Error finding "Registered server" on DSGW with HTTP auth enabled
by Bowden, Brendan
Hello all,
I'm getting an odd error from the admin server after enabling authentication on the DSGW as described here: http://directory.fedoraproject.org/wiki/DSGW#Requiring_Authenticated_Access
At first it wouldn't find any users; I tracked that back to it searching under o=NetscapeRoot instead of the real baseDN where the users are, so I adjusted ldapurl in adm.conf (names slightly changed to protect the innocent):
>From - ldapurl: ldap://ldap-01.example.com:389/o=NetscapeRoot
To - ldapurl: ldap://ldap-01.example.com:389/dc=example,dc=com
Now it finds the users OK, but is erroring on this:
[Wed Mar 09 09:57:50 2011] [error] [client 1.2.3.4] admserv_check_authz(): unable to find registered server (dsgwcmd)
I've searched all over for this one and can't find any hints. The source code says it's searching for "dsgwcmd" as a serverID under Server Groups in LDAP somewhere?
Any help would be appreciated, thanks!
---------------------------------------------------------------------
Admin-serv errors log with debug enabled:
[Wed Mar 09 09:57:49 2011] [info] Connection to child 9 established (server ldap-01.example.com:443, client 1.2.3.4)
[Wed Mar 09 09:57:50 2011] [notice] [client 1.2.3.4] admserv_host_ip_check: ap_get_remote_host could not resolve 1.2.3.4, referer: https://password.leve
l3sa.com/clients/dsgw/bin/lang?context=pb
[Wed Mar 09 09:57:50 2011] [warn] [client 1.2.3.4] admserv_host_ip_check: failed to get host by ip addr [1.2.3.4] - check your host and DNS configuratio
n, referer: https://password.example.com/clients/dsgw/bin/lang?context=pb
[Wed Mar 09 09:57:50 2011] [debug] mod_admserv.c(2754): [client 1.2.3.4] checking user cache for: testaccount, referer: https://password.example.com/clien
ts/dsgw/bin/lang?context=pb
[Wed Mar 09 09:57:50 2011] [debug] mod_admserv.c(2761): [client 1.2.3.4] not in cache, trying DS, referer: https://password.example.com/clients/dsgw/bin/la
ng?context=pb
[Wed Mar 09 09:57:50 2011] [debug] mod_admserv.c(1586): [client 1.2.3.4] admserv_check_authz: request for uri [/dsgwcmd/lang], referer: https://password.lev
el3sa.com/clients/dsgw/bin/lang?context=pb
[Wed Mar 09 09:57:50 2011] [error] [client 1.2.3.4] admserv_check_authz(): unable to find registered server (dsgwcmd), referer: https://password.example.com/clients/dsgw/bin/lang?context=pb
[Wed Mar 09 09:57:50 2011] [info] Connection to child 9 closed (server ldap-01.example.com:443, client 1.2.3.4)
[Wed Mar 09 09:57:50 2011] [info] Connection to child 10 established (server ldap-01.example.com:443, client 1.2.3.4)
[Wed Mar 09 09:57:50 2011] [notice] [client 1.2.3.4] admserv_host_ip_check: ap_get_remote_host could not resolve 1.2.3.4
[Wed Mar 09 09:57:50 2011] [warn] [client 1.2.3.4] admserv_host_ip_check: failed to get host by ip addr [1.2.3.4] - check your host and DNS configuration
[Wed Mar 09 09:57:50 2011] [info] Initial (No.1) HTTPS request received for child 10 (server ldap-01.example.com:443)
[Wed Mar 09 09:57:50 2011] [error] [client 1.2.3.4] File does not exist: /usr/share/dirsrv/html/favicon.ico
[Wed Mar 09 09:57:50 2011] [info] Connection to child 10 closed (server ldap-01.example.com:443, client 1.2.3.4)
LDAPd access log for the same access attempt:
[09/Mar/2011:09:57:49 -0500] conn=349 fd=112 slot=112 connection from 127.0.0.1 to 127.0.0.1
[09/Mar/2011:09:57:49 -0500] conn=349 op=0 BIND dn="" method=128 version=3
[09/Mar/2011:09:57:49 -0500] conn=349 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn=""
[09/Mar/2011:09:57:49 -0500] conn=349 op=1 SRCH base="dc=example,dc=com" scope=2 filter="(uid=testaccount)" attrs="c"
[09/Mar/2011:09:57:49 -0500] conn=349 op=1 RESULT err=0 tag=101 nentries=1 etime=0
