I have a pretty flat DIT, with all users currently under
ou=people,dc=example,dc=com; these user objects also have posixAccount
attributes, of which loginShell is one.
What I'm trying to achieve is to be able to set a "default" loginShell
to be a restricted shell (/bin/rbash) for developers, but allow that to
be a non-restricted shell on systems which are development hosts.
As an example, on a production host I'd like:
$ ldapsearch -x "(uid=devuser)" uid loginshell
dn: cn=Dev User,ou=People,dc=example,dc=com
while on a development host, I'd like the same search to return
dn: cn=Dev User,ou=People,dc=example,dc=com
I thought I might be able to achieve this by creating a view called
ou=Developers,dc=example,dc=com and using that as a base DN on the
development boxes, then applying a CoS within the view to override the
loginShell attribute, but then the CoS ends up being applied to the
original entry too.
Is there any way that I could:
- have a CoS apply based on client system attributes, like IP
- have a CoS which applies to a view that *doesn't* affect the original
- perhaps make use of cosPriority through two different views, so as to
have ou=Development,... and ou=Production,... (but that would be
answered by the previous option anyway)?
Is there some other clever way to achieve what I'd like? I'd really like
to avoid maintaining 2 separate DITs for the same set of users.
With the usual apologies.
The 3rd Edition of the International Conference on LDAP (LDAPCon
2011) will be held on October, 10-11, 2011 in Heidelberg, Germany.
A Call For Papers has been raised and the Program Committee asks you
to submit abstracts by July 8th.
The International Conference on LDAP is a technical forum for IT
professionals interested in LDAP and related topics like directory
servers, directory management applications, directory integration,
identity and access management, and meta directories.
It focuses on implementation and integration of LDAP servers and
LDAP-enabled client applications. The event will bring together vendors,
developers, active and prospective LDAP practitioners to share their
experiences about deployment strategies, service operations,
interoperability, discuss LDAP usage in new projects and learn about
upcoming trends and developments.
The 1st LDAPCon was held in September 2007 in Germany, the 2nd
LDAPCon was held in September 2009 in Portland, Oregon, USA
(Some pictures from LDAPCon 2007  and a nice summary of LDAPCon 2009 )
So if you're involved with LDAP in interesting projects and you want to
share your experiences, please check the Call For Papers and submit a
Peter Gietz (CEO)
DAASI International GmbH phone: +49 7071 407109-0
Europaplatz 3 Fax: +49 7071 407109-9
D-72074 Tübingen mail: peter.gietz(a)daasi.de
Germany Web: www.daasi.de
DAASI International GmbH, Tübingen
Geschäftsführer Peter Gietz, Amtsgericht Stuttgart HRB 382175
Directory Applications for Advanced Security and Information Management
We have a setup with multiple masters which are replicating down to 389
Directory Server consumers via 2 hubs, but have a consistency issue.
It appears a few objects were deleted and re-added to the masters but
the object was not deleted from the 389 consumers. We now have 1
object on the masters and 2 objects on the consumers which causes
problems for the mail servers. If we delete the object from the master
we are still left with one object on the slaves. The slaves currently
have a few duplicate objects like this:
dn: cn=mx::10, cn=somedomain.co.uk, ou=dns, o=acmesystems.com
The object showing nsuniqueid is the valid one that exists on the
master. Is there a way to remove the 2nd object from the consumer
I have seen this before on a single consumer so we re-initialised it,
but its a much bigger problem to re-initialise all of the consumers. It
would be ideal if there is a way to manually delete an object direct on
> Maybe I am understanding this wrong but could you not just check in
> the config what the search base is set to on the client side? What is
> the problem you are trying to solve?
yes, you're right. i can just take a look at ldap.conf but there's several places to look:
- debian/ubuntu uses /etc/ldap/ldap.conf
- RHEL/CentOS uses /etc/openldap/ldap.conf
- custom compilations can use any path. ex: /usr/local/ldap/ldap.conf
- windows openldap uses... i don't really know :P
so what im trying to do is resolving configured base without knowing anything about the client.
for example, this command gives me the server even if i dont know anything about the conf:
ldapsearch -d1 -x -LLL "(uid=example)" uid 2>&1 | grep ldap_connect_to_host
im just a little bit surprised that i can't find any debuglevel that gives me the BASE
We are using Ubuntu 10.04 server OS and all the web applications are running
on that.We have already implemented fedora-ds for ldap auth.now we are
planning to go some up-gradation.kindly let me know the following,
1.How to migrate running fedora-ds server to another server ?
2.i have taken all the user/group+etc in ldif format.is it enough for
migration or any other db (/var/lib/dirsrv/slapd-<instance>) also need to
bacup ? if any procedure please share with me ? how to import/export .ldif
3.in our setup,one server is in public network.so i am planning to do
replication through "ldaps", i.e local server to public server replication
through highly secure how to ?
Please help me on the above topics.
We are setting up a new CENTOS-DS version 8.1.0. and CENTOS 5.5 and attempt
to synchronize with the existing 2003 Windows AD server.
Performing the full sync completed. There is no user created in the DS
We would like to perform one way Sync: AD ----> DS. Once it works, we will
set up the password Sync from the AD to DS.
[26/May/2011:10:20:34 -0400] NSMMReplicationPlugin - Beginning total update
of replica "agmt="cn=ADsync" (wodcstage-1:389)".
[26/May/2011:10:20:34 -0400] NSMMReplicationPlugin - Finished total update
of replica "agmt="cn=ADsync" (wodcstage-1:389)". Sent 0 entries.
26/May/2011:10:20:37 -0400] conn=11 op=819 SRCH base="cn=ADsync, cn=replica,
cn=\22dc=algonquincollege, dc=com\22, cn=mapping tree, cn=config" scope=0
nsds5replicaLastInitEnd nsds5replicaLastInitStatus nsds5BeginReplicaRefresh"
[26/May/2011:10:20:37 -0400] conn=11 op=819 RESULT err=0 tag=101 nentries=1
After setting up 389 and adding users I attempt to run ldappasswd on a
test user. The error message I get is:
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available:
I installed Fedora 15 and then 389 via yum. All packages were downloaded
without any problems and setup-ds-admin.pl had no problems either. I
then launched the admin console and added two test users with POSIX
After this, I launched authconfig-tui and configured it as so:
User Information: Cache, use LDAP
Authentication: shadow passwords, LDAP auth, local auth sufficient
Base DN: dc=k,dc=unicornis,dc=no
As said earlier, ldappasswd doesn't work (I use ldappasswrd -h
localhost). However, ldapsearch works (see attached output).
I appreciate any feedback on how to start debugging this :-).
I have previously been asking questions about importing a TB addressbook
book here and I think I can see how I can do that now but I guess I
should ask a more fundamental question: Is using an LDAP server the
best way of getting a commonly accessible addressbook for both TB and
SM? Even if I could use a setup like that, there is still no way TB can
automatically update the LDAP DB for mails that go out to new email
addresses . .
It seems that LDAP is the only common addressbook possibility between TB
and SQ but that solution is not completely satisfactory either . .
GPO Box 3411
Sydney NSW 2001
Here is the pastebin of the console log with debugging.
The console no longer works on any operating system I've tried. I've tried the ldap server (CentOS 5.5), a Windows 2003 Server w/Console, a Windows 2008 Server w/console, and Fedora 15. None of them work. Here is the screenshot of the console.
The errors in the log state that it's unable to resolve a lot of the strings. I don't know how to troubleshoot this issue. Any ideas?
ResourceSet:getString():Unable to resolve menu-start
Sr. Network Engineer