[Fedora-directory-users] Re: fedora ds problem with updating centos
by Andy Schofield
I have exactly the same error:
> ldap...[19/Apr/2009:06:46:14 -0400] - Unable to access
nsslapd-rundir: > Bad address
In my case this is nothing to do with the upgrade to CentOS 5.3 (which
went smoothly). Instead it is when I upgrade to fedora-ds-base-1.2.0
from fedora-ds-base-1.1.3-2. It does not seem to make any difference
what the permissions are on the /var/run/dirsrv directory. To show this
I have made the directory world writable and I still get the error.
At the moment the permissions are: ls -ld /var/run/dirsrv
drwxrwxrwx 2 ldap root 4096 Apr 20 18:09 /var/run/dirsrv
Previously it was 750
Any other ideas?
Andy
PS I am running a production system so I have had to revert to 1.1.3
until this is fixed.
15 years
RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda
> Michal Rejda wrote:
> >> Michal Rejda wrote:
> >>
> >>>> Michal Rejda wrote:
> >>>>
> >>>>
> >>>>>> -----Original Message-----
> >>>>>> From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-
> >>>>>> directory-users-bounces(a)redhat.com] On Behalf Of Rich Megginson
> >>>>>> Sent: Tuesday, April 14, 2009 4:25 PM
> >>>>>> To: General discussion list for the Fedora Directory server
> >>>>>>
> >> project.
> >>
> >>>>>> Subject: Re: [Fedora-directory-users] LDAP proxy
> >>>>>>
> >>>>>> Michal Rejda wrote:
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> I tried to use http://tinyurl.com/culeft. But the database link
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>> doesn't work. I setup the database link to the Active Directory
> >>>>>>
> >> (and
> >>
> >>>>>> OpenLDAP). When I looked into Wireshark log, FDS send search
> >>>>>>
> >> request
> >>
> >>>>>> with controls:
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> 2.16.840.1.113730.3.4.2
> >>>>>>> 2.16.840.1.113730.3.4.12
> >>>>>>> And the AD server responded: Unavailable Critical Extension.
> >>>>>>>
> >>>>>>> I tried to remove this two controls from Database Link Settings
> >>>>>>>
> >> (in
> >>
> >>>>>>>
> >>>>>> administration console) but it didn't help. The server didn't
> >>>>>>
> >> return
> >>
> >>>>>> the message above, but the administrative console show error
> >>>>>>
> >> dialog.
> >>
> >>>>>> What error?
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>> I tried it again and the error message is exactly:
> >>>>>
> >>>>> Error fading object 'dn: dc=example, dc=com'.
> >>>>> The error send by the server was:
> >>>>> ".
> >>>>>
> >>>>> In the Whireshark log was still the search request witch control:
> >>>>> 2.16.840.1.113730.3.4.2
> >>>>>
> >>>>> Why is this control needed by the server when I removed it from
> >>>>>
> >>>>>
> >>>> Database link settings?
> >>>>
> >>>> I'm not sure - maybe the console is not working correctly. Try
> this:
> >>>> 1) Shutdown the server
> >>>> 2) cd /etc/dirsrv/slapd-yourinstance
> >>>> 3) edit dse.ldif - look for the entry
> >>>> dn: cn=config,cn=chaining database,cn=plugins,cn=config
> >>>> 4) edit the nsTransmittedControls attribute - remove
> >>>> 2.16.840.1.113730.3.4.2
> >>>> 5) save and restart the server
> >>>>
> >>>>
> >>> I looked into dse.ldif for a nsTransmittedControls attribute. There
> >>>
> >> is only the 1.3.6.1.4.1.1466.29539.12. , not the problematic
> >> 2.16.840.1.113730.3.4.2.
> >>
> >>> Isn't the 2.16.840.1.113730.3.4.2 hardcoded?
> >>>
> >> If it is, I don't see it. There is no mention of managedsa or
> >> 2.16.840.1.113730.3.4.2 anywhere in the chaining backend code. The
> >> only place it is mentioned is in the default list of
> >> nsTransmittedControls in the template-dse.ldif used during new
> >> instance creation.
> >>
> >>> Why is this so necessary?
