389-users November 2009

389-users@lists.fedoraproject.org

35 participants
43 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

memberOf task problem
by John A. Sullivan III 18 Dec '09

18 Dec '09

Hello, all. We are in the process of upgrading from 8.0 to 8.1. We've hit a few glitches along the way but most has gone well. However, we wanted to implement the new memberOf functionality. We successfully added the plugin by editing dse.ldif and enabled it from the console. However, we've been unsuccessful in having existing group membership assigned to the memberOf attribute. We first tried to run fixup-memberOf.pl but the script does not exist. There is a template.fixup-memberOf.pl but this does not seem to have been built into a final script. We then thought we would use the new task feature of the console. We went to cn=memberof task,cn=tasks,cn=config and tried to create the task object. There was no nsDirectoryServerTask objectclass. We added an nstask but then found there was no basedn attribute we could add. We then created an extensibleobject instead but still not basedn attribute. Finally, we resorted to ldapmodify (we hesitated just because we are not very familiar with the command line tools). First, we did: dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config changetype: add objectclass: top objectclass: extensibleObject cn: fixMemberOf basedn: o=Internal,dc=ssiservices,dc=biz The Internal Organization has several organizations under it (for various clients) and then user organizational units under those organizations. Although it generated no errors, it did not seem to work. Perhaps I just don't know how to test it. However, the following did not return an memberOf data: /usr/lib64/mozldap/ldapsearch -b "ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory Manager" -w - -h ldap uid=myid memberOf Doing /usr/lib64/mozldap/ldapsearch -b "ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory Manager" -w - -h ldap uid=myid showed me plenty of attributes but nothing for memberOf I also tried creating the task with a basedn of ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz in case it did not change objects lower in the tree. Still no success. Finally I tried: dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config changetype: add objectclass: top objectclass: nsDirectoryServerTask cn: fixMemberOf basedn: o=Internal,dc=ssiservices,dc=biz adding new entry cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config ldap_add: Object class violation ldap_add: additional info: unknown object class "nsDirectoryServerTask" And received the expected unknown object class error. What are we doing wrong? Are these documentation bugs? Are there application bugs or do we simply not know what we are doing with tasks and memberOf? How do we get the memberOf information into our existing user objects? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

5 13

Password Policy not working fine
by Allan Hougham 07 Dec '09

07 Dec '09

Dears, I have a problem with my passwords policies, I enabled "Enable fine-grained password policy", I apply this but is not working fine. I followed the steps of Administration Guide pag 364 - 7.1.1.2. Configuring a Subtree/User Password Policy Using the Console But it´s not working, i have that setting any more? Can you help me? Thanks a lot in advance! Allan Hougham _________________________________________________________________ ¿Vos ya tenés SMS Messenger en tu celular? Registrate Aquí http://www.somosmessengersiempre.com

3 13

identifying new entries
by Derek Alexander 06 Dec '09

06 Dec '09

Hi, Does Fedora Directory have an equivalent of Active Directory's 'whenCreated' attribute? If not, do you know of any standard schema that contain such an attribute? Reason for asking is that I need to identify new entries to the directory. I'd considered using the LDAP persistent search extension to receive notification of new entries but that requires a connection to the directory which is hard to guarantee always. I could of course use some other arbitrary attribute to recognise new entries but an equivalent of 'whenCreated' seems like the cleanest solution. Thanks, Derek Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/secretariat/legal/disclaimer.htm

3 2

want to redo new install
by Alan McKay 01 Dec '09

01 Dec '09

Hey folks, I'm making my first foray into DS on Centos 5.4. I got thinks installed a couple of weeks ago but now want to start from scratch again. It is a sandbox system running in a VM, so I can fairly easily just reload Centos in there. However, it would be even quicker if I could just remove the RPMs and add them back. Will that give me a clean slate? [root@sandbox1 ~]# rpm -qa | grep -i centos-ds centos-ds-8.1.0-1.el5.centos.2 centos-ds-admin-8.1.0-9.el5.centos.1 centos-ds-base-8.1.0-0.14.el5.centos.2 centos-ds-console-8.1.0-5.el5.centos.2 centos-ds-base-devel-8.1.0-0.14.el5.centos.2 thanks, -Alan -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

