Problem browsing LDAP with Outlook
by Chris Bryant
When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS.
When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well.
I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also.
Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration.
Thanks,
Chris
USA.NET
You Run Your Business. We'll Run Your Email.
This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.
3 years, 6 months
Severe dn corruption
by Edward Z. Yang
Hello,
Last evening we experienced server corruption inside our replicated
prefix.
Three users got moved from ou=People,dc=scripts,dc=mit,dc=edu to dc=scripts,
and another user got moved from ou=People,dc=scripts to
ou=People,ou=People,dc=scripts. We also couldn't fix it because it claimed
that the correct DN existed.
We also saw replication conflicts using , as the
thing after nsuniqueid instead of +.
Please advise.
Cheers,
Edward
P.S. Our dirsrvs have been crashing and segfaulting because of the GSSAPI bugs,
so if you want to blame it on that, ok, though dirsrv should not be corrupting
data when it gets interrupted.
13 years, 4 months
Several root suffixes
by Andreas Andersson
Hi!
Is 389 DS working fine using 5 - 10 root suffixes? I know its not very common as you usually only need one root suffix for your organization.
The reason why I'm asking is that I want to consolidate several test environments into one single LDAP environment.
I know its possible in 389 but are there any technical issues or limitations I might run into doing this?
Regards - Andreas
13 years, 4 months
In need of Storing Cleartext Password
by Uzor Ide
Hi
we have a need for 389 directory to store password in clear text, in given
subtree. I have used the console to configure password policy and chose
CLEAR for the encryption scheme under passwordStorageScheme, yet the
passwords are still SSHA encrypted. Is there any other thing that I should
do.
# entry-id: 11
dn: cn=users,cn=subscribers,dc=ourcompany,dc=com
objectClass: top
objectClass: nsContainer
cn: users
# entry-id: 14
dn: cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany,dc=com
objectClass: nsContainer
objectClass: top
cn: nsPwPolicyContainer
# entry-id: 15
dn:
cn=cn\3DnsPwPolicyEntry\2Ccn\3Dusers\2Ccn\3Dsubscribers\2Cdc\3Dourcompany\2Cdc\
3Dcom,cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany,dc=com
objectClass: ldapsubentry
objectClass: passwordpolicy
objectClass: top
cn: cn=nsPwPolicyEntry,cn=users,cn=subscribers,dc=ourcompany,dc=com
passwordMustChange: off
passwordExp: off
passwordHistory: on
passwordMinAge: 0
passwordChange: off
passwordStorageScheme: clear
passwordInHistory: 3
passwordLockout: on
passwordLockoutDuration: 21600
passwordResetFailureCount: 1800
passwordUnlock: on
passwordMaxFailure: 3
# entry-id: 16
dn:
cn=cn\3DnsPwTemplateEntry\2Ccn\3Dusers\2Ccn\3Dsubscribers\2Cdc\3Dourcompany\2Cd
c\3Dcom,cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany,dc=com
objectClass: extensibleObject
objectClass: costemplate
objectClass: ldapsubentry
objectClass: top
cosPriority: 1
pwdpolicysubentry:
cn=cn\3DnsPwPolicyEntry\2Ccn\3Dusers\2Ccn\3Dsubscribers\2Cdc\3
Dourcompany\2Cdc\3Dcom,cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany
,dc=com
cn: cn=nsPwTemplateEntry,cn=users,cn=subscribers,dc=ourcompany,dc=com
# entry-id: 17
dn: cn=nsPwPolicy_CoS,cn=users,cn=subscribers,dc=ourcompany,dc=com
objectClass: ldapsubentry
objectClass: cosSuperDefinition
objectClass: cosPointerDefinition
objectClass: top
costemplatedn:
cn=cn\3DnsPwTemplateEntry\2Ccn\3Dusers\2Ccn\3Dsubscribers\2Cdc\3Do
urcompany\2Cdc\3Dcom,cn=nsPwPolicyContainer,cn=users,cn=subscribers,dc=ourcompany,d
c=com
cosAttribute: pwdpolicysubentry default operational-default
cn: nsPwPolicy_CoS
# entry-id: 18
dn: uid=testuser,cn=users,cn=subscribers,dc=ourcompany,dc=com
givenName: U-da-man
uidNumber: 501
gidNumber: 501
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: account
objectClass: radiusprofile
uid: testuser
userPassword: {SSHA}HBk8h1pkgsUocxUgPF+HNeuHF1LgYaI99co6Aw==
radiusFramedMTU: 1400
radiusGroupName: local
radiusHuntgroupName: vpn.ourcompany.com
radiusRealm: vpn.ourcompany.com
radiusServiceType: Framed-User
radiusFilterId: std.ppp
passwordGraceUserTime: 0
dialupAccess: yes
There is also an attribute pwdpolicysubentry:
cn=cn\3DnsPwPolicyEntry\2Ccn\3Dusers\2Ccn\3Daccounts\2Cdc\3Dourcompany\2Cdc\3Dcom,cn=nsPwPolicyContainer,cn=users,cn=accounts,dc=ourcompany,dc=com
that shows up in the testuser's profile from the console that does not show
up in the ldif dump.
