Re: [389-users] question syncing with AD
by solarflow99
>From my tests, no. OU's have to created and deleted manually in 389. For
passwords, they have to be reset in AD since only passsync can pick them
up. You can replicate any OU, just create the sub containers first and
initiate a full resynchronization.
On Mon, Jun 27, 2011 at 4:16 PM, solarflow99 <solarflow99(a)gmail.com> wrote:
>
>
> On Mon, Jun 27, 2011 at 4:08 PM, Mi Zhou <mi.zhou(a)stjude.org> wrote:
>
>> Thanks Rich for the answer. A few more questions:
>>
>> Does existing password get synced during the initial full
>> re-sychronization? or does it only sync changes?
>>
>> Does container entries got synced as well? Say, if a new OU was created
>> on AD, will that be synced on 389?
>>
>
>
12 years, 9 months
Re: [389-users] question syncing with AD
by Mi Zhou
> > Does container entries got synced as well? Say, if a new OU was created
> > on AD, will that be synced on 389?
> During the initial sync init phase - yes. During the incremental phase
> - no.
Can we initiate a full resync to get this done, or it must be manually
added on the other end?
Thanks,
Mi
Email Disclaimer: www.stjude.org/emaildisclaimer
12 years, 9 months
question syncing with AD
by Mi Zhou
Hi,
I am exploring the possibilities of us setting up a 389 server and have
it synchronize with our AD.
I read that both 389 and AD have to be running SSL. We have multiple
domain controllers that trust each other, some running SSL, some not. I
wonder if every one of them have to be running SSL to make sync work.
Also does "passsync" have to be installed on every domain controllers?
Thanks a lot,
Mi
Email Disclaimer: www.stjude.org/emaildisclaimer
12 years, 9 months
Add another administrator
by Gioachino Bartolotta
Hi all,
it's possible to add another administrative user (similar to Directory
Manager) but who can only manage only user accounts under dc=mydomain?
Thanks
--
-------------------------------------------
Gioachino Bartolotta
ICQ #: 9103167
MSN Messenger: astraroth(a)email.it
Yahoo & Skype: gioachino_bartolotta
12 years, 9 months
win sync limitation
by solarflow99
I just noticed that a user created from windows cannot login on linux
because they have no posixuser attributes. If there was 1 feature that
would be a "nice to have", this would be it.
12 years, 9 months
Req : Multimaster replication query
by s.varadha rajan
Hi,
Anyone can help me, regarding my below query ?
Regards,
Varad
On Tue, Jun 21, 2011 at 7:26 PM, Rich Megginson <rmeggins(a)redhat.com> wrote:
> **
> On 06/20/2011 11:42 PM, s.varadha rajan wrote:
>
> Hi Rich,
>
> Please let me know, where can i get modified "mmr.pl" as per my below
> requirement.
>
> I don't know.
>
>
> Best Regards,
> Varad
>
>
>
> On Fri, Jun 17, 2011 at 7:46 PM, Rich Megginson <rmeggins(a)redhat.com>wrote:
>
>> On 06/16/2011 11:45 PM, s.varadha rajan wrote:
>>
>> Hi,
>>
>> i ran the below command in supplier side and the output is,
>>
>> # extended LDIF
>> #
>> # LDAPv3
>> # base <cn=config> with scope subtree
>> # filter: (objectclass=nsds5replicationagreement)
>> # requesting: ALL
>> #
>>
>> # Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.com po
>> rt 389, replica, o\3Dnetscaperoot, mapping tree, config
>> dn: cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.c
>> om port 389",cn=replica,cn="o=netscaperoot",cn=mapping tree,cn=config
>> objectClass: top
>> objectClass: nsDS5ReplicationAgreement
>> cn: "Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.com
>> port 389"
>> nsDS5ReplicaHost: sam.xxx.xxx.com
>> nsDS5ReplicaRoot: o=netscaperoot
>>
>>
>> This is the problem. I doubt that you wanted to replicate
>> o=netscaperoot. You probably wanted to replicate your user data suffix e.g.
>> dc=example,dc=com.
>>
>> Can someone please fix mmr.pl?