> >>>
> >>>
> >> It's not necessary, and I'm not sure where it is coming from. Once
> >> place might be an internal operation, but I'm not sure what internal
> >> operation would be doing this. You might also try to remove
> >> nsActiveChainingComponents and nsPossibleChainingComponents to see
> if
> >> one of those components is doing an internal operation with
> >> managedsait set.
> >>
> >
> > I removed nsActiveChainingComponents and nsPossibleChainingComponents
> and it didn't help.
> >
> Then I'm not sure where it's coming from. I suppose you could enable
> tracing in the directory server and see if there is anything
> interesting in the error log - see
> http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting
In the attachment is the part of the server error log. I removed all messages before I click on the exclamation mark before the DN in the Fedora administration console -> Directory folder tab. I don't understand this log. It is helpful for you?
> >
> >>>>>>>> Michal Rejda wrote:
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>> Hi all,
> >>>>>>>>>
> >>>>>>>>> Im trying to setup proxy on FDS to another LDAP server
> >>>>>>>>>
> >> (OpenLDAP
> >>
> >>>>>>>>> and Active Directory). I tried two ways, but none of these
> >>>>>>>>>
> >> works:
> >>
> >>>>>>>>> 1) New database link to LDAP server.
> >>>>>>>>>
> >>>>>>>>> - The remote LDAP server (OpenLDAP) returns: null.
> manageDSAit
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>> control
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>> value not found
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>> You might have to tweak the controls used by chaining - see
> >>>>>>>> http://tinyurl.com/culeft
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>> 2) Create multiple-master replication and setup other server
> >>>>>>>>> as
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>> consumer.
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>> - But this show error: 255 Replication error acquiring
> replica:
> >>>>>>>>> unknown error.
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>> Replication will only work to a SunDS, not to any other
> vendor.
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>> My question is: Is there way how to setup proxy to access
> >>>>>>>>>
> >> another
> >>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>> LDAP
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>> server from Fedora DS? I know that is possible to use AD
> sync,
> >>>>>>>>>
> >>>>>>>>>
> >>>> but
> >>>>
> >>>>
> >>>>>> I
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>>> cannot install anything on the AD server. The second reason
> >>>>>>>>> why
> >>>>>>>>>
> >> I
> >>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>> need
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>> to setup proxy is to use data stored in LDAP server
> (OpenLDAP,
> >>>>>>>>> Open Direcoty Server and Active Directory) in one place. I
> >>>>>>>>> need
> >>>>>>>>>
> >>>>>>>>>
> >>>> to
> >>>>
> >>>>
> >>>>>> update
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>>>> them too. It is not necessary to synchronize passwords.
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>> See also
> >>>>>>>>
> >>>>>>>>
> >> http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration
> >>
> >>>>>>>>
> >>>>>>>>
> >>>>>>>>> Thank you for reply.
> >>>>>>>>>
> >>>>>>>>> Regards,
> >>>>>>>>>
> >>>>>>>>> Michal
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>>>>>>>
> >>>
> >>> --
> >>> Fedora-directory-users mailing list
> >>> Fedora-directory-users(a)redhat.com
> >>> https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >>>
> >>>
> >
> >
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
>
15 years
[Fedora-directory-users] fedora ds problem with updating centos
by Eric
Hi all,
I had fedora-ds-1.1.3-1.fc6 installed on centos 5. I have updated centos to
5.3. now fedora ds cann't be start. when I use: service dirsrv start there
is this error:
ldap...[19/Apr/2009:06:46:14 -0400] - Unable to access nsslapd-rundir: Bad
address
[19/Apr/2009:06:46:14 -0400] - Ensure that user "ldap" has read and write
permissions on (null)
[19/Apr/2009:06:46:14 -0400] - Shutting down.
[FAILED]
15 years
[Fedora-directory-users] atomically delete subtree (non leaf)
by Roberto Polli
hi all,
usually ldap isn't able to atomically delete a subtree (non-leaf). This is
annoying while cleaning eg. an user addressbook of thousands of contacts.
Can fedora directory server manage in some way this kind of deletion
atomically?
If not, do you think it's an interesting feature?
Peace, R.
