[Fedora-directory-users] Replicate o=NetscapeRoot database
by Hugo Etievant
hello,
- I have installed 2 Directory servers, the second (DS2) is registered
on the first (DS1).
- I have installed multi master replication between the both (DS1 and
DS2) for user data on userRoot database.
Here, that is working.
- Finally, I try to configure multi master replication for
o=NetscapeRoot database between 2 DS with the same way of conventional
replication, after copying o=NetscapeRoot database from DS1 to DS2.
Replication work, but Administration Server of DS2 refuse to start on
the replica of NetscapeRoot.
The Admin Guide is not clear about NetscapeRoot replication
(8.14. Replicating o=NetscapeRoot for Administration Server Failover
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Replication...
)
It exists a way with GUI Console to configure replication for
o=NetscapeRoot on existing architecture ?
Who have experimented this point ?
regards
--
* Hugo Étiévant
***
15 years, 5 months
[Fedora-directory-users] dbverify
by Dan Lannom
I plan to migrate to fds from SunOne 5.2 and so I want to validate the
system.
I'm currently running version 1.1.3-2 of the directory on RHEL 5.2.
When I do searches against the server everything seems to work fine, but
When I run /usr/lib/dirsrv/slapd-{{hostname}}/dbverify, with the server
off, it fails with
errors like:
[28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 2
[28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 8
[28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 11
[28/Oct/2008:10:52:16 -0400] - libdb: Page 4: out-of-order key at entry 14
...
[28/Oct/2008:10:52:16 -0400] - libdb:
/var/lib/dirsrv/slapd-hume/db/{{SUFFIX}}/{{attribute}}.db4:
DB_VERIFY_BAD: Database verification failed
[28/Oct/2008:10:52:16 -0400] DB verify - verify failed(-30975):
/var/lib/dirsrv/slapd-{{hostname}}/db/userdata/{{attribute}}.db4
reindexing does not change anything and I find the same errors for both
i386 and x86_64 and the errors are almost identical for the master and
the slaves.
Since I can find any evidence of the indexes identified as corrupted not
working I wonder why dbverify is generating these errors.
Thanks for any help,
Dan Lannom
UM-Dearborn
15 years, 5 months
[Fedora-directory-users] [ioggstream] peculiar deploy of fedorads
by Roberto Polli
Hi all,
I'm planning a mid-size deploy of fedora-ds.
let's call the units of this deploy "island"
islands are independent, data must be physically isolated betwen them
* an island represent a scalable, multi-mastered deploy of fedora-ds made of
6+ nodes
* I have more islands: island1, island2, ..
* one island contains many mailDomain (foo.it, foo.net, foo.com)
* a mailDomain is hosted on one island: if foo.it is on island1, it won't be
on island2
* each island has its own services accessing ldap
There's one Rule-Them-All (RTA) island with shared services.
Services on the "RTA" must access all ldap using the same search for all the
island
ex. ldapsearch -h ruleThemAll "(mail=foo(a)bar.com)"
should find the user independently on which island it is.
question:
how will you implement this requirements trying to limit the overhead?
(somebody told me about a VirtualDS but I'd like to do it with FDS..)
Peace, R.
15 years, 5 months
[Fedora-directory-users] Windows Sync and Active Directory password complexity policies
by Hugo Etievant
hello,
The admin Guid says that : "Make sure that the Active Directory password
complexity policies are enabled so that the *Password Sync* service will
run. Run |secpol.msc|, and select *Security Settings*, then *Account
Policies*, and *Password Policy*. Make sure that |Password must meet
complexity requirements| is selected. " ( cf
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Windows_Sync-Configu...
)
I done the installation same as required.
But after a week, I have reconfigured Active Directory and unactivate
the "|Password must meet complexity requirements|" attribute.
Windows Sync continue to work without problem : new very simple password
(for example, password identical to login) are synchronized between AD
and FDS.
Why the Admin Guide says this attribute is mandatory ? The facts show
that it is not !
Is it a bug ?
The |complexity requirements are too much complicated for my users (and
are no configurable), i must unactivate it.|
Regards
--
* Hugo Étiévant *
15 years, 5 months
[Fedora-directory-users] Recover directory database files when disk fills up!
by Howard Wilkinson
We had the disk with the directory database files fill up overnight, a
rogue process :-[
Now the directory server will not start I get the following reported in
the system logs.
Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error invalid
parameter supplied
Jul 29 09:44:50 bastion ns-slapd: sql_select option missing
Jul 29 09:44:50 bastion ns-slapd: auxpropfunc error no mechanism
available
What can I do to recover the database so that I can start the server?
