PAM PTA partially working
by Prashanth Sundaram
Hello,
PS: I am sorry to paste such big error log.
I spend some time tweaking around the PAM PTA plug-in, so i can authenticate users against Active Directory. I configured the PAM PTA plug-in, krb5.conf, /etc/pam.d/ldapserver for kerberos authentication against AD.
So to begin with I had only one user in 389-ds which is same as the local account name(uid=psundaram) on the DS. With all the configuration set, I was able to get the ldapsearch working for this user. Even when I change the password on the AD side, I can use the new password to show ldif results.
[root@centos-lin ~]# ldapsearch -h centos-lin.fedorads.net -b "dc=fedorads,dc=net" -D "uid=psundaram,ou=People,dc=fedorads,dc=net" -W -x
[root@centos-lin ~]# less/var/log/dirsrv/slapd-centos-lin/errors/
[21/Sep/2009:18:08:30 -0400] NSACLPlugin - #### conn=2 op=1 binddn=""
[21/Sep/2009:18:08:30 -0400] NSACLPlugin - conn=2 op=1 (main): Deny search on entry(cn=change-sie-password,cn=commands,cn=admin-s
erv-centos-lin,cn=389 administration server,cn=server group,cn=centos-lin.fedorads.net,ou=fedorads.net,o=netscaperoot).attr(nsExe
cRef) to anonymous: no aci matched the subject by aci(16): aciname= "SIE Group (centos-lin)", acidn="o=netscaperoot"
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - #### conn=3 op=1 binddn="uid=psundaram,ou=people,dc=fedorads,dc=net"
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow search on entry(dc=fedorads,dc=net).attr(objectClass) to uid
=psundaram,ou=people,dc=fedorads,dc=net: allowed by aci(2): aciname= "Enable anonymous access", acidn="dc=fedorads,dc=net"
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(dc=fedorads,dc=net).attr(objectClass) to uid=p
sundaram,ou=people,dc=fedorads,dc=net: allowed by aci(2): aciname= "Enable anonymous access", acidn="dc=fedorads,dc=net"
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(dc=fedorads,dc=net).attr(objectClass) to uid=p
sundaram,ou=people,dc=fedorads,dc=net: cached allow by aci(2)
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(dc=fedorads,dc=net).attr(dc) to uid=psundaram,
ou=people,dc=fedorads,dc=net: cached allow by aci(2)
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - #### conn=3 op=1 binddn="uid=psundaram,ou=people,dc=fedorads,dc=net"
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow search on entry(cn=directory administrators,dc=fedorads,dc=n
et).attr(objectClass) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (on entry): Allow read on entry(cn=directory administrators,dc=fedorads,dc
=net).attr(NULL) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (on attr): Allow read on entry(cn=directory administrators,dc=fedorads,dc=
net).attr(objectClass) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(cn=directory administrators,dc=fedorads,dc=net
).attr(cn) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached allow by aci(2)
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - #### conn=3 op=1 binddn="uid=psundaram,ou=people,dc=fedorads,dc=net"
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow search on entry(ou=groups,dc=fedorads,dc=net).attr(objectCla
ss) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (on entry): Allow read on entry(ou=groups,dc=fedorads,dc=net).attr(NULL) t
o uid=psundaram,ou=people,dc=fedorads,dc=net: cached context/parent allow
[21/Sep/2009:22:13:44 -0400] NSACLPlugin - conn=3 op=1 (main): Allow read on entry(ou=groups,dc=fedorads,dc=net).attr(objectClass
) to uid=psundaram,ou=people,dc=fedorads,dc=net: cached allow by aci(2)
But when I created another account, uid=tjordan which exists in AD as well (but does not have a local acount like above user) the authentication fails.
[root@centos-lin ~]# ldapsearch -h centos-lin.fedorads.net -b "dc=fedorads,dc=net" -D "uid=tjordan,ou=People,dc=fedorads,dc=net" -W -x
Enter LDAP Password:
ldap_bind: Operations error (1)
additional info: Unknown PAM error [Permission denied] for user id [tjordan], bind DN [uid=tjordan,ou=people,dc=fedorads,dc=net]
less /var/log/dirsrv/slapd-centos-lin/errors
[21/Sep/2009:22:36:48 -0400] pam_passthru-plugin - Error from PAM during pam_authenticate (6: Permission denied)
[21/Sep/2009:22:36:48 -0400] pam_passthru-plugin - Unknown PAM error [Permission denied] for user id [tjordan], bind DN [uid=tjor
dan,ou=people,dc=fedorads,dc=net]
>From what I see, there is something related to anonymous bind, but I am not sure what that is. Can someone help me understand what the problem is and how can I fix, If you know?
Here is my PAM PTA
dn: cn=PAM Pass Through Auth,cn=plugins,cn=config
cn: PAM Pass Through Auth
nsslapd-pluginPath: libpam-passthru-plugin
nsslapd-pluginInitfunc: pam_passthruauth_init
nsslapd-pluginType: preoperation
nsslapd-pluginEnabled: on
nsslapd-pluginloadglobal: true
nsslapd-plugin-depends-on-type: database
pamMissingSuffix: ALLOW
pamExcludeSuffix: cn=config
pamExcludeSuffix: o=NetscapeRoot
pamIDMapMethod: RDN
pamIDAttr: notUsedWithRDNMethod
pamFallback: FALSE
pamSecure: FALSE
pamService: ldapserver
nsslapd-pluginId: pam_passthruauth
nsslapd-pluginVersion: 1.2.2
nsslapd-pluginVendor: 389 Project
nsslapd-pluginDescription: PAM pass through authentication plugin
modifiersName: cn=directory manager
modifyTimestamp: 20090921225438Z
Thanks,
Prashanth
14 years, 7 months
Tunning
by Emmanuel BILLOT
Hi,
I'm searching for a best practive documentation about tunning DB, like
nsslapd-lookthroughlimit
nsslapd-sizelimit
Our DIT contains 20 000 entries, what parameters can we use and how for
having a best configured dirsrv ?