[09/Mar/2011:09:57:49 -0500] conn=349 op=2 BIND dn="uid=Testaccount,ou=vpn,dc=subdomain,dc=example,dc=com" method=128 version=3
[09/Mar/2011:09:57:49 -0500] conn=349 op=2 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=testaccount,ou=vpn,dc=subdomain,dc=example,dc=com"
[09/Mar/2011:09:57:49 -0500] conn=350 fd=113 slot=113 connection from 127.0.0.1 to 127.0.0.1
[09/Mar/2011:09:57:49 -0500] conn=349 op=3 UNBIND
[09/Mar/2011:09:57:49 -0500] conn=349 op=3 fd=112 closed - U1
[09/Mar/2011:09:57:49 -0500] conn=350 op=0 BIND dn="uid=Testaccount,ou=vpn,dc=subdomain,dc=example,dc=com" method=128 version=3
[09/Mar/2011:09:57:49 -0500] conn=350 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=testaccount,ou=vpn,dc=subdomain,dc=example,dc=com"
[09/Mar/2011:09:57:49 -0500] conn=350 op=1 SRCH base="cn=Server Group, cn=ldap-01.example.com, ou=example.com, o=NetscapeRoot" scope=2 filter="(objectClass=*)" attrs=ALL
[09/Mar/2011:09:57:49 -0500] conn=350 op=1 RESULT err=0 tag=101 nentries=62 etime=0 notes=U
[09/Mar/2011:09:57:49 -0500] conn=351 fd=112 slot=112 connection from 127.0.0.1 to 127.0.0.1
[09/Mar/2011:09:57:49 -0500] conn=350 op=2 UNBIND
[09/Mar/2011:09:57:49 -0500] conn=350 op=2 fd=113 closed - U1
[09/Mar/2011:09:57:49 -0500] conn=351 op=0 BIND dn="uid=Testaccount,ou=vpn,dc=subdomain,dc=example,dc=com" method=128 version=3
[09/Mar/2011:09:57:49 -0500] conn=351 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=testaccount,ou=vpn,dc=subdomain,dc=example,dc=com"
[09/Mar/2011:09:57:49 -0500] conn=351 op=1 SRCH base="cn=slapd-ldap-01, cn=389 Directory Server, cn=Server Group, cn=ldap-01.example.com, ou=example.com, o=NetscapeRoot" scope=2 filter="(objectClass=*)" attrs=ALL
[09/Mar/2011:09:57:49 -0500] conn=351 op=1 RESULT err=0 tag=101 nentries=20 etime=0 notes=U
[09/Mar/2011:09:57:49 -0500] conn=352 fd=113 slot=113 connection from 127.0.0.1 to 127.0.0.1
[09/Mar/2011:09:57:49 -0500] conn=351 op=2 UNBIND
[09/Mar/2011:09:57:49 -0500] conn=351 op=2 fd=112 closed - U1
[09/Mar/2011:09:57:49 -0500] conn=352 op=0 BIND dn="uid=Testaccount,ou=vpn,dc=subdomain,dc=example,dc=com" method=128 version=3
[09/Mar/2011:09:57:49 -0500] conn=352 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=testaccount,ou=vpn,dc=subdomain,dc=example,dc=com"
[09/Mar/2011:09:57:49 -0500] conn=352 op=1 SRCH base="cn=Server Group, cn=ldap-01.example.com, ou=example.com, o=NetscapeRoot" scope=2 filter="(objectClass=*)" attrs=ALL
[09/Mar/2011:09:57:49 -0500] conn=352 op=1 RESULT err=0 tag=101 nentries=62 etime=0 notes=U
[09/Mar/2011:09:57:49 -0500] conn=352 op=2 UNBIND
[09/Mar/2011:09:57:49 -0500] conn=352 op=2 fd=113 closed - U1
13 years, 1 month
Re: [389-users] Changelog Modification
by Rich Megginson
On 03/09/2011 10:11 AM, Stephen Agar wrote:
> I've seen multiple different types of changes in there flagged as this
> issue.
> - Some was a custom "directory string" attribute, being change from
> value notActivated to activated
I suppose this might be a problem if the schema were somehow different
between the two servers, which could happen if you added the schema via
a file and not via LDAP.
> - Some password account lockout attributes, resettime, etc.
See
http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-singl...
> - Most are modifications to the "memberof" attribute, which is set by
> the member plugin
memberof should not be replicated - see
http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-singl...
there is an Important Note on that page about replicating memberof
> - Some are password changes
I suppose this could be possible if the password policy is different on
the supplier and the consumer
>
> In all cases that i've checked, the data seems to be correct and
> consistent across all 4 nodes.