>>
>>
>> nsDS5ReplicaPort: 389
>> nsDS5ReplicaBindDN: cn=repman,cn=config
>> nsDS5ReplicaBindMethod: simple
>> nsds5replicaTimeout: 120
>> nsDS5ReplicaCredentials: {DES}VdEnvxoUkmw1TpV1QyVPtg==
>> nsds5replicareapactive: 0
>> nsds5replicaLastUpdateStart: 20110616123147Z
>> nsds5replicaLastUpdateEnd: 20110616123147Z
>> nsds5replicaChangesSentSinceStartup:: MToxNC8wIA==
>> nsds5replicaLastUpdateStatus: 0 Incremental update succeeded
>> nsds5replicaUpdateInProgress: FALSE
>> nsds5replicaLastInitStart: 20110616104148Z
>> nsds5replicaLastInitEnd: 20110616104153Z
>> nsds5replicaLastInitStatus: 0 Total update succeeded
>>
>> # search result
>> search: 2
>> result: 0 Success
>>
>> # numResponses: 2
>> # numEntries: 1
>>
>>
>> Regards,
>> Varad
>>
>>
>>
>> On Thu, Jun 16, 2011 at 8:47 PM, Rich Megginson <rmeggins(a)redhat.com>wrote:
>>
>>> On 06/16/2011 07:33 AM, s.varadha rajan wrote:
>>>
>>> Hi,
>>>
>>> For me no issues to recive the logs.anyway, i have performed the
>>> following steps again,
>>>
>>> 1.Stop the "dirsrv" on both sides.
>>> 2.Enabled "nsslapd-errorlog-level: 8192" on both servers in "dse.ldif"
>>> file.
>>> 3.Started the "dirsrv" on both servers.
>>> 4.Export the datas in .ldif and imported to "sam" system
>>> 4.From "varad.xxx.xxx.com,Remove the agreement again (./mmr.pl --host1
>>> varad.xxx.xxx.com --host2 sam.xxx.xxx.com --host1_id 1 --host2_id 2
>>> --bindpw <password> --repmanpw <password> --remove)
>>> 5.From "varad.xxx.xxx.com,Created agreement again (./mmr.pl --host1
>>> varad.xxx.xxx.com --host2 sam.xxx.xxx.com --host1_id 1 --host2_id 2
>>> --bindpw <password> --repmanpw <password> --create)
>>> 6.Then created one user under "ou=people" , as a uid=TT in supplier side
>>> (varad.xxx.xxx.com)
>>> 7.but not replicated in other system...
>>>
>>> Supplier system (/var/log/dirsrv/slapd-varad/errors): (
>>> varad.xxx.xxx.com):
>>>
>>> [16/Jun/2011:18:36:48 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): Disconnected from the consumer
>>> [16/Jun/2011:18:36:48 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: start -> ready_to_acquire_replica
>>> [16/Jun/2011:18:36:48 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: ready_to_acquire_replica -> wait_for_changes
>>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: wait_for_changes -> wait_for_changes
>>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: wait_for_changes -> start
>>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): No linger to cancel on the connection
>>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): Disconnected from the consumer
>>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: start -> ready_to_acquire_replica
>>> [16/Jun/2011:18:41:49 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from varad.xxx.xxx.com port 389 to sam.xxx.xxx.comport 389"" (sam:389): State: ready_to_acquire_replica -> wait_for_changes
>>>
>>> Consumer system: (sam.xxx.xxx.xom):
>>>
>>> [16/Jun/2011:18:46:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): Disconnected from the consumer
>>> [16/Jun/2011:18:46:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: start -> ready_to_acquire_replica
>>> [16/Jun/2011:18:46:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: ready_to_acquire_replica -> wait_for_changes
>>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: wait_for_changes -> wait_for_changes
>>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: wait_for_changes -> start
>>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): No linger to cancel on the connection
>>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): Disconnected from the consumer
>>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: start -> ready_to_acquire_replica
>>> [16/Jun/2011:18:51:15 +051800] NSMMReplicationPlugin -
>>> agmt="cn="Replication from sam.xxx.xxx.com port 389 to varad.xxx.xxx.comport 389"" (varad:389): State: ready_to_acquire_replica -> wait_for_changes
>>>
>>> So,please let me know what is the problem ? and how to resolve ?
>>>
>>> on the supplier
>>> ldapsearch -x -D "cn=directory manager" -W -b cn=config
>>> '(objectclass=nsds5replicationagreement)'
>>>
>>>
>>> Regards,
>>> Varad
>>>
>>>
>>> On Wed, Jun 15, 2011 at 7:41 PM, Rich Megginson <rmeggins(a)redhat.com>wrote:
>>>
>>>> On 06/14/2011 11:59 PM, s.varadha rajan wrote:
>>>>
>>>> Hi,
>>>>
>>>> Thanks for the reply.that's ok.but if i create one new user in
>>>> supplier side,it's not replicating to consumer side.i think ubuntu 10.04 LTS
>>>> supports fedora-ds 1.1.x and dont have updated ppa links. for this case,
>>>> shall i upgrade the latest version, will give the solution? After upgrade,
>>>> how can i migrate my existing data.