RG,
--
==========================================
Emmanuel BILLOT
IRD - Orléans
Délégation aux Systèmes d'Information (DSI)
tél : 02 38 49 95 88
==========================================
14 years, 7 months
SASL mapping question
by Prashanth Sundaram
Dear All,
I have few questions related to SASL mapping in 389-ds. I am using Windows
AD as kerberos server and here¹s the tree in both 389-ds and AD.
In Active Directory:
Users are located in different OU¹s like FullTime, PartTime, Contractors
etc.
example: ou=FullTime, OU=Users, OU=CompanyName,DC=ADDomain,DC=com
In 389-DS
Users are located only in one OU
example: ou=People,DC=ldapdomain,DC=com
<<<<<<<<Questions>>>>>>>
1. Is my SASL mapping correct?
nsSaslMapRegexString: \(.*\)(a)ldapdomain.com
nsSaslFilterTemplate: (objectclass=user)
nsSaslBaseDNTemplate:
sAMAccountName=\1,ou=Users,ou=CompanyName,dc=ADDomain,dc=com
2. Since users are in sub-ou in ADDomain, do I have to create separate SASL
mapping for each out? If, so then how will the 389-ds know if the user is in
PartTime OU and not in FullTime OU.
3. How many SASL mapping should I have? By default I see 4 listed, should I
remove all others? I have read the RFCs which correspond but not sure why I
need them.
Thanks,
Prashanth
14 years, 7 months
389-ds-1.2.jar console error
by Eric
Hi
I had fedora-ds-1.1.3 installed on a vps centos 5.3. Its console was opened
from another centos 5. I have upgraded system centos 5 and know it opens
console with this error:
failed to install a local copy of 389-ds-1.2.jar.
I didn't change anything on my server. What happend?
14 years, 7 months
Problems with password syntax checking: invalid password syntax
by Kenneth Holter
Hi all.
I'm running Red Hat Directory Server 8.1.0, and are having some problems
with password syntax checking. When I don't enable the syntax checking,
everything works fine. But when I enable it it seems to discard even pretty
strong passwords. In the example belov I've configured password syntax
checking like this:
- Password minimum length: 8
- Minimum required character categories: 1
- Minimum token length: 3 (btw, don't know why I need to set this)
The new password I try to change to has two digits, four lower case letters,
one uppercase letter, and one special character. So it should be far more
complicated that the above settings call for. This is the output:
#### Output start
[root@server ~]# ssh kenneth@localhost
kenneth@localhost's password:
You are required to change your LDAP password immediately.
Last login: Fri Sep 18 16:37:26 2009 from localhost.localdomain
Welcome to the server!
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user kenneth.
Enter login(LDAP) password:
New UNIX password:
Retype new UNIX password:
LDAP password information update failed: Constraint violation
invalid password syntax - passwords with storage scheme are not allowed
passwd: Permission denied
Connection to localhost closed.
##### Output end
So basically what I'm wondering about is exactly which constraint I'm
violating. In other words, what does the "password with storage scheme are
not allowed" tell me?
Best regards,
Kenneth Holter
14 years, 7 months
Error in passsync service : "No entries yet"
by Hugo Etievant
hello,
My actual architecture :
- two 389DS server (version 1.1.3) on Fedora8 32bits
- two Active Directory on Windows Server 2003 Standard edition 32bits
domain controler (AD servers are both synchronized with "Active
Directory Intrasite Replication")
In january 2009, multimaster replication protocol was enabled between
two 389DS, and a passync service installed in only one AD with one
replication agreement between the AD server and one 389DS.
Password synchronization is successful.
In september 2009, a second AD server is installed with passync service
and a second replication agreement between one 389DS and the second AD.
But Password synchronization does not work with the second AD.
passsync.log :
09/09/09 15:04:44: PassSync service initialized
09/09/09 15:04:44: PassSync service running
09/09/09 15:04:45: No entries yet
09/09/09 15:12:40: No entries yet
09/09/09 15:26:33: No entries yet
09/09/09 15:35:02: No entries yet
"No entries yet" error message occure for each user password change on AD.
389DS can't catch windows password change.
my architecture schema :
389DS n°1
^----MMR-------------------> 389DS n°2
^----Win-Sync-Agreement---> (passsync) AD n°1
^----Win-Sync-Agreement---> (passsync) AD n°2
How can i resolve this problem, please ?
regards
--
* Hugo Étiévant
*
14 years, 7 months
389-DS install problem on CentOS
by Michel Urvoy
Hi,
I have tried to install 389-ds-base 1.2.2-1.el5 (i386) on CentOS from
dirsrv repos, but the public key is missing.
I get :
Public key for 389-ds-base-1.2.2-1.el5.i386.rpm is not installed.
>From where can I get the key?
14 years, 7 months
Syncing Active/Inactive status through Windows Sync
by Jonas Courteau
Hello all:
I've currently got Active Directory (on Windows 2003) syncing nicely
with DS, but I'm noticing that the AD Disabled/Enabled status is not
syncing with the DS Active/Inactive status. Looking though all the
docs, I don't see any mention that it SHOULD sync, especially seeing as
it's not in the table of synced items in the Windows Sync chapter of the
manual.
However, I have seen a few posts out and about on the Internet that
imply that the status does sync over, but nothing definitive. Anyone
able to provide the final word on if this is supposed to work or not?
Thanks!
Jonas Courteau
14 years, 7 months