>
> Thanks for any insight.
>
> --stephen
>
>
> On Tue, Mar 8, 2011 at 3:21 PM, Rich Megginson <rmeggins(a)redhat.com
> <mailto:rmeggins@redhat.com>> wrote:
>
> On 03/08/2011 11:17 AM, Stephen Agar wrote:
>> I have a 4 server multi master replication setup going on. We
>> get a lot of errors like this:
>>
>> NSMMReplicationPlugin - agmt="cn="Replication to server""
>> (server:636): Consumer failed to replay change (uniqueid
>> 2365a885-b85511df-ad54b6ca-51ecbecb, CSN 4d6ceae5000700010000):
>> DSA is unwilling to perform. Will retry later.
>>
>> I've used cl-dump on all four nodes to dump the logs and track
>> these down. However, all of the "offending" changes that say
>> they weren't made do indeed seem to be applied on all 4 nodes.
> What are these changes? What operations, attributes, values, etc.
>> Is there a command I can use to remove specific entries from the
>> changelog? In the past, i've just re-initialized nodes to get
>> rid of these, but that's certainly not the preferred way to do this.
>>
>> Thanks,
>> Stephen
>>
>>
>> --
>> 389 users mailing list
>> 389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org>
>> https://admin.fedoraproject.org/mailman/listinfo/389-users
>
>
13 years, 1 month
Changelog Modification
by Stephen Agar
I have a 4 server multi master replication setup going on. We get a lot of
errors like this:
NSMMReplicationPlugin - agmt="cn="Replication to server"" (server:636):
Consumer failed to replay change (uniqueid
2365a885-b85511df-ad54b6ca-51ecbecb, CSN 4d6ceae5000700010000): DSA is
unwilling to perform. Will retry later.
I've used cl-dump on all four nodes to dump the logs and track these down.
However, all of the "offending" changes that say they weren't made do indeed
seem to be applied on all 4 nodes. Is there a command I can use to remove
specific entries from the changelog? In the past, i've just re-initialized
nodes to get rid of these, but that's certainly not the preferred way to do
this.
Thanks,
Stephen
13 years, 1 month
Issue with 389
by Andrea Modesto Rossi
Dear all,
I hope you can help me in order to set up my first 389 Server.
My situation : fresh install of 389 (Fedora 14), installed the DS via
yum from the standard repos. Everything seems to work properly, DNA as well.
Basically i've got 2 problems and 1 question.
First of all, i work with 389 console ):
1) Adding a new group (e.g. administrator) i see that there is not the GID
attribute and i have to add it (by hand) every time (Advanced propertis
---> Object class ---> Add value ---> Posix Group); it's very boring :-)
How can i fix this issue? In general, is it possible to modify the basic
DIT ? Indeed i'd like to add much more information (manager, company,...an
so on) for each new users in a fast way.
2) I'm writing a Web interface able to manage users account (e.g.:password).
For some operations(reset pw) i need a Bind DN user, right? Ok, please
could you help me write an ACL (principle of least privilege) for this
user? i don't like to use the directory manage (cn=directory manager). My
idea is to create a new user able to handle only his OU, and nothing else!
3) I have a PKI. can i manage(store) users keys(public and private)
directly through 389? If so, how? could you point me in the right
direction?
Thank you very much.
have a nice weekend
/AMR
--
Andrea Modesto Rossi
Fedora Ambassador
13 years, 1 month
389/RHDS Compatibility in Enterprise
by Alaric
Hi folks
At $WORKk we are having a discusion about the scalability of different
directory server products, and I thought I'd reach out and see anyone had
any information that I could feed back into our dialogue. There are three
main points that i'm curious about, first the statement was made that Red
Hat doesn't suggest RHDS 8.* for use in enterprise environments and instead
suggests an LDAP server that uses or comes with Jboss (OpenDS or OpenLDAP
maybe? I was a bit unclear on this point... ). Second, 389/RHDS is in fact
just Sun Directory Server 5.0. And finally that RHDS/389
isn't compatible with the following products:
Weblogic 10g+
WebSphere 6+
OAM 10g/11g
OVD 11g
OIF 11gR3
OAAM 11g
OIM 11gR2
Sun IdM v6.1, 7.2, 8.1.1
I'd really like to be able to provide some constructive feedback to
my collages, since the feels like a matter of misunderstanding and
an opportunity to educate each other.