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
15 years
[Fedora-directory-users] Trouble starting 1.2.0 on debian lenny.
by Ryan Braun [ADS]
I just got finished building some lenny packages for fds 1.2.0 and I am having
some issues getting the DS running properly. Using my buildscripts (which
create a working 1.2.0 and 1.1.3 for etch, incrementing lenny package names
as required), the build works, but when I try to create an instance, I get
an error about Netscape Portable Runtime failing to load a library.
lenny:/opt/dirsrv/sbin# ./setup-ds.pl
==============================================================================
This program will set up the Fedora Directory Server.
SNIP
Directory Manager DN [cn=Directory Manager]:
Password:
Password (confirm):
Could not import LDIF file '/tmp/ldifUjjWfx.ldif'. Error: 256. Output:
importing data ...
[14/Apr/2009:12:58:17 -0400] - SSL alert: Security Initialization: NSS
initialization failed (Netscape Portable Runtime error -5977 - Failure to load
dynamic library.): certdir: /etc/dirsrv/slapd-lenny
[14/Apr/2009:12:58:17 -0400] - ERROR: NSS Initialization Failed.
Error: Could not create directory server instance 'lenny'.
Exiting . . .
Log file is '/tmp/setupuyjm1M.log'
I first noticed an issue when building mozldap, this came up
gcc -shared -Wl,-soname -Wl,libssldap60.so -o libssldap60.so
./clientinit.o ./ldapsinit.o ./errormap.o -L../../../../../dist/lib -lldap60
-lprldap60 -L/usr/lib/ -lssl3 -lnss3 -lsoftokn3 -L/usr/lib/ -lplc4 -lplds4 -
lnspr4
/usr/bin/ld: cannot find -lsoftokn3
Which led my to find out lenny libnss3-1d has libsofttokn3.so in /usr/lib/nss
and not /usr/lib. So I added a symlink to /usr/lib. After that mozldap and
everything built ok. But now I'm wondering if I need some kind of special --
with-nss-lib statements in my ./configure's.
lenny:~/fdsbuildscripts/mozldap# dpkg -L libnss3-1d
/usr
/usr/lib
/usr/lib/nss
/usr/lib/nss/libfreebl3.so
/usr/lib/nss/libsoftokn3.so
/usr/lib/nss/libnssdbm3.so
/usr/lib/nss/libnssckbi.so
/usr/lib/nss/libsoftokn3.chk
/usr/lib/nss/libfreebl3.chk
/usr/lib/libnss3.so.1d
/usr/lib/libnssutil3.so.1d
/usr/lib/libsmime3.so.1d
/usr/lib/libssl3.so.1d
/usr/share
/usr/share/doc
/usr/share/doc/libnss3-1d
/usr/share/doc/libnss3-1d/copyright
/usr/share/doc/libnss3-1d/changelog.Debian.gz
/usr/lib/libssl3.so
/usr/lib/libsmime3.so
/usr/lib/libnssutil3.so
/usr/lib/libnss3.so
vs etch
/usr
/usr/share
/usr/share/doc
/usr/share/doc/libnss3-0d
/usr/share/doc/libnss3-0d/copyright
/usr/share/doc/libnss3-0d/changelog.Debian.gz
/usr/share/doc/libnss3-0d/MPL.gz
/usr/lib
/usr/lib/libnss3.so.0d
/usr/lib/libsmime3.so.0d
/usr/lib/libsoftokn3.so.0d
/usr/lib/libssl3.so.0d
/usr/lib/xulrunner
/usr/lib/xulrunner/libfreebl3.so
/usr/lib/xulrunner/libnssckbi.so
/usr/lib/xulrunner/libfreebl3.chk
/usr/lib/libsoftokn3.0d.chk
Here are my ./configure options when building mozldap and fedora-ds-base
mozldap
./configure --prefix=/ \
--libdir=/usr/lib/ \
--includedir=/usr/include/mozldap \
--oldincludedir=/usr/include/mozldap \
--sysconfdir=/usr/share/mozldap/etc/ \
--bindir=/usr/lib/mozldap/ \
--enable-clu \
--with-nss-inc=/usr/include/nss/ \
--with-nss-lib=/usr/lib/ \
--with-nspr-inc=/usr/include/nspr/ \
--with-nspr-lib=/usr/lib/ \
--with-svrcore-inc=/usr/include \
--with-svrcore-lib=/usr/lib \
--with-sasl
fedora-ds-base
CPPFLAGS=-DNETSNMP_USE_INLINE=1 ./configure \
--prefix=/opt/dirsrv \
--enable-bundle \
--localstatedir=/var \
--sysconfdir=/etc \