3 2

Multi master replication - "Invalid syntax" error.
by Daniel 30 Nov '09

30 Nov '09

Hi, I need a helping hand from some experienced 389-ds admin. I have built two LDAPs based on CentOS 5.3 and Fedora directory server. ldap1 - is the production server which is running a few months. all of the data are placed there. ldap2 - is the clean install of CentOS 5.3 and 389-ds, identical to ldap1, but with no data at all. My point is to replicate present ldap1 data in to the new ldap2 server. I went through the documentation here http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication and everything seems to be OK Replication agreements are created, when I display them I get the following output replication agreements from ldap1.mydomain.com (389) ->ldap2.mydomain.com (389) replication agreements from ldap2.mydomain.com (389) ->ldap1.mydomaincom (389) ...but when I perform the ldapsearch for some certain records - ldap2 won't find anything. So I checked the ldap1 error log and found this 25/Nov/2009:13:08:40 +0100] NSMMReplicationPlugin - agmt_delete: begin [25/Nov/2009:13:08:48 +0100] NSMMReplicationPlugin - agmt="cn="Replication to ldap2.mydomain.com"" (ldap2:389): Schema replication update failed: Invalidsyntax [25/Nov/2009:13:08:48 +0100] NSMMReplicationPlugin - agmt="cn="Replication to ldap2.mydomain.com"" (ldap2:389): Warning: unable to replicate schema: rc=1 [25/Nov/2009:13:08:51 +0100] NSMMReplicationPlugin - agmt="cn="Replication to ldap2.mydomain.com"" (ldap2:389): Schema replication update failed: Invalid syntax [25/Nov/2009:13:08:51 +0100] NSMMReplicationPlugin - Warning: unable to replicate schema to host ldap2.mydomain.com, port 389. Continuing with total update session. [25/Nov/2009:13:08:51 +0100] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn="Replication to ldap2.mydomain.com"" (ldap2:389)". [25/Nov/2009:13:08:54 +0100] NSMMReplicationPlugin - Finished total update of replica "agmt="cn="Replication to ldap2.mydomain.com"" (ldap2:389)". Sent 107 entries. Can you please explain to me what does it mean "Invalid syntax"? I googled but no useful information were found. So if someone knows what to do for solution I would greatly appreciate the help. Thank you very much. ~ Daniel.

2 5

Database link problem
by Francesco Fiore 30 Nov '09

30 Nov '09

If I set a database link, I 've the error "LDAP server is unwilling to perform" on 389-console. I've already checked the ACIs and the bind DN informations. The version of 389-ds is 1.1.3. Can you help me? Thanks

2 1

libpam-passthru-plugin
by Hartmann, Tim 30 Nov '09

30 Nov '09

Hi Folks, I've been looking at upgrading the version of libpam-passthru-plugin.so that we use, we are using v 1.1.3 from an older version of Fedora Directory Server on our RHDS 8.0 Install, I noticed that v 1.2.2 is available in 389 on Fedora 11, and thought it might be useful to upgrade my version of the Plugin. Are there any Pros/Con's to using a newer version of the plug in? Thanks! Tim

2 5

Schema conversion from OpenLDAP to 389DS
by Mitja Mihelič 25 Nov '09

25 Nov '09

Hi! Is it possible to use references for attributeTypes/objectClasses definitions in the 389DS schemas ? Like: schacAttributeType:1 instead of 1.3.6.1.4.1.25178.1.2.1 Of course the OID for schacAttributeType should be defined beforehand. Please read the text bellow for a better explanation. I was trying to convert the OpenLDAP SCHAC schema into a 389DS schema by using the ol2rhds.pl script available on http://directory.fedoraproject.org The converted file did not exactly want to play ball so it had to be modified. The OpenLDAP version of the schema uses references instead of numbers for OIDs: * objectIdentifier TERENA 1.3.6.1.4.1.25178 * objectIdentifier schac TERENA:1 * objectIdentifier schacObjectClass schac:1 * objectIdentifier schacAttributeType schac:2 The script that converted the schema did not take the references into account so I ended up with attribute names like: <snip> attributeTypes: ( schacAttributeType:1 NAME 'schacMotherTongue' </snip> When trying to load the schema into the 389DS it complained: <snip> [25/Nov/2009:14:48:13 +0100] schemareload - Schema reload task starts (schema dir: default) ... [25/Nov/2009:14:48:15 +0100] dse - The entry cn=schema in file /etc/dirsrv/slapd-import/schema/91schac.ldif is invalid, error code 21 (Invalid syntax) - attribute type schacMotherTongue The OID "schacMotherTongue:1" must begin and end with a digit, or be "schacMotherTongue-oid" [25/Nov/2009:14:48:15 +0100] schema_reload - schema file validation failed [25/Nov/2009:14:48:15 +0100] schemareload - Schema validation failed. </snip> After I manually replaced the references with OIDs it worked. OK, I also had to modify a couple of attribute syntax definitions :) Regards, Mitja

2 1

PosixGroup
by dan kakon 25 Nov '09

25 Nov '09

Hello everybody, I want to create a posixgroup for my useraccount, i created a user with utility of 389 DS, but when i see my client linux, i not see my group when i wrote id user. I see just my user and not my group. Please help me. Dan -- Dan Kakon 126, Avenue de Paris 94300 Vincennes Tel : 0178689468 Port : 0650621292 email :dankakon@dksn.net kakon.dan(a)gmail.com Blog DKSN: www.dksn.net

3 7

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users November 2009