Thanks in advance for any feedback!
-a
13 years, 1 month
Announcing 389 Directory Server version 1.2.8 Release Candidate 1
by Rich Megginson
The 389 Project team is pleased to announce the release of
389-ds-base-1.2.8 Release Candidate 1. This release has fixes for bugs
found in 1.2.8 alpha testing and bugs from earlier releases.
Installation
yum install --enablerepo=updates-testing 389-ds
# or for EPEL
yum install --enablerepo=epel-testing 389-ds
setup-ds-admin.pl
Upgrade
yum upgrade --enablerepo=updates-testing 389-ds-base
idm-console-framework 389-admin 389-ds-console 389-admin-console
# or for EPEL
yum upgrade --enablerepo=epel-testing 389-ds-base
idm-console-framework 389-admin 389-ds-console 389-admin-console
setup-ds-admin.pl -u
How to Give Feedback
The best way to provide feedback is via the Fedora Update system. Each
update is broken down by package and platform. For example, if you are
using Fedora 13, and you have successfully installed or upgraded all of
the packages, and the console and etc. works, then go to the links below
for Fedora 13 and provide feedback.
* 389-ds-base-1.2.8.rc1
** EL-5 -
https://admin.fedoraproject.org/updates/389-ds-base-1.2.8-0.6.rc1.el5
** Fedora 13 -
https://admin.fedoraproject.org/updates/389-ds-base-1.2.8-0.6.rc1.fc13
** Fedora 14 -
https://admin.fedoraproject.org/updates/389-ds-base-1.2.8-0.6.rc1.fc14
** Fedora 15 -
https://admin.fedoraproject.org/updates/389-ds-base-1.2.8-0.6.rc1.fc15
scroll down to the bottom of the page, and click on the Add a comment >>
link
* select one of the Works for me or Does not work radio buttons, add
text, and click on the Add Comment button
If you are using a build on another platform, just send us an email to
389-users(a)lists.fedoraproject.org
Reporting Bugs
If you find a bug, or would like to see a new feature, you can enter it
here - https://bugzilla.redhat.com/enter_bug.cgi?product=389
More Information
* Release Notes - http://port389.org/wiki/Release_Notes
* Install_Guide - http://port389.org/wiki/Install_Guide
* Download - http://port389.org/wiki/Download
13 years, 1 month
Ciphers persistant after restart
by Gerrard Geldenhuis
Hi
Unfortunately I am stuck with a slightly older version of 389 at the moment so if this is fixed in a later version then great otherwise I include the details to try an reproduce.
Versions:
389-admin-1.1.11-1.el5
389-admin-console-1.1.5-1.el5
389-admin-console-doc-1.1.5-1.el5
389-adminutil-1.1.8-4.el5
389-console-1.1.4-1.el5
389-ds-1.2.1-1.el5
389-ds-base-1.2.6.1-2.el5
389-ds-console-1.2.3-1.el5
389-ds-console-doc-1.2.3-1.el5
389-dsgw-1.1.5-1.el5
Problem:
Open admin console
Select Encryption tab and then click on settings button.
Select TLS tab and remove( uncheck) all ciphers below 128bits level
Click Ok, and save
Exit admin console
Restart admin server
Log into admin console again.
The unchecked ciphers removed a moment ago is checked again...
Monitoring the audit log does show that changes are being made, I need to go through it with a fine tooth comb though.
Any thoughts on why this is happening, a bug a feature to protect against dumb users maybe?
Regards
________________________________________________________________________
In order to protect our email recipients, Betfair Group use SkyScan from
MessageLabs to scan all Incoming and Outgoing mail for viruses.
________________________________________________________________________
13 years, 1 month
Quick Classic CoS question
by James Roman
I have a classic Class of Service that I want to modify. Currently it
applies one attribute on each assigned entry. I have three other
attributes that I'd like to have the same CoS apply. I'm not sure how to
identify more than one cosattribute. Do I simply add multiple
cossattribute attributes to the CoS definition or is there a format for
listing multiple attribute values in the cosattribute attributes in the
CoS definition?
13 years, 1 month
advice on ssl cert rotation
by jon heise
Recently i had ssl certs expire on my directory servers, currently i have
one running without using an ssl cert, the secondary server is still set to
use the old cert and as such it is not functioning. On the primary server
the admin server has been set to use a new self signed cert but we are
locked out of that. Is there a way to change what cert the ldap server will
load without the use of the admin server ?
13 years, 1 month