86568
Intevation GmbH, Osnabrück http://www.intevation.de/~wilde/
Amtsgericht Osnabrück, HR B 18998 http://www.intevation.de/
Geschäftsführer: Frank Koormann, Bernhard Reiter, Dr. Jan-Oliver Wagner
16 years, 2 months
[Fedora-directory-users] Can't add users with admin console, perhaps because I have no users in "Directory Administrators" group.
by Listbox
Hi folks,
I've got a bootstrap puzzle using the DS console to create my first users. I
can't create Directory Administrators for my domain unless I am logged in as
a Directory Administrator for that domain. I'm sure this is really simple,
but I know a minimum about ldap management, and I cannot find the relevant
docs on what exactly to do.
This is a brand new installation of FDS 1.1 with a brand new MIT Kerberos
setup on a fresh Fedora 7 install. There are no "people" in the LDAP
directory. There aren't even any end users in the /etc/passwd file.
When I try to use the FDS console to create a user in the "People"
directory, I get this error dialog after I close the new user form"
netscape.ldap.LDAPException: error result (50); Insufficient 'add' privilege
to the 'userPassword' attribute
I think my slapd error log is telling me that there is no-one in the
"Directory Administrators" 'group' for my "hymesruzicka" 'directory'.
Thanks for any help!
*******************************************
*******************************************
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - Processed attr:userpassword for
entry:uid=installer,ou=people,dc=hymesruzicka,dc=org
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - 1. Evaluating ALLOW aci(4) "
"Directory Administrators Group""
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - Evaluating user
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot in group
cn=Directory Administrators,dc=hymesruzicka,dc=org?
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - -- In cn=Configuration
Administrators,ou=Groups,ou=TopologyManagement,o=NetscapeRoot
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - -- Not in cn=Directory
Administrators,dc=hymesruzicka,dc=org
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - Evaluated ACL_FALSE
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - conn=14 op=22 (main): Deny add on
entry(uid=installer,ou=people,dc=hymesruzicka,dc=org).attr(userpassword) to
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot: no aci
matched the subject by aci(4): aciname= "Directory Administrators Group",
acidn="dc=hymesruzicka,dc=org"
*******************************************
*******************************************
I got a similar error in the log when I tried to create a new ACI for the
"hymesruzicka" 'directory' with a user from the "netscaperoot" directory:
*******************************************
*******************************************
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - acl_init_userGroup: found in
cache for
dn:uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - #### conn=14 op=142
binddn="uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot"
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Searching AVL tree for
update:dc=hymesruzicka,dc=org: container:1
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Searching AVL tree for
update:dc=org: container:-1
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ************ RESOURCE INFO
STARTS *********
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Client DN:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - resource type:256(write
target_DN )
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Slapi_Entry DN:
dc=hymesruzicka,dc=org
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ATTR: aci
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - rights:write
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ************ RESOURCE INFO
ENDS *********
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Using ACL Cointainer:0 for
evaluation
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ***BEGIN ACL INFO[ Name:
"Directory Administrators Group"]***
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ACL Index:4 ACL_ELEVEL:6
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ACI type:(compare search read
write delete add self target_attr acltxt allow_rule )
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ACI RULE type:(groupdn )
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Slapi_Entry
DN:dc=hymesruzicka,dc=org
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ***END ACL
INFO*****************************
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Num of ALLOW Handles:1, DENY
handles:0
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Processed attr:aci for
entry:dc=hymesruzicka,dc=org
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - 1. Evaluating ALLOW aci(4) "
"Directory Administrators Group""
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Evaluating user
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot in group
cn=Directory Administrators,dc=hymesruzicka,dc=org?
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - -- In cn=Configuration
Administrators,ou=Groups,ou=TopologyManagement,o=NetscapeRoot
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - -- Not in cn=Directory
Administrators,dc=hymesruzicka,dc=org
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Evaluated ACL_FALSE
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - conn=14 op=142 (main): Deny write
on entry(dc=hymesruzicka,dc=org).attr(aci) to
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot: no aci
matched the subject by aci(4): aciname= "Directory Administrators Group",
acidn="dc=hymesruzicka,dc=org"
16 years, 2 months
[Fedora-directory-users] Can't add users with admin console, perhaps because I have no use rs in "Directory Administrators" group.
by Charles Hymes
Hi folks,
I've got a bootstrap puzzle using the DS console to create my first users. I
can't create Directory Administrators for my domain unless I am logged in as
a Directory Administrator for that domain. I'm sure this is really simple,
but I know a minimum about ldap management, and I cannot find the relevant
docs on what exactly to do.
This is a brand new installation of FDS 1.1 with a brand new MIT Kerberos
setup on a fresh Fedora 7 install. There are no "people" in the LDAP
directory. There aren't even any end users in the /etc/passwd file.
