Problem browsing LDAP with Outlook
by Chris Bryant
When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS.
When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well.
I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also.
Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration.
Thanks,
Chris
USA.NET
You Run Your Business. We'll Run Your Email.
This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.
3 years, 1 month
changelogdb has gotten large...
by Hartmann, Tim
Hi,
I've run into a situation where one of the files in /var/lib/dirsrv/<instance>/changelogdb has grown almost as large as the partition it's on. In my directory server configs, I noticed I was keeping an unlimited changelog, so I set that to what seems like a reasonably long amount of time (18 weeks) but didn't see any decrease in the file size. I'm wondering now about the best course of action. I can
a) move the whole dirsrv directory to another partition with more space available and symlink the old location to the new, which worked when I tested it, but I wanted to make sure I wouldn't be hosing something up the next time I upgrade.
b) find some means of manually shrinking the *.db ( can you even do that?)
c) point dirsrv at a new location, and reinitialize the consumers (which doesn't seem all that desirable)
Has anyone else found it necessary to shrink your changelogdb?
Thanks
-Tim
13 years
dynamic group expansion: writing a patch...
by Roberto Polli
Hi all,
I'd like to start a patch on dynamic group expansion, but dunno where to
start.
Can you point me?
Should be something like reusing VLV code?
Thx+Peace,
R-
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
13 years, 2 months
Directory Re-population
by Chun Tat David Chu
Hi All,
We use 389 Directory as part of our development lab. Every time when we do
a new test, we need to repopulate our 389 directory to a clean slate (i.e.
delete all existing data and re-create a base hierarchy tree).
Our current way of doing so is simply using the ldapdelete command to remove
all existing data and use ldapadd to re-create the base hierarchy tree.
This approach is okay but sometime it could take up to 20 to 30 minutes to
delete all existing data depending on the amount of data saved in the
directory.
Is there a more efficient way to repopulate the 389 Directory?
Thanks!
David
13 years, 3 months
sub trees
by Rick Dicaire
Hi folks, new to ldap, and 389 DS.
Is the following scenario possible, and even the correct way to go
about achieving:
I have a number of different machines running various linux
distributions. What I'd like to do is have different search trees in
ldap based on these distributions. In each tree I want users and
groups specific to that distro.
What is the best approach to implement this?
--
aRDy Music and Rick Dicaire present:
http://www.ardynet.com
http://www.ardynet.com:9000/ardymusic.ogg.m3u
13 years, 4 months
SSL peer reports incorrect Message Authentication Code in versions >= 1.2.2
by Juan Asensio Sánchez
Hi everyone
We are having trouble since we have updated from version 1.1.3 to 1.2.2 and
1.2.5. We have integrated CentOS/Redhat clients into LDAP. When we try to
make "getent group", we only get one group and its members, but no the rest
of the groups (should be more than 1000 groups). In the logs of dirsrv, we
get the following error:
[03/May/2010:12:17:40 +0200] conn=71386 fd=72 slot=72 SSL connection from
XXXXX to XXXXX
[03/May/2010:12:17:40 +0200] conn=71386 SSL 256-bit AES
[03/May/2010:12:17:40 +0200] conn=71386 op=0 BIND dn="cn=Application
Manager,cn=config" method=128 version=3
[03/May/2010:12:17:40 +0200] conn=71386 op=0 RESULT err=0 tag=97 nentries=0
etime=0 dn="cn=application manager,cn=config"
[03/May/2010:12:17:40 +0200] conn=71386 op=1 SRCH