--datadir=/usr/share \
--with-svrcore-inc=/usr/include \
--with-svrcore-lib=/usr/lib \
--with-ldapsdk-inc=/usr/include/mozldap/ \
--with-ldapsdk-lib=/usr/lib/ \
--with-ldapsdk-bin=/usr/lib/mozldap \
--with-nss-inc=/usr/include/nss/ \
--with-nss-lib=/usr/lib/ \
--with-nspr-inc=/usr/include/nspr/ \
--with-nspr-lib=/usr/lib/ \
--with-icu-inc=/usr/include/unicode \
--with-icu-lib=/usr/lib \
--with-icu-bin=/usr/bin \
--with-sasl \
--with-net-snmp \
--with-kerberos
Thanks
Ryan
15 years
RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda
> Michal Rejda wrote:
> >> Michal Rejda wrote:
> >>
> >>>> -----Original Message-----
> >>>> From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-
> >>>> directory-users-bounces(a)redhat.com] On Behalf Of Rich Megginson
> >>>> Sent: Tuesday, April 14, 2009 4:25 PM
> >>>> To: General discussion list for the Fedora Directory server
> project.
> >>>> Subject: Re: [Fedora-directory-users] LDAP proxy
> >>>>
> >>>> Michal Rejda wrote:
> >>>>
> >>>>
> >>>>> I tried to use http://tinyurl.com/culeft. But the database link
> >>>>>
> >>>>>
> >>>> doesn't work. I setup the database link to the Active Directory
> (and
> >>>> OpenLDAP). When I looked into Wireshark log, FDS send search
> request
> >>>> with controls:
> >>>>
> >>>>
> >>>>> 2.16.840.1.113730.3.4.2
> >>>>> 2.16.840.1.113730.3.4.12
> >>>>> And the AD server responded: Unavailable Critical Extension.
> >>>>>
> >>>>> I tried to remove this two controls from Database Link Settings
> (in
> >>>>>
> >>>>>
> >>>> administration console) but it didn't help. The server didn't
> return
> >>>> the message above, but the administrative console show error
> dialog.
> >>>>
> >>>> What error?
> >>>>
> >>>>
> >>> I tried it again and the error message is exactly:
> >>>
> >>> Error fading object 'dn: dc=example, dc=com'.
> >>> The error send by the server was:
> >>> ".
> >>>
> >>> In the Whireshark log was still the search request witch control:
> >>> 2.16.840.1.113730.3.4.2
> >>>
> >>> Why is this control needed by the server when I removed it from
> >>>
> >> Database link settings?
> >>
> >> I'm not sure - maybe the console is not working correctly. Try this:
> >> 1) Shutdown the server
> >> 2) cd /etc/dirsrv/slapd-yourinstance
> >> 3) edit dse.ldif - look for the entry
> >> dn: cn=config,cn=chaining database,cn=plugins,cn=config
> >> 4) edit the nsTransmittedControls attribute - remove
> >> 2.16.840.1.113730.3.4.2
> >> 5) save and restart the server
> >>
> >
> > I looked into dse.ldif for a nsTransmittedControls attribute. There
> is only the 1.3.6.1.4.1.1466.29539.12. , not the problematic
> 2.16.840.1.113730.3.4.2.
> > Isn't the 2.16.840.1.113730.3.4.2 hardcoded?
> If it is, I don't see it. There is no mention of managedsa or
> 2.16.840.1.113730.3.4.2 anywhere in the chaining backend code. The only
> place it is mentioned is in the default list of nsTransmittedControls
> in
> the template-dse.ldif used during new instance creation.
> > Why is this so necessary?
> >
> It's not necessary, and I'm not sure where it is coming from. Once
> place
> might be an internal operation, but I'm not sure what internal
> operation
> would be doing this. You might also try to remove
> nsActiveChainingComponents and nsPossibleChainingComponents to see if
> one of those components is doing an internal operation with managedsait
> set.
I removed nsActiveChainingComponents and nsPossibleChainingComponents and it didn't help.