>>>>
>>>> First check your errors log on your supplier side to see if there are
>>>> any errors during the incremental update phase (the messages below are from
>>>> the init phase), then check the access log on the consumer side to see if
>>>> the supplier is connecting and attempting to send the new user.
>>>>
>>>> If that shows nothing, then try enabling the replication log level -
>>>> http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting
>>>>
>>>>
>>>> or give me a solution for this.
>>>>
>>>> Regards,
>>>> Varad
>>>>
>>>>
>>>> On Tue, Jun 14, 2011 at 8:26 PM, Rich Megginson <rmeggins(a)redhat.com>wrote:
>>>>
>>>>> On 06/14/2011 08:23 AM, s.varadha rajan wrote:
>>>>>
>>>>> Hi,
>>>>>
>>>>> I followed the procedure to configure "multi-master replication" as
>>>>> per
>>>>> http://directory.fedoraproject.org/wiki/Howto:MultiMasterReplication.
>>>>> but i got an error as
>>>>>
>>>>> *From consumer side:*
>>>>>
>>>>> 14/Jun/2011:19:25:41 +051800] NSMMReplicationPlugin -
>>>>> multimaster_be_state_change: replica o=netscaperoot is coming online;
>>>>> enabling replication
>>>>> [14/Jun/2011:19:25:41 +051800] NSMMReplicationPlugin -
>>>>> replica_reload_ruv: Warning: new data for replica o=netscaperoot does not
>>>>> match the data in the changelog.
>>>>> Recreating the changelog file. This could affect replication with
>>>>> replica's consumers in which case the consumers should be reinitialized.
>>>>>
>>>>> This is not an error. It just means the consumer has been initialized
>>>>> with data from the master, and it had old data (probably from setup) which
>>>>> was wiped out.
>>>>>
>>>>>
>>>>> *From Supplier side:*
>>>>>
>>>>> [14/Jun/2011:19:26:12 +051800] NSMMReplicationPlugin - Beginning total
>>>>> update of replica "agmt="cn="Replication from varad.xxx.xxx.com port
>>>>> 389 to sam.xxx.xxx.com port 389"" (sam:389)".
>>>>> [14/Jun/2011:19:26:15 +051800] NSMMReplicationPlugin - Finished total
>>>>> update of replica "agmt="cn="Replication from varad.xxx.xxx.com port
>>>>> 389 to sam.xxx.xxx.com port 389"" (sam:389)". Sent 120 entries.
>>>>>
>>>>>
>>>>> We are using the OS-Ubuntu 10.04. I searched in google and got the
>>>>> some result in "https://bugzilla.redhat.com/show_bug.cgi?id=388021".
>>>>> but i dont know how to fix this.Please help on this.
>>>>>
>>>>> Regards,
>>>>> Varad
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Mon, May 30, 2011 at 12:27 PM, s.varadha rajan <
>>>>> rajanvaradhu(a)gmail.com> wrote:
>>>>> >
>>>>> > Hi,
>>>>> >
>>>>> > Thanks for the reply.I will try and update you further.
>>>>> >
>>>>> > Regards,
>>>>> > Varad
>>>>> >
>>>>> >
>>>>> >
>>>>> > On Fri, May 27, 2011 at 8:30 PM, Rich Megginson <rmeggins(a)redhat.com>
>>>>> wrote:
>>>>> >>
>>>>> >> On 05/27/2011 12:11 AM, s.varadha rajan wrote:
>>>>> >>
>>>>> >> Hi,
>>>>> >>
>>>>> >> Can i get any update on my below query ?
>>>>> >>
>>>>> >> Regards,
>>>>> >> Varad
>>>>> >>
>>>>> >> On Tue, May 24, 2011 at 6:17 PM, s.varadha rajan <
>>>>> rajanvaradhu(a)gmail.com> wrote:
>>>>> >>>
>>>>> >>> Hi,
>>>>> >>> We are using Ubuntu 10.04 server OS and all the web applications
>>>>> are running on that.We have already implemented fedora-ds for ldap auth.now
>>>>> we are planning to go some up-gradation.kindly let me know the following,
>>>>> >>> 1.How to migrate running fedora-ds server to another server ?