base="ou=Groups,o=XXXXX,dc=XXXXX,dc=XXXXX" scope=2
filter="(&(objectClass=posixGroup))" attrs="cn userPassword memberUid
uniqueMember gidNumber"
[03/May/2010:12:17:40 +0200] conn=71386 op=2 SRCH
base="uid=XXXXX,ou=XXXXX,o=XXXXX,dc=XXXXX,dc=XXXXX" scope=0
filter="(objectClass=*)" attrs="uid uniqueMember objectClass"
*[03/May/2010:12:17:40 +0200] conn=71386 op=-1 fd=72 closed - SSL peer
reports incorrect Message Authentication Code.*
[03/May/2010:12:17:40 +0200] conn=71387 fd=73 slot=73 SSL connection from
XXXXX to XXXXX
[03/May/2010:12:17:41 +0200] conn=71387 SSL 256-bit AES
[03/May/2010:12:17:41 +0200] conn=71387 op=0 BIND dn="cn=Application
Manager,cn=config" method=128 version=3
[03/May/2010:12:17:41 +0200] conn=71387 op=0 RESULT err=0 tag=97 nentries=0
etime=1 dn="cn=application manager,cn=config"
[03/May/2010:12:17:41 +0200] conn=71387 op=1 SRCH
base="uid=XXXXX,ou=People,o=XXXXX,dc=XXXXX,dc=XXXXX" scope=0
filter="(objectClass=*)" attrs="uid uniqueMember objectClass"
[03/May/2010:12:17:41 +0200] conn=71387 op=1 RESULT err=0 tag=101 nentries=1
etime=0
[03/May/2010:12:17:41 +0200] conn=71387 op=2 SRCH
base="uid=XXXXX,ou=People,o=XXXXX,dc=XXXXX,dc=XXXXX" scope=0
filter="(objectClass=*)" attrs="uid uniqueMember objectClass"
[03/May/2010:12:17:41 +0200] conn=71387 op=2 RESULT err=0 tag=101 nentries=1
etime=0
[03/May/2010:12:17:41 +0200] conn=71387 op=3 SRCH
base="uid=XXXXX,ou=People,o=XXXXX,dc=XXXXX,dc=XXXXX" scope=0
filter="(objectClass=*)" attrs="uid uniqueMember objectClass"
[03/May/2010:12:17:41 +0200] conn=71387 op=3 RESULT err=0 tag=101 nentries=1
etime=0
[03/May/2010:12:17:41 +0200] conn=71387 op=4 SRCH
base="uid=XXXXX,ou=People,o=XXXXX,dc=XXXXX,dc=XXXXX" scope=0
filter="(objectClass=*)" attrs="uid uniqueMember objectClass"
[03/May/2010:12:17:41 +0200] conn=71387 op=4 RESULT err=0 tag=101 nentries=1
etime=0
The following UIDs search after the group, are the members of the first
group returned by the group search. The command "getent passwd" works fine.
This only happens in servers upgraded to 389-ds-base 1.2.2 or 1.2.5 (tested
in 6 different servers). If we configure the LDAP client to use un-upgraded
servers using fedora-ds-base 1.1.3 (tested in 4 different servers), the
command "getent group" works fine, and no errors are shown in the log. The
client configuration is always the same, just changing the LDAP server.
These are the configuration files:
/etc/ldap.conf
uri ldaps://XXXXXX
base dc=XXXXXX,dc=XXXXXX
ldap_version 3
binddn cn=Application Manager,cn=config
bindpw XXXXXX
ssl on
sasl_secprops maxssf=0
tls_cacertdir /etc/openldap/cacerts
tls_cacert /etc/openldap/cacerts/cert-CA-cacert.pem
timelimit 20
bind_timelimit 20
idle_timelimit 3600
nss_base_hosts ou=Computers,o=XXXXXX,dc=XXXXXX,dc=XXXXXX?one
nss_base_group ou=Groups,o=XXXXXX,dc=XXXXXX,dc=XXXXXX?sub
nss_base_passwd
dc=XXXXXX,dc=XXXXXX?sub?&(|(objectClass=myPerson)(objectClass=posixAccount))(|(ou:dn:=People)(ou:dn:=Computers))
nss_base_shadow
dc=XXXXXX,dc=XXXXXX?sub?&(|(objectClass=myPerson)(objectClass=posixAccount))(|(ou:dn:=People)(ou:dn:=Computers))
nss_initgroups_ignoreusers
avahi,avahi-autoipd,backup,bin,daemon,dbus,dhcp,games,gdm,gnats,haldaemon,hplip,irc,klog,ldap,libuuid,list,lp,mail,mailman,man,messagebus,named,news,nobody,polkituser,proxy,radiusd,radvd,root,sshd,sync,sys,syslog,tomcat,uucp,www-data
pam_password clear
/etc/openldap/ldap.conf
URI ldaps://XXXXXX
BASE dc=XXXXXX,dc=XXXXXX
TLS_CACERTDIR /etc/openldap/cacerts
TLS_CACERT /etc/openldap/cacerts/cert-CA-cacert.pem
TLS_REQCERT allow
/etc/nsswitch.conf
passwd: files ldap
shadow: files ldap
group: files ldap
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: nisplus
publickey: nisplus
automount: files nisplus
aliases: files nisplus
Regards.
