[Fedora-directory-users] Removing attributes from Active Directory on sync
by Jeff Williams
Hello,
I'm trying to create a AD<->FDS sync
Our AD has the following layout:
uid=myuser,Ou=User,OU=CompanyGroup,dc=ourADdomain,dc=com
While our LDAP structure has the following layout:
uid=myuser,ou=people,dc=ldapdomain,dc=com
How can I make sure that the users from the AD ou=user,ou=CompanyGroup,dc=ouraddomain,dc=com are placed in the ou=people,dc=ldapdomain,dc=com container?
I'm not sure how to consistently remove the excessive AD attribute?
Thanks,
Jeff Williams
15 years, 5 months
[Fedora-directory-users] Windows sync: Synchronization of group membership
by Erling Ringen Elvsrud
Hello list,
According to the RHDS Administration Guide in the chapter on
Windows Sync(page 531):
"The membership of groups is synchronized with the constraint that
only those members that are also within the scope of the agreement are
propagated"
(note that I did not read this before the test)
I have tried the following:
In AD I have:
ou=LinuxUsers
ou=LinuxGroups
I have configured two separate synchronization agreements in RHDS, one
that populate ou=People from ou=LinuxUsers in AD and one that
populate ou=Groups from ou=LinuxGroups in AD.
The synchronization works, and after it is complete I use ldapsearch
on ou=Groups in RHDS and ou=LinuxGroups in AD and the
member-attributes is indeed missing on the RHDS side.
So, in order to keep group-membership I need to synchronize the parent ou of
both users and groups. So something like
ou=LinuxUsers,ou=Linux, dc=... and
ou=LinuxGroups, ou=Linux, dc=... must be created in AD, and in the
synchronization agreement I will sync ou=Linux and get both users and groups.
The alternative is to synchronize with the current parrent of
LinuxUsers and LinuxGruops.
Is this correct?
Do you know why this "limitation" exists?
Thanks
Erling
15 years, 5 months
[Fedora-directory-users] Coolkey
by Zach Casper
I'm currently attempting to use the Coolkey applet but we are not Gemalto
users/developers.
Does a version exist in a CAP file versus the IJC built Java Card applet
or
Does a non-Cyberflex dependent src exist? I don't believe that SDK is
available but non-the-less it was still a "for fee" piece.
Where is the true Open Source non-dependent Coolkey solution?
We have already been using MUSCLE and others but I understand Coolkey has
matured from v0.9.1 and current MUSCLE is at v0.9.8
Zach
15 years, 5 months
[Fedora-directory-users] remote connection to console
by Eric
Hi,
there was a fedora ds version 1.0.4. admin had a remote console via an
intermadiate machine using ssh tunnel. fedora-ds folder was destroyed then
I replaced it with a copy of fedora-ds folder from another installation. the
server works well but the admin hasn't remote console.
the ssh file that worked before is:
ssh -L 389:ldap server IP:389 -L 8080:ldap server IP:port of
fedora-ds installation -l admin intermadiate _machine _IP
I only changed the port number of fedora-ds installation with new port
number. shuld I change another thing?
15 years, 5 months
[Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09
Hi together,
I have successfully set up my directory server. For a disaster tolerant
topology I want to load balance the two servers over a F5 LTM load
balancer. My problem is, that I have tried to export the certificate ( I
have a self generated one ) without a result. The load balancer could
only read certificates in pem format. So, if anyone of you know what
type of certificate the DS uses let me know about it ;-)
The certificate was generated with the gencert.sh script which is
available under
http://github.com/richm/scripts/tree/master%2Fsetupssl.sh?raw=true
I don't know very much about the SSL stuff so I am not sure If I have
tried the right tools/commands.
Which one is the certificate the slapd-yourhost-cert8.db or is it only
stored in there?
Thank you in advance!
Cheers
phru
15 years, 5 months
Re: [Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09
I had the same issue exporting my certificate in pkcs12 format to import it to the radius part of my authentification server.
Indeed, there are two certificates in the pkcs12 file for chaining with root certificat, you must specify to write options to extract only the good one (or edit the pem on you own to cut off the bad one).
# certutil -d . -L
# pk12util -d . -o ldap-server.pk12 -n «certificate name »
# pk12util -d /etc/dirsrv/slapd-server/ -i ldap-server.pk12 -n «certificat name»
# openssl pcks12
-clcerts : no client certificate
-cacerts : no CA certificate
I think the option -cacerts will fix your issue as it fixed mine.
In fact, it's a bug with poor implementations of pem file reading (like freeradius does).
Hope it would help.
Regards.
--
Nicolas CAREL
Service Commun Informatique
Chef de service
Tel : 04 72 76 61 43 - e-mail : nicolas carel inrp fr <mailto:nicolas%20carel%20inrp%20fr>
Institut National de Recherche Pédagogique
<http://www.inrp.fr/> 19 allée de Fontenay - B.P. 17424 - 69347 LYON CEDEX 07
Standard : 04 72 76 61 00 - Télécopie : 04 72 76 61 10
Attachment: smime.p7s <https://www.redhat.com/archives/fedora-directory-users/2008-November/p7sg...>
Description: S/MIME Cryptographic Signature
Hi,
Thank you for your help. I am using fedora-ds 1.0.4-1 (RH4).
When I try to run the certutil -d . -L command there is no output or certificate available?! Where is the mistake?
/opt/fedora-ds/alias
/opt/fedora-ds/shared/bin/certutil -d . -L
In the directory /opt/fedora-ds/alias I have the following files:
admin-serv-host-cert8.db
admin-serv-host-key3.db
adminserver.p12
cacert.asc
cert8.db
gencert.sh
key3.db
libnssckbi.so
noise.txt
password.conf
pwdfile.txt
secmod.db
slapd-host-cert8.db
slapd- host -cert8.db.bak
slapd- host -key3.db
slapd- host -key3.db.bak
slapd- host -pin.txt
The secured LDAP connection from a client to the server is working properly, therefore I think the certificates are installed right.
Thank you in advance
Regards
Phru
15 years, 5 months
[Fedora-directory-users] Exporting the Fedora DS certificate
by Rusch Philipp pru09
Hi together,
I have successfully set up my directory server. For a disaster tolerant
topology I want to load balance the two servers over a F5 LTM load
balancer. My problem is, that I have tried to export the certificate ( I
have a self generated one ) without a result. The load balancer could
only read certificates in pem format. So, if anyone of you know what
type of certificate the DS uses let me know about it ;-)
The certificate was generated with the gencert.sh script which is
available under
http://github.com/richm/scripts/tree/master%2Fsetupssl.sh?raw=true
I don't know very much about the SSL stuff so I am not sure If I have
tried the right tools/commands.
Which one is the certificate the slapd-yourhost-cert8.db or is it only
stored in there?
Thank you in advance!
Cheers
phru
15 years, 5 months
[Fedora-directory-users] Discussion about "Configuration DS" & "User DS" settings in Admin Server Console
by Hugo Etievant
hello,
In the general "Configuration" tab of "Administration Server" Console,
what differences between connexion settings in "User DS" and
"Configuration DS" tabs ?
Theses settings are redundant, no ?
"User DS" settings are used by Administration Server to be connected to
the Directory Server configuration database (netscapeRoot).
But what additional information is supplied by "Configuration DS" ???
bye
--
* Hugo Étiévant
***
15 years, 5 months