[Fedora-directory-users] Re: Referrals in RHDS
by Visolve LDAP Group
Hi Tim,
It is possible to configure Referrals (default ,smart and suffix referrals
also).
Referrals Configuration:
dn: cn=config
changetype: modify
replace: nsslapd-referral
nsslapd-referral: ldap://$LdapHost:$PORT2/o=referral.com
Here PORT2 and LdapHost is the port number and hostname of server two to
which the server1 will be referring. This is the configuration of DEFAULT
Referrals
Regards,
R.Gopinath
>> Tim Hartmann wrote:
>>
>>> Hi
>>>
>>> I've got a question on referrals and proxy in RHDS. I'm in mid migration
>>> from OpenLDAP and I ran into this stansa in the slapd.conf of the old
>>> replicas.
>>>
>>> database ldap
>>> suffix "cn=OracleContext,dc=school,dc=edu"
>>> uri ldap://oidnames.sub.school.edu:8010/
>>>
>>> >From what I understand this is a proxy to one of our sister
>>> organizations LDAP servers (Sun Directory Server I think)
>>>
>>> I've been trying to replicate this functionality in my RHDS
>>> installation, and so far i've not been able to. I've tried default
>>> referrals and that doesn't seem to work. I've tried to use smart
>>> referrals, but that doesn't seem to be the right usage for smart
>>> referrals.
>>>
>>> Will RHDS / FDS do LDAP proxying? Is there some other way that I should
>>> set up referrals to allow this sort of functionality to work?
>>>
>>>
>> Referrals might work, if all of your clients are smart enough to know
>> how to follow them.
>>
>> I suggesting Chaining Database (aka Database Links) -
>> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/index.html
>>
>>> Thanks in advance for your help!
>>>
>>> Tim
15 years, 2 months
[Fedora-directory-users] RE: Referrals in RHDS
by gopinath
Hi Tim,
It is possible to configure Referrals (default ,smart and suffix referrals
also).
Referrals Configuration:
dn: cn=config
changetype: modify
replace: nsslapd-referral
nsslapd-referral: ldap://$LdapHost:$PORT2/o=referral.com
Here PORT2 and LdapHost is the port number and hostname of server two to
which the server1 will be referring. This is the configuration of DEFAULT
Referrals
Regards,
R.Gopinath
>> Tim Hartmann wrote:
>>
>>> Hi
>>>
>>> I've got a question on referrals and proxy in RHDS. I'm in mid migration
>>> from OpenLDAP and I ran into this stansa in the slapd.conf of the old
>>> replicas.
>>>
>>> database ldap
>>> suffix "cn=OracleContext,dc=school,dc=edu"
>>> uri ldap://oidnames.sub.school.edu:8010/
>>>
>>> >From what I understand this is a proxy to one of our sister
>>> organizations LDAP servers (Sun Directory Server I think)
>>>
>>> I've been trying to replicate this functionality in my RHDS
>>> installation, and so far i've not been able to. I've tried default
>>> referrals and that doesn't seem to work. I've tried to use smart
>>> referrals, but that doesn't seem to be the right usage for smart
>>> referrals.
>>>
>>> Will RHDS / FDS do LDAP proxying? Is there some other way that I should
>>> set up referrals to allow this sort of functionality to work?
>>>
>>>
>> Referrals might work, if all of your clients are smart enough to know
>> how to follow them.
>>
>> I suggesting Chaining Database (aka Database Links) -
>> http://www.redhat.com/docs/manuals/dir-server/ag/8.0/index.html
>>
>>> Thanks in advance for your help!
>>>
>>> Tim
15 years, 2 months
[Fedora-directory-users] LDAP Proxy in Fedora Directory Server
by Hartmann, Tim
Hi
I've got a question on referrals and proxy in RHDS. I'm in mid migration
from OpenLDAP and I ran into this stansa in the slapd.conf of the old
replicas.
database ldap
suffix "cn=OracleContext,dc=school,dc=edu"
uri ldap://oidnames.sub.school.edu:8010/
>From what I understand this is a proxy to one of our sister
organizations LDAP servers (Sun Directory Server I think)
I've been trying to replicate this functionality in my RHDS
installation, and so far i've not been able to. I've tried default
referrals and that doesn't seem to work. I've tried to use smart
referrals, but that doesn't seem to be the right usage for smart referrals.
Will RHDS / FDS do LDAP proxying? Is there some other way that I should
set up referrals to allow this sort of functionality to work?
Thanks in advance for your help!
Tim
15 years, 2 months
[Fedora-directory-users] Windows Sync (via changelog) only works with front-ends sending uncenctyped passwords
by lambam80@hotmail.com
Hello everybody and a BIG thanks to Rich, and the rest of you, for your kind aid. Can you please help with something else ?
HISTORY-------
We're currently investigating using Windows SYNC but only the password part of the SYNC functionality - no accounts.
My prototype works fine - if I change a password with Windows Cntl+Alt+Del itis propogated to Redhat Directory Server (RHDS). If I change the RHDS password with a simple front end itis propogated to Windows Active-Directory (Netscape console, for example, or a script with userpassword: secret-password ).
I read the following:
Directory Server passwords are synchronized along with other entry attributes because plain-text passwords are retained in the Directory Server changelog.
Source: http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Windows_Sync.html#Wi...
PROBLEM ?---------
I think this only works with RHDS and password changing front-ends that send the password unencrypted.