> >
> >>>>>> Michal Rejda wrote:
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> Hi all,
> >>>>>>>
> >>>>>>> Im trying to setup proxy on FDS to another LDAP server
> (OpenLDAP
> >>>>>>> and Active Directory). I tried two ways, but none of these
> works:
> >>>>>>>
> >>>>>>> 1) New database link to LDAP server.
> >>>>>>>
> >>>>>>> - The remote LDAP server (OpenLDAP) returns: null. manageDSAit
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>> control
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> value not found
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>> You might have to tweak the controls used by chaining - see
> >>>>>> http://tinyurl.com/culeft
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> 2) Create multiple-master replication and setup other server as
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>> consumer.
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> - But this show error: 255 Replication error acquiring replica:
> >>>>>>> unknown error.
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>> Replication will only work to a SunDS, not to any other vendor.
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> My question is: Is there way how to setup proxy to access
> another
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>> LDAP
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> server from Fedora DS? I know that is possible to use AD sync,
> >>>>>>>
> >> but
> >>
> >>>> I
> >>>>
> >>>>
> >>>>>>> cannot install anything on the AD server. The second reason why
> I
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>> need
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> to setup proxy is to use data stored in LDAP server (OpenLDAP,
> >>>>>>> Open Direcoty Server and Active Directory) in one place. I need
> >>>>>>>
> >> to
> >>
> >>>> update
> >>>>
> >>>>
> >>>>>>> them too. It is not necessary to synchronize passwords.
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>> See also
> >>>>>>
> http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>>> Thank you for reply.
> >>>>>>>
> >>>>>>> Regards,
> >>>>>>>
> >>>>>>> Michal
> >>>>>>>
> >>>>>>>
> >>>>>>>
> >
> >
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
>
15 years
[Fedora-directory-users] Samba 3 + FDS
by Juan Pablo Lorier
Hi there.
I'm installing samba 3 + Centos Directory Server on a Centos 5 server.
I've followed the fds samba howto but when I get to the line where it
uses pdbedit, there's nothing listed by pdbedit.
I checked pdbedit -L and nothing comes back.
As I'm new to fds (and ldap) I don't know what can be wrong.
how can I check if samba is able to work with fds authentication? I
suspect that samba is not accesing fds and so it can't see the
administrator entry.
Regards,
JPL
--
Este mensaje ha sido analizado por MailScanner
en busca de virus y otros contenidos peligrosos,
y se considera que está limpio.
15 years
RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda
> Michal Rejda wrote:
> >
> >> -----Original Message-----
> >> From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-
> >> directory-users-bounces(a)redhat.com] On Behalf Of Rich Megginson
> >> Sent: Tuesday, April 14, 2009 4:25 PM
> >> To: General discussion list for the Fedora Directory server project.
> >> Subject: Re: [Fedora-directory-users] LDAP proxy
> >>
> >> Michal Rejda wrote:
> >>
> >>> I tried to use http://tinyurl.com/culeft. But the database link
> >>>
> >> doesn't work. I setup the database link to the Active Directory (and
> >> OpenLDAP). When I looked into Wireshark log, FDS send search request
> >> with controls:
> >>
> >>> 2.16.840.1.113730.3.4.2
> >>> 2.16.840.1.113730.3.4.12
> >>> And the AD server responded: Unavailable Critical Extension.
> >>>
> >>> I tried to remove this two controls from Database Link Settings (in
> >>>
> >> administration console) but it didn't help. The server didn't return
> >> the message above, but the administrative console show error dialog.
> >>
> >> What error?
> >>
> > I tried it again and the error message is exactly:
> >
> > Error fading object 'dn: dc=example, dc=com'.
> > The error send by the server was:
> > ".
> >
> > In the Whireshark log was still the search request witch control:
> > 2.16.840.1.113730.3.4.2
> >
> > Why is this control needed by the server when I removed it from
> Database link settings?
> >
> I'm not sure - maybe the console is not working correctly. Try this:
> 1) Shutdown the server
> 2) cd /etc/dirsrv/slapd-yourinstance
> 3) edit dse.ldif - look for the entry
> dn: cn=config,cn=chaining database,cn=plugins,cn=config
> 4) edit the nsTransmittedControls attribute - remove
> 2.16.840.1.113730.3.4.2
> 5) save and restart the server
I looked into dse.ldif for a nsTransmittedControls attribute. There is only the 1.3.6.1.4.1.1466.29539.12. , not the problematic 2.16.840.1.113730.3.4.2.
