Problem browsing LDAP with Outlook
by Chris Bryant
When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS.
When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well.
I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also.
Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration.
Thanks,
Chris
USA.NET
You Run Your Business. We'll Run Your Email.
This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.
3 years, 3 months
memberOf task problem
by John A. Sullivan III
Hello, all. We are in the process of upgrading from 8.0 to 8.1. We've
hit a few glitches along the way but most has gone well. However, we
wanted to implement the new memberOf functionality. We successfully
added the plugin by editing dse.ldif and enabled it from the console.
However, we've been unsuccessful in having existing group membership
assigned to the memberOf attribute.
We first tried to run fixup-memberOf.pl but the script does not exist.
There is a template.fixup-memberOf.pl but this does not seem to have
been built into a final script.
We then thought we would use the new task feature of the console. We
went to cn=memberof task,cn=tasks,cn=config and tried to create the task
object. There was no nsDirectoryServerTask objectclass. We added an
nstask but then found there was no basedn attribute we could add. We
then created an extensibleobject instead but still not basedn attribute.
Finally, we resorted to ldapmodify (we hesitated just because we are not
very familiar with the command line tools). First, we did:
dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
changetype: add
objectclass: top
objectclass: extensibleObject
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
The Internal Organization has several organizations under it (for
various clients) and then user organizational units under those
organizations. Although it generated no errors, it did not seem to
work. Perhaps I just don't know how to test it. However, the following
did not return an memberOf data:
/usr/lib64/mozldap/ldapsearch -b
"ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory
Manager" -w - -h ldap uid=myid memberOf
Doing /usr/lib64/mozldap/ldapsearch -b
"ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory
Manager" -w - -h ldap uid=myid
showed me plenty of attributes but nothing for memberOf
I also tried creating the task with a basedn of
ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz in case it did not
change objects lower in the tree. Still no success.
Finally I tried:
dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
changetype: add
objectclass: top
objectclass: nsDirectoryServerTask
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
adding new entry cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
ldap_add: Object class violation
ldap_add: additional info: unknown object class "nsDirectoryServerTask"
And received the expected unknown object class error.
What are we doing wrong? Are these documentation bugs? Are there
application bugs or do we simply not know what we are doing with tasks
and memberOf? How do we get the memberOf information into our existing
user objects? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan(a)opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
13 years, 12 months
Password Policy not working fine
by Allan Hougham
Dears,
I have a problem with my passwords policies, I enabled "Enable fine-grained password policy", I apply this but is not working fine.
I followed the steps of Administration Guide pag 364 -
7.1.1.2. Configuring a Subtree/User Password Policy Using the Console
But it´s not working, i have that setting any more?
Can you help me?
Thanks a lot in advance!
Allan Hougham
_________________________________________________________________
¿Vos ya tenés SMS Messenger en tu celular? Registrate Aquí
http://www.somosmessengersiempre.com
14 years
identifying new entries
by Derek Alexander
Hi,
Does Fedora Directory have an equivalent of Active Directory's 'whenCreated' attribute?
If not, do you know of any standard schema that contain such an attribute?
Reason for asking is that I need to identify new entries to the directory.
I'd considered using the LDAP persistent search extension to receive notification
of new entries but that requires a connection to the directory which is hard to
guarantee always.
I could of course use some other arbitrary attribute to recognise new entries but an
equivalent of 'whenCreated' seems like the cleanest solution.
Thanks,
Derek
Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/secretariat/legal/disclaimer.htm
14 years
want to redo new install
by Alan McKay
Hey folks,
I'm making my first foray into DS on Centos 5.4. I got thinks
installed a couple of weeks ago but now want to start from scratch
again. It is a sandbox system running in a VM, so I can fairly easily
just reload Centos in there. However, it would be even quicker if I
could just remove the RPMs and add them back.
Will that give me a clean slate?
[root@sandbox1 ~]# rpm -qa | grep -i centos-ds
centos-ds-8.1.0-1.el5.centos.2
centos-ds-admin-8.1.0-9.el5.centos.1
centos-ds-base-8.1.0-0.14.el5.centos.2
centos-ds-console-8.1.0-5.el5.centos.2
centos-ds-base-devel-8.1.0-0.14.el5.centos.2
thanks,
-Alan
--
“Don't eat anything you've ever seen advertised on TV”
- Michael Pollan, author of "In Defense of Food"
14 years
Multi master replication - "Invalid syntax" error.
by Daniel
Hi, I need a helping hand from some experienced 389-ds admin.
I have built two LDAPs based on CentOS 5.3 and Fedora directory server.
ldap1 - is the production server which is running a few months. all of
the data are placed there.
ldap2 - is the clean install of CentOS 5.3 and 389-ds, identical to
ldap1, but with no data at all.
My point is to replicate present ldap1 data in to the new ldap2 server.