For example, if I do something like the following with RHDS:
./ldapmodify -P "/root/.mozilla/firefox/acu5w0yl.default/cert8.db" -c -h ${DEST_HOST} -p ${DEST_PORT} -D "${DEST_BIND}" -w $DESTDN_PASSWORD <<EOFdn: uid=${TGI},ou=People,${DEST_SUFFIX}changetype: modifyreplace: userpassworduserpassword: {SHA}v9KDMpMQgX13LuXtmWzmSaIcNGM=EOF
Note: Please note the {SHA} stuff in 'userpassword'.
I cannot see how, using the changelog, RHDS can unencrypt the password from {SHA} so as to re-encode it in unicodePwd for sending to Active-Directory.
unicodePwd: good link http://www.eyrie.org/~eagle/journal/2007-07/010.html
My tests show that it doesn't work: After running the script I cannot login to Windowsusing my account/secret-password.
If however, I change my script to use the password unencrypted (userpassword: secret-password) the propogation works again and I can log into my Windows client.
Q1. Am I correct that it only works with RHDS front-ends that send the password unencrypted ?
Thanks,
_________________________________________________________________
Show them the way! Add maps and directions to your party invites.
http://www.microsoft.com/windows/windowslive/events.aspx
15 years, 2 months
[Fedora-directory-users] Strange: authentication works only in debug mode?!
by Simon Victor
Hello,
i have a strange problem here:
Environment:
Ubuntu Server 8.10,
Fedora Directory 1.1.0 B2009.09.419
(self built, see http://victornet.de/wiki/howto:buildfdsonubuntu).
Now, the server seems to be run as expected:
./ns-slapd -d accesscontrol+connections -D </path/to/config>
./ldapsearch -x -w password -D "cn=Directory Manager" -b
dc=acme,dc=com "(objectclass=*")
gives me results, works correctly. But:
/opt/dirsrv/lib/dirsrv/slapd-<instance>/start-slapd
./ldapsearch -x -w password -D "cn=Directory Manager" -b
dc=acme,dc=com "(objectclass=*")
always dies with "ldap_simple_bind: Invalid credentials".
I'm stuck at this issue about 4 hours and have no ideas anymore. Maybe
somebody can help me with that.
Thanks in advance,
regards,
Simon
Setup: fds
15 years, 2 months
[Fedora-directory-users] Binding to Directory Server with Kerberos Tickets
by Hartmann, Tim
Hi,
I've been configuring our Directory Server implementation to use gss-api
for authentication, and it works great! However I ran into a bit of a
snag and was hoping someone on the list might have a suggestion for a
resolution!
I followed the docs during my configuration and all went well
http://www.redhat.com/docs/manuals/dir-server/ag/8.0/Introduction_to_SASL...
I'm able to bind to our ldap replicas with my TGT when I search the real hostname, however we load balance our replicas behind a Cisco SLB which serves out a second hostname and IP.
I've updated the ldap keytab file to include both the Kerberos principles for the real hostname, and the slb hostname, and am still able to sucessfully bind with Kerberos to the real hostname, but not through the SLB.
I had a similar problem with kerberized ssh a while back, and the solution there was a patch to openssh which allowed Kerberos to use any principle in the keytab file. (the GSSAPIStrictAcceptorCheck flag in ssh provides this) Does FDS have any similar configuration option? Or had anyone run into this sort of issue while trying to bind to ldap via kerberos?
I'd also be willing to load balance the servers useing some other means beside the SLB.
Thanks!!
Tim
15 years, 2 months
[Fedora-directory-users] FDS and Kerberos in Windows Domain
by Seppel
Hi,
I have installed a fds 1.1 on centos.
I would like to use the kerberos authentication feature from my MS
ActiveDirectory Domäin.
I am new with kerberos.
I found a howto but this howto is for Linux Kerberos and not for MS
Kerberos. Does anybody can provide a howto use MS Kerberos for FDS
authentication?
Thanks in advance
seppel
15 years, 2 months
[Fedora-directory-users] Windows Sync and UserprincipalName
by Seppel
Hi,
at the moment I am playing with the windows Sync feature.
I would like to sync users from AD -> FDS.
Is it possible to change the existing mapping?
I would like to use the Userprincipalname in fds?
Thanks for any hint or input
carsten
15 years, 2 months
[Fedora-directory-users] sequence of events
by Christopher Barry
Greetings all,
Trying to wrap my head around how a linux laptop interacts with AD/FDS when these are reachable - and not. Can you all have a look and edit this post as required to bring me up to speed?
A. User is added to AD
B. WinSync pulls changes to FDS over SSL
1a. Newly added user on Linux laptop logs into laptop plugged into domain LAN
1a.1 pam_krb5 acquires TGT from AD
1a.2 nss_ldap acquires authorization/automount and other map data from FDS (SSL?)
2a. User uses TGT to access NetApp to automount their home directory
Domain login completes. Accessing other kerberized services in an SSO mode functions.
====================
1b. User logs into laptop off LAN
1b.1 pam_unix authenticates the user from passwd/group/shadow and he mounts local home directory.
Local login completes.
3b. User vpns into office w/ vpnc.
3b.1 accesses various servers/services with domain username/password resolved from FDS - no kerberos.
Please edit/flesh out as appropriate.
Thanks All,
Christopher
15 years, 2 months