>>>>> >>> 2.i have taken all the user/group+etc in ldif format.is it enough
>>>>> for migration or any other db (/var/lib/dirsrv/slapd-<instance>) also need
>>>>> to bacup ?
>>>>> >>
>>>>> >> LDIF should be fine.
>>>>> >>>
>>>>> >>> if any procedure please share with me ? how to import/export .ldif
>>>>> file
>>>>> >>
>>>>> >> /usr/lib[64]/dirsrv/slapd-INSTNAME/db2ldif - export database to ldif
>>>>> >> /usr/lib[64]/dirsrv/slapd-INSTNAME/ldif2db - import database from
>>>>> ldif
>>>>> >>>
>>>>> >>> 3.in our setup,one server is in public network.so i am planning to
>>>>> do replication through "ldaps", i.e local server to public server
>>>>> replication through highly secure how to ?
>>>>> >>
>>>>> >> Not exactly, but there is plenty of documentation - see
>>>>> http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-singl...
>>>>> >>>
>>>>> >>> Please help me on the above topics.
>>>>> >>> Regards,
>>>>> >>> Varad
>>>>> >>
>>>>> >> --
>>>>> >> 389 users mailing list
>>>>> >> 389-users(a)lists.fedoraproject.org
>>>>> >> https://admin.fedoraproject.org/mailman/listinfo/389-users
>>>>> >
>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>
12 years, 10 months
issues installing in RHEL6.1
by Paul Robert Marino
Ive been trying to install on 389 RHEL 6.1 and i keep geting dependency
errors
This is the last error thats hanging me up and i know its just an
incorrect dependency in the spec file or a package that has not updated
in the repo yet
see below
"
yum install 389-ds --enablerepo=epel-389-ds-base
..
...
...
...
--> Finished Dependency Resolution
Error: Package: 389-ds-1.2.1-1.el6.noarch (epel)
Requires: 389-ds-console-doc
Error: 389-ds-base conflicts with selinux-policy-targeted
Error: Package: 389-ds-1.2.1-1.el6.noarch (epel)
Requires: 389-ds-console
You could try using --skip-broken to work around the problem
You could try running: rpm -Va --nofiles --nodigest
[root@lnn1214 ~]# yum search 389-ds-console
Loaded plugins: rhnplugin
Warning: No matches found for: 389-ds-console
No Matches found
[root@lnn1214 ~]# yum install 389-ds-console --enablerepo=epel-389-ds-base
Loaded plugins: rhnplugin
Setting up Install Process
No package 389-ds-console available.
Error: Nothing to do
[root@lnn1214 ~]# yum search 389-ds-console --enablerepo=epel-389-ds-base
Loaded plugins: rhnplugin
Warning: No matches found for: 389-ds-console
No Matches found
[root@lnn1214 ~]# yum search 389-console --enablerepo=epel-389-ds-base
Loaded plugins: rhnplugin
=====================================================================================
N/S Matched: 389-console
======================================================================================
389-console.noarch : 389 Management Console
Name and summary matches only, use "search all" for everything.
"
This is the last error thats hanging me up
12 years, 10 months
Help getting an Ubuntu Client to work with 389 Directory Server - specifically Ubuntu 11.04 (GNU/Linux 2.6.38-8-server x86_64)
by Clint Dilks
Hi,
Can anyone point me to some good documentation that shows how to get Ubuntu
11.04 (GNU/Linux 2.6.38-8-server x86_64) working as a client with 389
Directory Server?
I have tried following
https://help.ubuntu.com/community/FedoraDirectoryServerClientHowto
but it seems to be old. /etc/pam_ldap.conf being replaced by
/etc/ldap.conf.
>From my experience setting up CentOS clients I expected there to also be a
config file similar to /etc/openldap/ldap.conf. It appears this is
/etc/ldap/ldap.conf.
I have also looked at
https://help.ubuntu.com/community/LDAPClientAuthentication
I then came across
https://help.ubuntu.com/11.04/serverguide/C/openldap-server.html#openldap...
And did
sudo dpkg-reconfigure ldap-auth-config
sudo auth-client-config -t nss -p lac_ldap
sudo pam-auth-update
Currently a getent passwd or getent group is not returning any results from
ldap. We can see the client making connections but it doesn't seem to be
asking for any information.
ldapsearch -vv -x -b 'ou=Active,ou=People,dc=cms,
dc=waikato,dc=ac,dc=nz' '(objectclass=*)' appears to work correctly.