Isn't the 2.16.840.1.113730.3.4.2 hardcoded? Why is this so necessary?
> >
> >>>> Michal Rejda wrote:
> >>>>
> >>>>
> >>>>> Hi all,
> >>>>>
> >>>>> Im trying to setup proxy on FDS to another LDAP server (OpenLDAP
> >>>>> and Active Directory). I tried two ways, but none of these works:
> >>>>>
> >>>>> 1) New database link to LDAP server.
> >>>>>
> >>>>> - The remote LDAP server (OpenLDAP) returns: null. manageDSAit
> >>>>>
> >>>>>
> >>>> control
> >>>>
> >>>>
> >>>>> value not found
> >>>>>
> >>>>>
> >>>>>
> >>>> You might have to tweak the controls used by chaining - see
> >>>> http://tinyurl.com/culeft
> >>>>
> >>>>
> >>>>> 2) Create multiple-master replication and setup other server as
> >>>>>
> >>>>>
> >>>> consumer.
> >>>>
> >>>>
> >>>>> - But this show error: 255 Replication error acquiring replica:
> >>>>> unknown error.
> >>>>>
> >>>>>
> >>>>>
> >>>> Replication will only work to a SunDS, not to any other vendor.
> >>>>
> >>>>
> >>>>> My question is: Is there way how to setup proxy to access another
> >>>>>
> >>>>>
> >>>> LDAP
> >>>>
> >>>>
> >>>>> server from Fedora DS? I know that is possible to use AD sync,
> but
> >>>>>
> >> I
> >>
> >>>>> cannot install anything on the AD server. The second reason why I
> >>>>>
> >>>>>
> >>>> need
> >>>>
> >>>>
> >>>>> to setup proxy is to use data stored in LDAP server (OpenLDAP,
> >>>>> Open Direcoty Server and Active Directory) in one place. I need
> to
> >>>>>
> >> update
> >>
> >>>>> them too. It is not necessary to synchronize passwords.
> >>>>>
> >>>>>
> >>>>>
> >>>> See also
> >>>> http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration
> >>>>
> >>>>
> >>>>> Thank you for reply.
> >>>>>
> >>>>> Regards,
> >>>>>
> >>>>> Michal
> >>>>>
> >>>>>
15 years
RE: [Fedora-directory-users] LDAP proxy
by Michal Rejda
> -----Original Message-----
> From: fedora-directory-users-bounces(a)redhat.com [mailto:fedora-
> directory-users-bounces(a)redhat.com] On Behalf Of Rich Megginson
> Sent: Tuesday, April 14, 2009 4:25 PM
> To: General discussion list for the Fedora Directory server project.
> Subject: Re: [Fedora-directory-users] LDAP proxy
>
> Michal Rejda wrote:
> > I tried to use http://tinyurl.com/culeft. But the database link
> doesn't work. I setup the database link to the Active Directory (and
> OpenLDAP). When I looked into Wireshark log, FDS send search request
> with controls:
> > 2.16.840.1.113730.3.4.2
> > 2.16.840.1.113730.3.4.12
> > And the AD server responded: Unavailable Critical Extension.
> >
> > I tried to remove this two controls from Database Link Settings (in
> administration console) but it didn't help. The server didn't return
> the message above, but the administrative console show error dialog.
> >
> What error?
I tried it again and the error message is exactly:
Error fading object 'dn: dc=example, dc=com'.
The error send by the server was:
".
In the Whireshark log was still the search request witch control:
2.16.840.1.113730.3.4.2
Why is this control needed by the server when I removed it from Database link settings?
> >
> >> Michal Rejda wrote:
> >>
> >>> Hi all,
> >>>
> >>> Im trying to setup proxy on FDS to another LDAP server (OpenLDAP
> >>> and Active Directory). I tried two ways, but none of these works:
> >>>
> >>> 1) New database link to LDAP server.
> >>>
> >>> - The remote LDAP server (OpenLDAP) returns: null. manageDSAit
> >>>
> >> control
> >>
> >>> value not found
> >>>
> >>>
> >> You might have to tweak the controls used by chaining - see
> >> http://tinyurl.com/culeft
> >>
> >>> 2) Create multiple-master replication and setup other server as
> >>>
> >> consumer.
