389-users September 2009

389-users@lists.fedoraproject.org

33 participants
35 discussions

memberOf task problem
by John A. Sullivan III 18 Dec '09

18 Dec '09

Hello, all. We are in the process of upgrading from 8.0 to 8.1. We've hit a few glitches along the way but most has gone well. However, we wanted to implement the new memberOf functionality. We successfully added the plugin by editing dse.ldif and enabled it from the console. However, we've been unsuccessful in having existing group membership assigned to the memberOf attribute. We first tried to run fixup-memberOf.pl but the script does not exist. There is a template.fixup-memberOf.pl but this does not seem to have been built into a final script. We then thought we would use the new task feature of the console. We went to cn=memberof task,cn=tasks,cn=config and tried to create the task object. There was no nsDirectoryServerTask objectclass. We added an nstask but then found there was no basedn attribute we could add. We then created an extensibleobject instead but still not basedn attribute. Finally, we resorted to ldapmodify (we hesitated just because we are not very familiar with the command line tools). First, we did: dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config changetype: add objectclass: top objectclass: extensibleObject cn: fixMemberOf basedn: o=Internal,dc=ssiservices,dc=biz The Internal Organization has several organizations under it (for various clients) and then user organizational units under those organizations. Although it generated no errors, it did not seem to work. Perhaps I just don't know how to test it. However, the following did not return an memberOf data: /usr/lib64/mozldap/ldapsearch -b "ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory Manager" -w - -h ldap uid=myid memberOf Doing /usr/lib64/mozldap/ldapsearch -b "ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory Manager" -w - -h ldap uid=myid showed me plenty of attributes but nothing for memberOf I also tried creating the task with a basedn of ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz in case it did not change objects lower in the tree. Still no success. Finally I tried: dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config changetype: add objectclass: top objectclass: nsDirectoryServerTask cn: fixMemberOf basedn: o=Internal,dc=ssiservices,dc=biz adding new entry cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config ldap_add: Object class violation ldap_add: additional info: unknown object class "nsDirectoryServerTask" And received the expected unknown object class error. What are we doing wrong? Are these documentation bugs? Are there application bugs or do we simply not know what we are doing with tasks and memberOf? How do we get the memberOf information into our existing user objects? Thanks - John -- John A. Sullivan III Open Source Development Corporation +1 207-985-7880 jsullivan(a)opensourcedevel.com http://www.spiritualoutreach.com Making Christianity intelligible to secular society

5 13

added schema not showing up in admin console
by Mike Clayton 03 Nov '09

03 Nov '09

I am trying to configure bind to talk directly to 389-ds, i have converted the dnszone.schema file that ships with bind-sdb to ldif using: perl ol-schema-migrate.pl -b /etc/openldap/schema/dnszone.schema > /etc/dirsrv/slapd-dc0/schema/61bind-dns.ldif and restarted the dirsrv service. but i can't seem to find an object class or anything for dnsZone. i looked in the logs and did not see any mention of dnsZone. Have i missed something or am i just not looking in the right places Mike

3 2

Deleting entries that are not modified recently
by Kimmo Koivisto 06 Oct '09

06 Oct '09

Hello I'm using fedora-ds-1.0.4-1.RHEL4 and I have an application that creates and modifies entries located in FDS. Application does not remote old entries, and I cannot change how application works. I would like to delete entries that are not modified recently with either plain ldapsearch+ldapdelete or using some FDS tools, perl scipt etc. So, my question is, what is the easiest way to delete entries, for example older that 3 months? Regards, Kimmo

4 6

389 unusable on F11?
by Kevin Bowling 01 Oct '09

01 Oct '09

Hi, I have been running FDS/389 on a F11 xen DomU for several months. I use it as the backend for UNIX username/passwords and also for redMine (a Ruby on Rails bug tracker) for http://www.gnucapplus.org/. This VM would regularly lock up every week or so when 389 was still called FDS. I've since upgraded to 389 by issuing 'yum upgrade' as well as running the 'setup-...-.pl -u' script and now it barely goes a day before crashing. When ldap crashes, the whole box basically becomes unresponsive. I left the Xen hardware console open to see what was up and the only thing I could conclude was that 389 was crashing (if I issued a service start it came back to life). Doing anything like a top or ls will completely kill the box. Likewise, the logs show nothing at or before the time of crash. I suspected too few file descriptors but changing that to a very high number had no impact. I was about to do a rip and replace with OpenLDAP which I use very sucesessfully for our corporate systems but figured I ought to see if anyone here can help or if I can submit any kind of meaningful bug report first. I assume I will need to run 389's slapd without daemonizing it and hope it spits something useful out to stderr. Any advice here would be greatly appreciated, as would any success stories of using 389 on F11. I'm not subscribed to the list so please CC. Regards, Kevin Bowing