Below are the two main config files
cat /etc/ldap.conf | grep -v '^#' | grep -v '^$'
base ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz
ldap_version 3
pam_member_attribute uniquemember
pam_password clear
uri ldap://inf2.cms.waikato.ac.nz/
tls_cacertdir /etc/ssl/certs
pam_password_prohibit_message Please visit
https://secure.scms.waikato.ac.nz/password/ to change your password.
ssl start_tls
nss_base_passwd ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz?sub
nss_base_shadow ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz?sub
nss_base_group ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz?sub
nss_base_netgroup ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz?sub
nss_map_attribute uniqueMember memberUid
nss_initgroups_ignoreusers
avahi,backup,bin,daemon,games,gnats,irc,landscape,libuuid,list,lp,mail,man,messagebus,nagios,news,ntp,postfix,proxy,root,sshd,sync,sys,syslog,uucp,www-data
nss_reconnect_tries 5 # no. of times to double the sleep time
nss_reconnect_sleeptime 4 # initial sleep value
nss_reconnect_maxsleeptime 64 # max sleep value to cap at
nss_reconnect_maxconntries 2
cat /etc/ldap/ldap.conf | grep -v '^#' | grep -v '^$'
URI ldap://inf2.cms.waikato.ac.nz/
BASE ou=Active,ou=People,dc=cms,dc=waikato,dc=ac,dc=nz
TLS_CACERTDIR /etc/ssl/certs
>From /var/log/auth we see
Jun 22 13:52:28 wdm2 getent: nss_ldap: reconnecting to LDAP server...
Jun 22 13:52:28 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping
4 seconds)...
Jun 22 13:52:32 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping
8 seconds)...
Jun 22 13:56:50 wdm2 getent: nss_ldap: reconnecting to LDAP server...
Jun 22 13:56:50 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping
4 seconds)...
Jun 22 13:56:54 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping
8 seconds)...
Jun 22 13:57:02 wdm2 getent: nss_ldap: reconnecting to LDAP server (sleeping
16 seconds)...
To see all config files go to
http://www.scms.waikato.ac.nz/~clintd/ubuntu-ldap/etc/
Thank you for any insight you can offer relating to this issue.
12 years, 10 months
Re: [389-users] win sync error
by solarflow99
On Tue, Jun 21, 2011 at 1:39 PM, Rich Megginson <rmeggins(a)redhat.com> wrote:
> **
> On 06/21/2011 11:23 AM, solarflow99 wrote:
>
> I'm using self signed certs, did I miss something?
>
> Probably. There are many steps involved in getting winsync to use
>> TLS/SSL to talk to AD, and getting AD PassSync to use TLS/SSL to talk to
>> DS. Which
>>
>
> From the Docs listed online:
> http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.1/html/Admin...
>
> The 8.2 docs are better
>
> http://docs.redhat.com/docs/en-US/Red_Hat_Directory_Server/8.2/html-singl...
>
> and I went over everything else I could possibly find too. It seems in the
> case of self signed certificates,
>
> Are you talking about self signed certs for 389 or for AD?
>
I guess that would be both. This is all internal so no servers need real
third party signed certificates, just trying to get it to work.
> the windows CA has to exported as a .cer file, and imported in 389 with:
> certutil -d . -A -n "AD Cert" -t "CTu,u,u" -i ad-cert.cer
>
> Yes, that is correct. So what's the problem?
>
It wasn't mentioned anywhere, so once I guessed what had to be done, now i'm
getting a different error:
# /usr/lib64/mozldap/ldapsearch -v -Z -P
/etc/dirsrv/slapd-ldapserver/cert8.db -h 10.10.10.210 -p 636 -D
"cn=administrator" -w mypassword -b "cn=users,dc=389testdomain,dc=local"
"objectclass=*"
ldapsearch: started Tue Jun 21 08:41:15 2011
ldap_init( 10.10.10.210, 636 )
ldaptool_getcertpath -- /etc/dirsrv/slapd-ldapserver/cert8.db
ldaptool_getkeypath -- /etc/dirsrv/slapd-ldapserver/cert8.db
ldaptool_getmodpath -- (null)
ldaptool_getdonglefilename -- (null)
ldap_simple_bind: Invalid credentials
ldap_simple_bind: additional info: 80090308: LdapErr: DSID-0C0903A9,
comment: AcceptSecurityContext error, data 52e, v1db1
12 years, 10 months