I went through the documentation here
http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication and
everything seems to be OK
Replication agreements are created, when I display them I get the
following output
replication agreements from ldap1.mydomain.com (389)
->ldap2.mydomain.com (389)
replication agreements from ldap2.mydomain.com (389)
->ldap1.mydomaincom (389)
...but when I perform the ldapsearch for some certain records - ldap2
won't find anything.
So I checked the ldap1 error log and found this
25/Nov/2009:13:08:40 +0100] NSMMReplicationPlugin - agmt_delete: begin
[25/Nov/2009:13:08:48 +0100] NSMMReplicationPlugin -
agmt="cn="Replication to ldap2.mydomain.com"" (ldap2:389): Schema
replication update failed: Invalidsyntax
[25/Nov/2009:13:08:48 +0100] NSMMReplicationPlugin -
agmt="cn="Replication to ldap2.mydomain.com"" (ldap2:389): Warning:
unable to replicate schema: rc=1
[25/Nov/2009:13:08:51 +0100] NSMMReplicationPlugin -
agmt="cn="Replication to ldap2.mydomain.com"" (ldap2:389): Schema
replication update failed: Invalid syntax
[25/Nov/2009:13:08:51 +0100] NSMMReplicationPlugin - Warning: unable to
replicate schema to host ldap2.mydomain.com, port 389. Continuing with
total update session.
[25/Nov/2009:13:08:51 +0100] NSMMReplicationPlugin - Beginning total
update of replica "agmt="cn="Replication to ldap2.mydomain.com""
(ldap2:389)".
[25/Nov/2009:13:08:54 +0100] NSMMReplicationPlugin - Finished total
update of replica "agmt="cn="Replication to ldap2.mydomain.com""
(ldap2:389)". Sent 107 entries.
Can you please explain to me what does it mean "Invalid syntax"?
I googled but no useful information were found.
So if someone knows what to do for solution I would greatly appreciate
the help.
Thank you very much.
~ Daniel.
14 years
Database link problem
by Francesco Fiore
If I set a database link, I 've the error "LDAP server is unwilling to
perform" on 389-console.
I've already checked the ACIs and the bind DN informations.
The version of 389-ds is 1.1.3.
Can you help me?
Thanks
14 years
libpam-passthru-plugin
by Hartmann, Tim
Hi Folks,
I've been looking at upgrading the version of libpam-passthru-plugin.so
that we use, we are using v 1.1.3 from an older version of Fedora
Directory Server on our RHDS 8.0 Install, I noticed that v 1.2.2 is
available in 389 on Fedora 11, and thought it might be useful to upgrade
my version of the Plugin. Are there any Pros/Con's to using a newer
version of the plug in?
Thanks!
Tim
14 years
Schema conversion from OpenLDAP to 389DS
by Mitja Mihelič
Hi!
Is it possible to use references for attributeTypes/objectClasses
definitions in the 389DS schemas ?
Like: schacAttributeType:1 instead of 1.3.6.1.4.1.25178.1.2.1
Of course the OID for schacAttributeType should be defined beforehand.
Please read the text bellow for a better explanation.
I was trying to convert the OpenLDAP SCHAC schema into a 389DS schema by
using the ol2rhds.pl script available on http://directory.fedoraproject.org
The converted file did not exactly want to play ball so it had to be
modified.
The OpenLDAP version of the schema uses references instead of numbers
for OIDs:
* objectIdentifier TERENA 1.3.6.1.4.1.25178
* objectIdentifier schac TERENA:1
* objectIdentifier schacObjectClass schac:1
* objectIdentifier schacAttributeType schac:2
The script that converted the schema did not take the references into
account
so I ended up with attribute names like:
<snip>
attributeTypes: (
schacAttributeType:1
NAME 'schacMotherTongue'
</snip>
When trying to load the schema into the 389DS it complained:
<snip>
[25/Nov/2009:14:48:13 +0100] schemareload - Schema reload task starts
(schema dir: default) ...
[25/Nov/2009:14:48:15 +0100] dse - The entry cn=schema in file
/etc/dirsrv/slapd-import/schema/91schac.ldif is invalid, error code 21
(Invalid syntax) - attribute type schacMotherTongue The OID
"schacMotherTongue:1" must begin and end with a digit, or be
"schacMotherTongue-oid"
[25/Nov/2009:14:48:15 +0100] schema_reload - schema file validation failed
[25/Nov/2009:14:48:15 +0100] schemareload - Schema validation failed.
</snip>
After I manually replaced the references with OIDs it worked. OK, I also
had to modify a couple of attribute syntax definitions :)
Regards,
Mitja
14 years
PosixGroup
by dan kakon
Hello everybody,
I want to create a posixgroup for my useraccount, i created a user with
utility of 389 DS, but when i see my client linux, i not see my group when i
wrote id user. I see just my user and not my group.
Please help me.
Dan
--
Dan Kakon
126, Avenue de Paris
94300 Vincennes
Tel : 0178689468
Port : 0650621292
email :dankakon@dksn.net
kakon.dan(a)gmail.com
Blog DKSN: www.dksn.net
14 years