13 years, 4 months
Replication Ring ...
by Reinhard Nappert
Hi all,
do you see an issue with the following replication topology:
S1 <----> S2 <---> S3 <---> S4
/\ /\
| |
\/ \/
S5 <----> S6 <---> S7 <---> S8
All connections are bi-directional (Multi-Master)
Thanks,
-Reinhard
13 years, 4 months
storing x509 certificates in the directory
by Luke Schierer
Hi all,
I have been using fedora directory server/389 directory server for a
couple years now with out any real issues, so I want to start off by
thanking all of the developers for the hours they put into making it
available to us.
Lately I have had the need to look at storeing x509 certificates in my
LDAP directory, to make them available to an application we use.
Looking at the documentation available on the website, it appears that
the usercertificate attribute either used to be a binary attribute, or
that there is a way to make it a binary attribute that I am not
seeing.
If the former, that it was but is no longer a binary attribute, it
appears to me that the 389-console cannot handle the PEM formatted
certificates, once one is added, I can no longer select that attribute
to manipulate either it, or the certificate it contains.
If the latter, that it can be changed to be binary, I would greatly
appreciate a pointer on how to do so.
Hopefully someone who has worked with certificates in 389-ds can give
me some pointers either way, so that I can either submit a bug report,
or find the right docs to be reading. Any help would be greatly
appreciated.
Thanks!!
Luke
13 years, 4 months
Does 389org expand dynamic groups?
by Roberto Polli
Hi all,
I'm playing with dynamic groups, but it seems that ldap doesn't evaluate them.
The MemberOf plugin doesn't work with dynamic groups too...
Do I have to search them programmatically?
Thx+Peace,
R.
PS. a similar question has been asked but not answered
http://lists.fedoraproject.org/pipermail/389-users/2008-May/007784.html
--
Roberto Polli
Babel S.r.l. - http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."
13 years, 4 months
Rename ldap entries
by Giovanni Mancuso
Hi all,
in my ldap, i have a series of entry that are:
uid = xxxx, ou=People,dc=test.com, o=company, dc=example, dc=com
.......
uid = xxxx, ou=People,dc=test.com, o=company, dc=example, dc=com
uid = xxxx, ou=People,dc=test1.com, o=company, dc=example, dc=com
.......
uid = xxxx, ou=People,dc=test1.com, o=company, dc=example, dc=com
uid = xxxx, ou=People,dc=test2.com, o=company, dc=example, dc=com
.......
uid = xxxx, ou=People,dc=test2.com, o=company, dc=example, dc=com
uid = xxxx, ou=People,dc=test3.com, o=company, dc=example, dc=com
.......
uid = xxxx, ou=People,dc=test3.com, o=company, dc=example, dc=com
Foreach domain (dc=test*.com), i have, cos, aci and role that are
interconnected.
An aci example:
aci: (targetattr = "subschemaSubentry || companyUsedQuota") (version
3.0;acl "
admin update used quota";allow (read,compare,search,write)(roledn =
"ldap://
/cn=admin role,o=company, dc=example, dc=com");)
I need to rename my o=company in o=company1. Any ideas?
I thought that if I do a db2ldif, and export my db in ldif file, i can run:
sed -i s/o=company,/o=company1,/g ldiffile.ldif
But it doesn't work becouse db2ldif cut the lines after 75 characters.
Can i create an export that doesn't truncate the row? Is there a workaround?
Any suggestion is welcome :-)
Thanks
13 years, 4 months