> >>
> >>> - But this show error: 255 Replication error acquiring replica:
> >>> unknown error.
> >>>
> >>>
> >> Replication will only work to a SunDS, not to any other vendor.
> >>
> >>> My question is: Is there way how to setup proxy to access another
> >>>
> >> LDAP
> >>
> >>> server from Fedora DS? I know that is possible to use AD sync, but
> I
> >>> cannot install anything on the AD server. The second reason why I
> >>>
> >> need
> >>
> >>> to setup proxy is to use data stored in LDAP server (OpenLDAP, Open
> >>> Direcoty Server and Active Directory) in one place. I need to
> update
> >>> them too. It is not necessary to synchronize passwords.
> >>>
> >>>
> >> See also
> >> http://directory.fedoraproject.org/wiki/Howto:OpenldapIntegration
> >>
> >>> Thank you for reply.
> >>>
> >>> Regards,
> >>>
> >>> Michal
> >>>
> >>>
> >
> >
> >
> > --
> > Fedora-directory-users mailing list
> > Fedora-directory-users(a)redhat.com
> > https://www.redhat.com/mailman/listinfo/fedora-directory-users
> >
>
15 years
[Fedora-directory-users] Installation error
by Samuel Germain
Hello,
I am trying to install Fedora Directory Server on Fedora Core 10 but the
last step of the installation is going wrong. The log file is following
below
Anybody can help me ?
Thanks a lot
Best regards
*
[09/04/15:18:49:53] - [Setup] Info Would you like to continue?
[09/04/15:18:50:18] - [Setup] Info yes
[09/04/15:18:50:18] - [Setup] Info Choose a setup type:
1. Express
Allows you to quickly set up the servers using the most
common options and pre-defined defaults. Useful for quick
evaluation of the products.
2. Typical
Allows you to specify common defaults and options.
3. Custom
Allows you to specify more advanced options. This is
recommended for experienced server administrators only.
To accept the default shown in brackets, press the Enter key.
[09/04/15:18:50:18] - [Setup] Info Choose a setup type
[09/04/15:18:50:19] - [Setup] Info 2
[09/04/15:18:50:19] - [Setup] Info Enter the fully qualified domain name of
the computer
on which you're setting up server software. Using the form
<hostname>.<domainname>
Example: eros.example.com.
To accept the default shown in brackets, press the Enter key.
[09/04/15:18:50:20] - [Setup] Info Computer name
[09/04/15:18:50:22] - [Setup] Info localhost.fr
[09/04/15:18:50:22] - [Setup] Info The servers must run as a specific user
in a specific group.
It is strongly recommended that this user should have no privileges
on the computer (i.e. a non-root user). The setup procedure
will give this user/group some permissions in specific paths/files
to perform server-specific operations.
If you have not yet created a user and group for the servers,
create this user and group using your native operating
system utilities.
[09/04/15:18:50:22] - [Setup] Info System User
[09/04/15:18:50:26] - [Setup] Info samuel
[09/04/15:18:50:26] - [Setup] Info System Group
[09/04/15:18:50:28] - [Setup] Info samuel
[09/04/15:18:50:28] - [Setup] Info Server information is stored in the
configuration directory server.
This information is used by the console and administration server to
configure and manage your servers. If you have already set up a
configuration directory server, you should register any servers you
set up or create with the configuration server. To do so, the
following information about the configuration server is required: the
fully qualified host name of the form
<hostname>.<domainname>(e.g. hostname.example.com), the port number
(default 389), the suffix, the DN and password of a user having
permission to write the configuration information, usually the
configuration directory administrator, and if you are using security
(TLS/SSL). If you are using TLS/SSL, specify the TLS/SSL (LDAPS) port
number (default 636) instead of the regular LDAP port number, and
provide the CA certificate (in PEM/ASCII format).
If you do not yet have a configuration directory server, enter 'No' to
be prompted to set up one.
[09/04/15:18:50:28] - [Setup] Info Do you want to register this software
with an existing
configuration directory server?
[09/04/15:18:50:32] - [Setup] Info no
[09/04/15:18:50:32] - [Setup] Info Please enter the administrator ID for the
configuration directory
server. This is the ID typically used to log in to the console. You
will also be prompted for the password.