Please help I have followed the documentation Redhat directory 8.2
thanks
13 years, 4 months
Announcing 389 Directory Server 1.2.7 Alpha 3 for testing
by Rich Megginson
The 389 team is pleased to announce the availability for testing of
Alpha 3 of version 1.2.7. This release contains some new features as
well as many bug fixes. On those platforms which have OpenLDAP built
with Mozilla NSS crypto support (Fedora 14 and later), the packages are
built with OpenLDAP instead of the Mozilla LDAP C SDK.
WARNING: If you are upgrading from a previous 1.2.6 release candidate,
you will need to run fixfiles to fix some SELinux AVCs, or directory
server will not start. See bug
https://bugzilla.redhat.com/show_bug.cgi?id=622882
To fix, run this:
fixfiles -R 389-ds-base restore
If you are upgrading from 1.2.5 or earlier, or a stable 1.2.6, there is
no problem.
WARNING: If you are upgrading from a 1.2.6 alpha or release candidate,
you will need to manually fix your entryrdn index files. See
http://port389.org/wiki/Subtree_Rename#warning:_upgrade_from_389_v1.2.6_....
for more information. If you are upgrading from 1.2.5 or earlier, or a
1.2.6 stable release, there is no problem.
The new packages and versions are:
* 389-ds-base 1.2.7.a3
* 389-admin 1.1.12.a2
* 389-adminutil 1.1.13
* 389-dsgw 1.1.6
* perl-Mozilla-LDAP 1.5.3 (Fedora 14 and later)
***We need your help! Please help us test this software.*** It is an
Alpha release, so it may have a few glitches, but it has been tested for
regressions and for new feature bugs. The Fedora system
requires that packages go into Testing until verified and pushed
to Stable.
The more testing we get, the faster we can release these packages to
Stable. See the Release Notes for information about how to provide
testing feedback (or just send an email to
389-users(a)lists.fedoraproject.org).
=== Installation ===
yum install --enablerepo=[updates-testing|epel-testing] 389-ds
setup-ds-admin.pl
=== Upgrade ===
yum upgrade --enablerepo=[updates-testing|epel-testing] 389-ds-base
389-admin 389-adminutil 389-dsgw perl-Mozilla-LDAP
setup-ds-admin.pl -u
=== New features ===
* On Fedora 14 and later, the 389 packages are built with OpenLDAP
instead of Mozilla LDAP
* Account Policy - keep track of last login, automatically disable
unused accounts
* The replication changelog has been moved into the main server database
environment
* Member Of supports multiple membership attributes
=== Bugs Fixed ===
This release contains many bug fixes. The complete list of bugs
fixed is found at the link below. Note that bugs marked as MODIFIED
have been fixed but are still in testing.
* Bug List for 389 1.2.7
https://bugzilla.redhat.com/showdependencytree.cgi?id=576869&hide_resolved=1
* Release Notes - http://port389.org/wiki/Release_Notes
* Install_Guide - http://port389.org/wiki/Install_Guide
* Download - http://port389.org/wiki/Download
13 years, 4 months
What are people using to manager user accounts?
by Orion Poplawski
I'd be very interested to know what tools people are using to manage user
accounts in the directory server. Currently we are using a modified version
of fdstools because we have a Posix + Samba environment, but would be
interested in other solutions that may be out there.
Thanks!