15 years, 5 months
[Fedora-directory-users] Personal Address book In FDS
by stupid stupid
Hello,
I am new to FDS and LDAP world. I have installed FDS on a server and would
like to use it for Address book lookup.
The address book look up is working from different mail clients,
but I wanted to know how to allow users to add their own Personal Address
book entries to the Fedora DS.
Please help.
Thanks
15 years, 5 months
[Fedora-directory-users] ACI deny matching with macros
by John A. Sullivan III
Hello, all. This post is a follow up to an IRC chat with Rich Megginson
and others.
Rich, I did not report the problem as a bug because upon several more
hours of testing, it does not appear to be a conflict between userdn and
roledn permissions. Rather, it appears to be a wildcard globbing issue.
To bring the everyone else up to speed, in a multi-tenant environment,
we have an allow ACI to permit clients to administer their own portion
of the tree. However, their portions of the tree also contain some
system type accounts used to by the host to enable certain client
functions. These should not be viewable by the client admins so there
is an ACI to deny access to these. We also want to use macros to create
a single ACI at the root which will apply to all clients rather than
creating ACIs for each client.
To grant client access, we create a role at the top of their tree named
ldapadmins and assign it to the appropriate client admins. We create a
root level ACI as follows:
(targetattr = "*") (target = "ldap:///($dn),dc=ssiservices, dc=biz")
(version 3.0;acl "Client Administrators";allow (all)(roledn =
"ldap:///cn=ldapadmins,[$dn],dc=ssiservices,dc=biz");)
It works fine. The tree looks something like this:
root
/com
/client1
/Users
/Internal
/Contacts
/SysAccounts
No one would have access to SysAccounts except client ldapadmins from
the above ACI. We don't want that so we create the following ACI to
deny access to SysAccounts:
(targetattr = "*") (target =
"ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl
"Protect sysaccounts";deny (all)(userdn =
"ldap:///uid=*,ou=users,[$dn],dc=ssiservices,dc=biz");)
We had contemplated
(targetattr = "*") (target =
"ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl
"Protect sysaccounts";deny (all)(userdn =
"ldap:///uid=*[$dn],dc=ssiservices,dc=biz");)
but did not want to take the chance that the SysAccounts uses could not
see themselves.
Let's say we have a client admin at
uid=terry,ou=internal,ou=users,dc=client1,dc=com,dc=ssiservices,dc=biz.
The * after uid and with no comma before ou=users should match anything
in users including "uid=terry,ou=internal,". It doesn't. The deny rule
is not applied to Terry.
If I change the ACI to:
(targetattr = "*") (target =
"ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl
"Protect sysaccounts";deny (all)(userdn =
"ldap:///uid=*ou=internal,ou=users,[$dn],dc=ssiservices,dc=biz");)
it still fails. However, if I change it to:
(targetattr = "*") (target =
"ldap:///ou=sysaccounts,($dn),dc=ssiservices,dc=biz") (version 3.0;acl
"Protect sysaccounts";deny (all)(userdn =
"ldap:///uid=*,ou=internal,ou=users,[$dn],dc=ssiservices,dc=biz");)
it works. The deny matches Terry and is enforced. This seems to be an
explicit contradiction of the documentation.
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Managing_Access_Cont...
userdn = "ldap:///uid=*,dc=example,dc=com";
The bind rule is evaluated to be true if the user binds to the directory
using any distinguished name of the specified pattern. For example, both
of the following bind DNs would be evaluated to be true:
uid=ssarette,dc=example,dc=com
uid=tjaz,ou=Accounting,dc=example,dc=com
Are we doing something wrong or is this just a mismatch between code and
docs? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
15 years, 5 months
[Fedora-directory-users] DSGW user authorization problem
by Lev Dudko
Dear Directory server experts,
could you help me, please, to solve the problem with DSGW
authorization.
I have successfully setup FDS on Fedora 9 with
setup-ds-admin.pl
setup ssl with the help of script from this page:
http://www.linuxmail.info/fedora-directory-server-setup-howto-centos-5/
and run setup-ds-dsgw
Now, the directory server works, administration server works and
I can configure everything in DS and Admin server with console
fedora-idm-console -a https://localhost:9830
ldap and ldaps ports are open and accept requests.
I can point my browser to https://localhost:9830 and use DSGW to
search successfully,
but I can not do authorization, when I try to authorize as some user
(normal user, Directory Manager or admin) I got the error:
Authentication Failed
Authentication failed because the password you supplied is incorrect.