3 7

Multiple versions of FDS in the same server
by Juan Asensio Sánchez 30 Sep '09

30 Sep '09

Hi I don't know why, but I have multiple versions of the FDS packages installed in the same server: --------------------------------------------------------------------------------------------------------------- [root@XXXXXXXXXXXXXX ~]# rpm -qa | grep fedora | sort fedora-admin-console-1.1.0-4.fc6 fedora-ds-1.1.0-3.fc6 fedora-ds-1.1.2-1.fc6 fedora-ds-admin-1.1.1-1.fc6 fedora-ds-admin-1.1.2-2.fc6 fedora-ds-admin-console-1.1.2-1.fc9 fedora-ds-admin-debuginfo-1.1.1-1.fc6 fedora-ds-admin-debuginfo-1.1.2-2.fc6 fedora-ds-base-1.1.0-3.fc6 fedora-ds-base-1.1.3-2.fc6 fedora-ds-base-debuginfo-1.1.1-1.fc6 fedora-ds-base-devel-1.1.0-3.fc6 fedora-ds-base-devel-1.1.3-2.fc6 fedora-ds-console-1.1.0-5.fc6 fedora-ds-console-1.1.2-2.fc9 fedora-ds-dsgw-1.1.1-1.fc6 fedora-idm-console-1.1.0-5.fc6 fedora-idm-console-debuginfo-1.1.0-5.fc6 --------------------------------------------------------------------------------------------------------------- How can this be possible? When updating, old versions shouldn't be removed? What will happen when I'll try to update to 389DS 1.2? --------------------------------------------------------------------------------------------------------------- [root@XXXXXXXXXXXXXXXXX yum.repos.d]# yum upgrade 389-ds Loaded plugins: fastestmirror Determining fastest mirrors idmcommon 100% |=========================| 951 B 00:00 dirsrv 100% |=========================| 951 B 00:00 idmcommon-noarch 100% |=========================| 951 B 00:00 dirsrv-noarch 100% |=========================| 951 B 00:00 Setting up Upgrade Process Resolving Dependencies --> Running transaction check ---> Package 389-ds.noarch 0:1.1.3-4.el5 set to be updated --> Processing Dependency: 389-ds-console for package: 389-ds --> Processing Dependency: 389-ds-console-doc for package: 389-ds --> Processing Dependency: 389-admin-console-doc for package: 389-ds --> Processing Dependency: 389-admin for package: 389-ds --> Processing Dependency: 389-admin-console for package: 389-ds --> Processing Dependency: 389-dsgw for package: 389-ds --> Processing Dependency: 389-console for package: 389-ds --> Processing Dependency: 389-ds-base for package: 389-ds --> Running transaction check ---> Package 389-console.noarch 0:1.1.3-3.el5 set to be updated ---> Package 389-dsgw.i386 0:1.1.4-1.el5 set to be updated --> Processing Dependency: fedora-ds-base = 1.1.0-3.fc6 for package: fedora-ds-base-devel ---> Package 389-ds-console.noarch 0:1.2.0-4.el5 set to be updated ---> Package 389-ds-console-doc.noarch 0:1.2.0-4.el5 set to be updated ---> Package 389-ds-base.i386 0:1.2.2-1.el5 set to be updated --> Processing Dependency: fedora-ds-base = 1.1.3-2.fc6 for package: fedora-ds-base-devel ---> Package 389-admin.i386 0:1.1.8-4.el5 set to be updated ---> Package 389-admin-console.noarch 0:1.1.4-1.el5 set to be updated ---> Package 389-admin-console-doc.noarch 0:1.1.4-1.el5 set to be updated --> Running transaction check ---> Package 389-ds-base-devel.i386 0:1.2.2-1.el5 set to be updated --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================================================================= Package Arch Version Repository Size ============================================================================================================================================================= Installing: 389-admin i386 1.1.8-4.el5 dirsrv 368 k replacing fedora-ds-admin.i386 1.1.1-1.fc6 389-admin-console noarch 1.1.4-1.el5 dirsrv 201 k replacing fedora-ds-admin-console.noarch 1.1.2-1.fc9 389-console noarch 1.1.3-3.el5 idmcommon-noarch 72 k replacing fedora-idm-console.i386 1.1.0-5.fc6 389-ds noarch 1.1.3-4.el5 dirsrv-noarch 8.6 k replacing fedora-ds.i386 1.1.2-1.fc6 389-ds-base i386 1.2.2-1.el5 dirsrv-noarch 1.7 M replacing fedora-ds-base.i386 1.1.3-2.fc6 389-ds-base-devel i386 1.2.2-1.el5 dirsrv-noarch 57 k replacing fedora-ds-base-devel.i386 1.1.0-3.fc6 389-ds-console noarch 1.2.0-4.el5 dirsrv-noarch 1.4 M replacing fedora-ds-console.noarch 1.1.0-5.fc6 389-dsgw i386 1.1.4-1.el5 dirsrv 1.1 M replacing fedora-ds-dsgw.i386 1.1.1-1.fc6 Installing for dependencies: 389-admin-console-doc noarch 1.1.4-1.el5 dirsrv 39 k 389-ds-console-doc noarch 1.2.0-4.el5 dirsrv 53 k Transaction Summary ============================================================================================================================================================= Install 10 Package(s) Update 0 Package(s) Remove 0 Package(s) Total download size: 4.9 M --------------------------------------------------------------------------------------------------------------- It won't remove all old versions? I know this is a topic more about general package management than 389DS, but any help is wellcome. Regards.