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301 http://www.cora.nwra.com
13 years, 4 months
DSGW SELinux issues
by Orion Poplawski
Running on CentOS 5.4, get:
type=AVC msg=audit(1288197048.706:347260): avc: denied { execute_no_trans }
for pid=1388 comm="httpd.worker" path="/usr/lib/dirsrv/dsgw-cgi-bin/lang"
dev=dm-4 ino=225129 scontext=system_u:system_r:httpd_t:s0
tcontext=system_u:object_r:lib_t:s0 tclass=file
Looks like these are mislabeled:
[root@earth admin-serv]# ls -Z /usr/lib/dirsrv/cgi-bin
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t admpw
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t config
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t download
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t dsconfig
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_create
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_listdb
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_remove
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_restart
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t
ds_shutdown
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t
ds_snmpctrl
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ds_start
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t
ds_unregister
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t help
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t htmladmin
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t
monreplication
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ReadLog
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t
repl-monitor-cgi.pl
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t restartsrv
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t
sec-activate
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t security
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t
start_config_ds
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t
statpingserv
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t statusping
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t stopsrv
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t ugdsconfig
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t viewdata
-rwxr-xr-x root root system_u:object_r:httpd_dirsrvadmin_script_exec_t viewlog
[root@earth admin-serv]# ls -Z /usr/lib/dirsrv/dsgw-cgi-bin
-rwxr-xr-x root root system_u:object_r:lib_t auth
-rwxr-xr-x root root system_u:object_r:lib_t csearch
-rwxr-xr-x root root system_u:object_r:lib_t dnedit
-rwxr-xr-x root root system_u:object_r:lib_t doauth
-rwxr-xr-x root root system_u:object_r:lib_t domodify
-rwxr-xr-x root root system_u:object_r:lib_t dosearch
-rwxr-xr-x root root system_u:object_r:lib_t edit
-rwxr-xr-x root root system_u:object_r:lib_t lang
-rwxr-xr-x root root system_u:object_r:lib_t myorg
-rwxr-xr-x root root system_u:object_r:lib_t newentry
-rwxr-xr-x root root system_u:object_r:lib_t org
-rwxr-xr-x root root system_u:object_r:lib_t search
-rwxr-xr-x root root system_u:object_r:lib_t tutor
-rwxr-xr-x root root system_u:object_r:lib_t unauth
389-admin-1.1.11-1.el5
389-admin-console-1.1.5-1.el5
389-admin-console-doc-1.1.5-1.el5
389-adminutil-1.1.8-4.el5
389-console-1.1.4-1.el5
389-ds-1.2.1-1.el5
389-ds-base-1.2.6.1-2.el5
389-ds-console-1.2.3-1.el5
389-ds-console-doc-1.2.3-1.el5
389-dsgw-1.1.5-1.el5
File a bug?
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301 http://www.cora.nwra.com
13 years, 4 months
389-console jar issues
by Orion Poplawski
It appears that my 389-console is trying to get /java/jars/389-admin-1.1.jar
to access the admin server and /java/jars/389-ds-1.2.3.jar to access the
directory server, but the jar files are in /java/ not /java/jars.
389-admin-1.1.11-1.el5
389-admin-console-1.1.5-1.el5
389-admin-console-doc-1.1.5-1.el5
389-adminutil-1.1.8-4.el5
389-console-1.1.4-1.el5
389-ds-1.2.1-1.el5
389-ds-base-1.2.6.1-2.el5
389-ds-console-1.2.3-1.el5
389-ds-console-doc-1.2.3-1.el5
389-dsgw-1.1.5-1.el5
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA/CoRA Division FAX: 303-415-9702
3380 Mitchell Lane orion(a)cora.nwra.com
Boulder, CO 80301 http://www.cora.nwra.com
13 years, 4 months
can 389 DS server 1.1 be configured this way?
by Mike Li
Can I configure the 389 DS server 1.1 to change its returning error codes?
i.e. can I *configure* it so that it returns LDAP_NO_SUCH_OBJECT (0x20)
instead of LDAP_INVALID_DN_SYNTAX (0x22) to client, when it receives
client's searching string with an invalid DN syntax ? -- anyone has done
this? just curious.
Thanks
13 years, 4 months
openldap ldapsearch command
by Frederic Hornain
Dear *,
How can I configure the Directory server in order to use SASL DIGEST-MD5
with ldapsearch qnd without error messages?
ldapsearch -W -h xxx.xxx.xxx.xxx -U username -b "dc=example,dc=com" -Y
DIGEST-MD5
Enter LDAP Password : xxxxx
SASL/DIGEST-MD5 authentication started
ldap_sasl_interactive_bind_s: Invalid credentials (49)
additional info: SASL(-14): authorization failure: unable canonify user and
get auxprops
Thanks in advance for your help and your time.
BR
Frederic ;)
-----------------------------------------------------
Fedora-ambassadors-list mailing list
Fedora-ambassadors-list(a)redhat.com
13 years, 4 months