Please click the Retry button and try again. If you have forgotten the
password for this entry, a directory administrator must reset the
password for you.
Of course, I am sure that the password is correct. There are no so much
useful information in the log files. The
executable /usr/lib64/dirsrv/dsgw-cgi-bin/doauth do this authorization.
I have read available documentation rather careful, but did not find the
answer. Looks like one of the solution is to use binddnfile directive
with special text file, but it looks strange for me that it is
impossible to use normal authorization in LDAP with DSGW.
Have I missed something during the configuration or forgot to add some
special ACL?
Lev
15 years, 5 months
[Fedora-directory-users] Error generating certificate-signing request
by Christopher Waltham
I'm having trouble generating a CSR on a pair of new DS 1.1.3 installs.
I get this error message:
"An error has occured.
Unable to convert DN to certificate name.
-----BEGIN NEW CERTIFICATE REQUEST-----"
"
(There is actually nothing listed under the "BEGIN NEW CERTIFICATE
REQUEST" part).
This is my DN of the request: CN="falls", OU="Information
Technology",O="Bowdoin College",L="Brunswick",ST="Maine",C="US".
I found this thread: http://www.linux-archive.org/fedora-directory/160707-error-creating-certi...
online and tried the suggestion, i.e. removing the " quotes in the
DN. After that, the request was generated successfully -- however, I
don't think that this is good behavior.. has anyone seen this issue
before?
Chris
15 years, 5 months
[Fedora-directory-users] "Server failed to start !!!" when installing FDS 1.1.3 in RHEL5.2
by Christopher Waltham
I'm using RHEL5.2 (i386) and installing RPMs from the FDS repository
that's mentioned on the FDS wiki. But I'm having trouble configuring
FDS 1.1.3 due to errors that I believe are related to permissions on /
var/run/dirsrv.
Before installing DS, here are the permission on /var/run/dirsrv:
[root@falls ~]# ls -ald /var/run/dirsrv
drwxr-xr-x 3 root root 4096 Nov 14 09:24 /var/run/dirsrv
When finishing the end of setup-ds-admin.pl, I see these messages:
Are you ready to set up your servers? [yes]:
Creating directory server . . .
Server failed to start !!! Please check errors log for problems
Possible timeout starting server: timeout=1226673415 now=1226673416
Could not start the directory server using command '/usr/lib/dirsrv/
slapd-falls/start-slapd'. The last line from the error log was '[14/
Nov/2008:09:26:55 -0500] - Fedora-Directory/1.1.3 B2008.269.157
starting up
'. Error: Unknown error 256
Error: Could not create directory server instance 'falls'.
Exiting . . .
Log file is '/tmp/setupblsNWZ.log'
There is nothing else of relevance in either /tmp/setupblsNWZ.log or /
var/log/dirsrv/slapd-falls/errors
If I try and start the directory server after the installation failed,
I get this error:
[root@falls ~]# /etc/init.d/dirsrv start
Starting dirsrv:
falls... [FAILED]
*** Warning: 1 instance(s) failed to start
If I manually chmod & chown the /var/run/dirsrv directory, it will
start:
[root@falls ~]# chmod 770 /var/run/dirsrv && chown nobody:nobody /var/
run/dirsrv
[root@falls ~]# /etc/init.d/dirsrv start
Starting dirsrv:
falls... [ OK ]
However, because the setup-ds-admin.pl process never completed, the
admin server hasn't been configured (and I don't want to have to do
that by hand). Note that I am using nobody:nobody in the FDS installer
when asked who I want to run the services as.
When I manually ( chmod 770 /var/run/dirsrv && chown nobody:nobody /
var/run/dirsrv ) *before* I run setup-ds-admin.pl I get this error:
[08/11/14:09:00:33] - [Setup] Info Are you ready to set up your servers?
[08/11/14:09:00:34] - [Setup] Info yes
[08/11/14:09:00:34] - [Setup] Info Creating directory server . . .
[08/11/14:09:00:36] - [Setup] Info Your new DS instance 'ldap' was
successfully created.
[08/11/14:09:00:36] - [Setup] Info Creating the configuration
directory server . . .
[08/11/14:09:00:36] - [Setup] Fatal The suffix 'o=NetscapeRoot'
already exists. Config entry DN 'cn="o=NetscapeRoot",cn=mapping
tree,cn=config'.
[08/11/14:09:00:36] - [Setup] Fatal Failed to create the configuration
directory server
[08/11/14:09:00:36] - [Setup] Fatal Exiting . . .
Any thoughts? This is getting pretty frustrating :-\
Thanks,
Chris
15 years, 5 months