1 0

Synchronze userPrincipalName
by Emmanuel BILLOT 29 Sep '09

29 Sep '09

Hi, Is it possible to add userPrincipalName as an synchronized attribut between 389DS and AD ? It is the last useful attribut that we need in our DIT... BR, -- ========================================== Emmanuel BILLOT IRD - Orléans Délégation aux Systèmes d'Information (DSI) tél : 02 38 49 95 88 ==========================================

1 0

authentication proxy
by renuka meher 29 Sep '09

29 Sep '09

Hi, I am working on a project wherein i have to deploy Redhat's Dogtag Certificate System in my organisation. I have set up a fedora directory server on a system. There is an existing windows Active directory server. What i need is as follows: I need to use ldap for authentication check, in read only mode..A method to check if the username and password is correct. Something like Authentication proxy.. Thanks

1 0

Do not find db2bak or ldif2db command
by Michael Kang 27 Sep '09

27 Sep '09

Dear Fedora Directory community, After system upgrade is complete, I run yum install 389-ds to install fedora directory server on Fedora 11. I don't have db2bak or ldif2db command(or scripts). Did I miss some packages? Regards, Michael -- Michael Kang（康上明学） There is a giant asleep within every man. When the giant awakens,miracles happen. Personal blog: http://ufusion.org - United Fusion

4 5

Class of service removal
by Mikael Kermorgant 26 Sep '09

26 Sep '09

Hello, I'm using 389 ds 1.2.0. I've created a class of service on ou=people, which adds an attribute with a specific attribute. I've proceded in 3 steps : 1 - created an object of objectclass nscontainer named cn=cosTemplates at the root of my tree 2 - under that object, created an object of class cosTemplate and extensibleobject - added the desired attribute with default value for ou=people 3 - created a class of service with the wizzard "New -> Class of service" by right clicking on ou=people. Strange thing is that the class of service applies, but I can't find any object that corresponds to the class of service itself. I tried to search with this filter (objectclass=cos*) but I don't get it. Would you have any idea about how to find it in order to remove it for example ? Best regards, -- Mikael Kermorgant

2 2

Using different bind user to add tasks
by Jonas Courteau 25 Sep '09

25 Sep '09

Hi: I was wondering how to go about setting up an ACI to allow a different user to add specific tasks. For example, say I created a special user cn=backups,cn=config (or similar) and I wanted that user to be able to add cn=backup,cn=tasks,cn=config entries to schedule backups, but not allow them to do any other tasks. The idea here is to have a specific user to trigger the backups remotely without having to be including the directory manager password in scripts. I've been poking around with various ACIs but so far I'm kinda feeling around in the dark. I'm sure someone else has done something along these lines - any suggestions? Also, if you think this idea is silly and you wish to share your backup best practices, I'd love to hear! Thanks! Jonas

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users September 2009