[09/04/15:18:50:32] - [Setup] Info Configuration directory server
administrator ID
[09/04/15:18:50:34] - [Setup] Info admin
[09/04/15:18:50:34] - [Setup] Info Password
[09/04/15:18:50:37] - [Setup] Info Password (confirm)
[09/04/15:18:50:39] - [Setup] Info The information stored in the
configuration directory server can be
separated into different Administration Domains. If you are managing
multiple software releases at the same time, or managing information
about multiple domains, you may use the Administration Domain to keep
them separate.
If you are not using administrative domains, press Enter to select the
default. Otherwise, enter some descriptive, unique name for the
administration domain, such as the name of the organization
responsible for managing the domain.
[09/04/15:18:50:39] - [Setup] Info Administration Domain
[09/04/15:18:50:41] - [Setup] Info fr
[09/04/15:18:50:41] - [Setup] Info The standard directory server network
port number is 389. However, if
you are not logged as the superuser, or port 389 is in use, the
default value will be a random unused port number greater than 1024.
If you want to use port 389, make sure that you are logged in as the
superuser, that port 389 is not in use.
[09/04/15:18:50:41] - [Setup] Info Directory server network port
[09/04/15:18:50:44] - [Setup] Info 389
[09/04/15:18:50:44] - [Setup] Info Each instance of a directory server
requires a unique identifier.
This identifier is used to name the various
instance specific files and directories in the file system,
as well as for other uses as a server instance identifier.
[09/04/15:18:50:44] - [Setup] Info Directory server identifier
[09/04/15:18:50:46] - [Setup] Info localhost
[09/04/15:18:50:46] - [Setup] Info The suffix is the root of your directory
tree. The suffix must be a valid DN.
It is recommended that you use the dc=domaincomponent suffix convention.
For example, if your domain is example.com,
you should use dc=example,dc=com for your suffix.
Setup will create this initial suffix for you,
but you may have more than one suffix.
Use the directory server utilities to create additional suffixes.
[09/04/15:18:50:46] - [Setup] Info Suffix
[09/04/15:18:50:48] - [Setup] Info dc=fr
[09/04/15:18:50:48] - [Setup] Info Certain directory server operations
require an administrative user.
This user is referred to as the Directory Manager and typically has a
bind Distinguished Name (DN) of cn=Directory Manager.
You will also be prompted for the password for this user. The password must
be at least 8 characters long, and contain no spaces.
Press Control-B or type the word "back", then Enter to back up and start
over.
[09/04/15:18:50:48] - [Setup] Info Directory Manager DN
[09/04/15:18:50:49] - [Setup] Info cn=Directory Manager
[09/04/15:18:50:49] - [Setup] Info Password
[09/04/15:18:50:57] - [Setup] Info Password (confirm)
[09/04/15:18:51:05] - [Setup] Info The Administration Server is separate
from any of your web or application
servers since it listens to a different port and access to it is
restricted.
Pick a port number between 1024 and 65535 to run your Administration
Server on. You should NOT use a port number which you plan to
run a web or application server on, rather, select a number which you
will remember and which will not be used for anything else.
[09/04/15:18:51:05] - [Setup] Info Administration port
[09/04/15:18:51:08] - [Setup] Info 9830
[09/04/15:18:51:08] - [Setup] Info The interactive phase is complete. The
script will now set up your
servers. Enter No or go Back if you want to change something.
[09/04/15:18:51:08] - [Setup] Info Are you ready to set up your servers?
[09/04/15:18:51:10] - [Setup] Info yes
[09/04/15:18:51:10] - [Setup] Info Creating directory server . . .
[09/04/15:18:51:13] - [Setup] Info Your new DS instance 'localhost' was
successfully created.
[09/04/15:18:51:13] - [Setup] Info Creating the configuration directory
server . . .
[09/04/15:18:54:22] - [Setup] Fatal Error: failed to open an LDAP connection
to host 'localhost.fr' port '389' as user 'cn=Directory Manager'. Error:
unknown.
[09/04/15:18:54:22] - [Setup] Fatal Failed to create the configuration
directory server
[09/04/15:18:54:22] - [Setup] Fatal Exiting . . .
Log file is '/tmp/setupZf31Ze.log'*
15 years