When I try to use the FDS console to create a user in the "People"
directory, I get this error dialog after I close the new user form"
netscape.ldap.LDAPException: error result (50); Insufficent 'add' privilige
to the 'userPassword'attribute
I think my slapd error log is telling me that there is no-one in the
"Directory Administrators" 'group' for my "hymesruzicka" 'directory'.
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - Processed attr:userpassword for
entry:uid=installer,ou=people,dc=hymesruzicka,dc=org
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - 1. Evaluating ALLOW aci(4) "
"Directory Administrators Group""
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - Evaluating user
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot in group
cn=Directory Administrators,dc=hymesruzicka,dc=org?
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - -- In cn=Configuration
Administrators,ou=Groups,ou=TopologyManagement,o=NetscapeRoot
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - -- Not in cn=Directory
Administrators,dc=hymesruzicka,dc=org
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - Evaluated ACL_FALSE
[19/Jan/2008:11:16:39 -0800] NSACLPlugin - conn=14 op=22 (main): Deny add on
entry(uid=installer,ou=people,dc=hymesruzicka,dc=org).attr(userpassword) to
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot: no aci
matched the subject by aci(4): aciname= "Directory Administrators Group",
acidn="dc=hymesruzicka,dc=org"
I get a similar error in the log when I try to create a new aci for the
"hymesruzicka" 'directory'with a user from the "netscaperoot" directory:
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - acl_init_userGroup: found in
cache for
dn:uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - #### conn=14 op=142
binddn="uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot"
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Searching AVL tree for
update:dc=hymesruzicka,dc=org: container:1
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Searching AVL tree for
update:dc=org: container:-1
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ************ RESOURCE INFO
STARTS *********
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Client DN:
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - resource type:256(write
target_DN )
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Slapi_Entry DN:
dc=hymesruzicka,dc=org
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ATTR: aci
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - rights:write
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ************ RESOURCE INFO
ENDS *********
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Using ACL Cointainer:0 for
evaluation
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ***BEGIN ACL INFO[ Name:
"Directory Administrators Group"]***
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ACL Index:4 ACL_ELEVEL:6
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ACI type:(compare search read
write delete add self target_attr acltxt allow_rule )
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ACI RULE type:(groupdn )
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Slapi_Entry
DN:dc=hymesruzicka,dc=org
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - ***END ACL
INFO*****************************
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Num of ALLOW Handles:1, DENY
handles:0
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Processed attr:aci for
entry:dc=hymesruzicka,dc=org
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - 1. Evaluating ALLOW aci(4) "
"Directory Administrators Group""
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Evaluating user
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot in group
cn=Directory Administrators,dc=hymesruzicka,dc=org?
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - -- In cn=Configuration
Administrators,ou=Groups,ou=TopologyManagement,o=NetscapeRoot
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - -- Not in cn=Directory
Administrators,dc=hymesruzicka,dc=org
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - Evaluated ACL_FALSE
[19/Jan/2008:13:05:02 -0800] NSACLPlugin - conn=14 op=142 (main): Deny write
on entry(dc=hymesruzicka,dc=org).attr(aci) to
uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot: no aci
matched the subject by aci(4): aciname= "Directory Administrators Group",
acidn="dc=hymesruzicka,dc=org"
16 years, 2 months
Re: [Fedora-directory-users] Difficulties with fedora-idm-console
by leonhardt@hawaii.rr.com
Thanks Doug...that did the trick.
Matt
---- Doug Chapman <prjctgeek(a)gmail.com> wrote:
> I had this same same issue until I changed the JAVA variable in the
> fedora-idm-console script (or you could fix your PATH so the correct jre
> came first, it's just doing `which java`).
>
> On Jan 18, 2008 6:41 PM, <leonhardt(a)hawaii.rr.com> wrote:
>
> > Hi everyone...I'm new to LDAP and FDS, so please bear with me.
> >
> > I just install FDS 1.1 on a clean F8 box. I got through the setup scripts
> > but when I launch fedora-idm-console, and enter my login info I keep getting
> > an Error 400 response. My login looks like this:
> >
> > User ID: cn=Directory Manager
> > Password: ********
> > Administration URL: http://localhost:9830
> >
> > I've tried all kinds of variations, username w/o the "cn=", logging in as
> > "admin", and every variation of IP/partially/fully-qualified domain name I
> > could think of for the box. I've also tried running with '-a' (it didn't
> > recognize the -d option, recommended to me by someone in the #fedora-ds
> > room). This is my error, no matter what I do:
> >
> > Can't logon because of an incorrect User ID,
> > Incorrect password or Directory problem.
> > HttpException:
> > Response: HTTP/1.1 400 Bad Request
> > Status: 400
> > URL: http:/admin-serv/authenticate
> >
> > This last line bothers me...it looks as if the console is not even trying
> > to pass the login info to a valid URL! If I just point my browser at
> > http://localhost:9830/ I get the HTML back-end and can authenticate there
> > to get into the "Adminsitration Express" tool, so I'm fairly convinced I'm
> > using the correct login info...
> >
> > I's confused...
> >
> > Matt
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
16 years, 2 months