Problem browsing LDAP with Outlook
by Chris Bryant
When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS.
When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well.
I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also.
Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration.
Thanks,
Chris
USA.NET
You Run Your Business. We'll Run Your Email.
This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.
3 years
SO kills ns-ldapd because of memory usage
by Moisés Barba Pérez
Hi,
I have a memory issue with 389-ds 1.2.5 in a CentOS 5.5 64bits 4GB ram.
The server swaps when the server physical memory increase over 75% approx.
When the swap is full the server reaches 100% of physical memory and the SO
kills the ns-ldapd process.
Out of memory: Killed process 30383, UID 99, (ns-slapd).
The cache sizes are:
nsslapd-dbcachesize: 838860800
nsslapd-import-cachesize: 20000000
nsslapd-cachememsize: 125829120 (for each 26 db)
Which can be the problem?
10 years, 9 months
389 <=> AD group sync
by Vesa Alho
Hi,
I'm testing group sync between 389ds and Microsoft AD. It works
otherwise, but incremental updates are not working. Any changes to
groups on 389 side do not get synced to AD unless I do a full manual
update triggered via console. Syncing users works normally. Would
someone have an idea why?
-Matti
10 years, 9 months
Scripts to analyze 389 directory server access logs?
by Justin Piszcz
Hello,
I've written a couple scripts to analyze these logs but was curious if
there were any open source ones to analyze the 389 directory server access
logs?
Its always good to see the various methods of analysis (especially if there
is any interpretation of what is found in the logs themselves).
Is there anything out there that folks use?
There is one on freshmeat but its for OpenLDAP only.
Justin.
10 years, 9 months
suggestion for Howto:ChainOnUpdate page
by Jovan.VUKOTIC@sungard.com
Hi,
In case you follow instructions from ChainOnUpdate page, http://directory.fedoraproject.org/wiki/Howto:ChainOnUpdate
note that in "Step 2 (Hub Only)" OID for
nsTransmittedControl: 2.16.840.1.113730.3.4.12
representing a proxied authorization control is an old OID of the control which newer version (version 2) is
2.16.840.1.113730.3.4.18
Hence, at least in my 389 DS, version 1.2.10.7, which rootDSE has the newer OID of the control among its supportedcontrol values it was required that
dn: cn=config,cn=chaining database,cn=plugins,cn=config
has
nsTransmittedControl: 2.16.840.1.113730.3.4.18
Otherwise, I kept receiving "Critical extension is unavailable (12)" error
Hope this may be helpful to someone.
Thanks,
Jovan
10 years, 9 months
Password Expiration Time
by Tariq Kmail
I am using php to change the password for my ldap users, and now I am trying to enable the password expiration policy
But when I enable it, most of the users became blocked users because they did not change their password recently.
I want to unlock them using php or ldap automatically.. what are the attributes needed to solve this problem?
I tried to reset passwordexpirationtime to be in the future for all of them, but this did not work to unblock them
Any help please?
Thanks
10 years, 9 months
chain on update by ldapmodify problem
by Jovan.VUKOTIC@sungard.com
Hi,
I have two Directory Servers (1.2.10.7 version) configured in single master replication topology over TLS/SSL encrypted line.
Replication works fine, but I cannot have chain on update work although I have set both servers as per http://www.directory.fedora.redhat.com/wiki/Howto:ChainOnUpdate
page.
I have tested the functionality with openldap ldapmodify tool with
-e !authzid
general extension, but I keep receiving an error for which I could not find anything about
"authzid=: Event not found":
# ldapmodify -x -H ldaps://asp.com:636 -D "uid=rmanager,cn=config" -w secret -e !authzid="dn:uid=amisovic,ou=people,dc=asp,dc=com" -f amisovic_upd.ldif
authzid=: Event not found.
Any help will be appreciated! Thanks!
Jovan
10 years, 9 months
ACI for single user access
by James Chamberlain
I'm trying to figure out how to write an ACI which would allow one
user to read a particular branch of the directory, but deny all
others. If I specify it as two rules - one denying access to
everyone, the other granting access to this user - no one can read
that branch. If I specify it as a single rule, that this user can
read this branch, it's not imposing any new restrictions and everyone
can read the branch. I've tried reading the documentation and didn't
see this example listed. Can anyone point me in the right direction?
Thanks,
James
10 years, 10 months
NSMMReplicationPlugin - repl_set_mtn_referrals
by Andreas Kekkou
Hi,
I have recently deleted and recreated the MMR between my two server and
since then the following message is appearing in the error log:
NSMMReplicationPlugin - repl_set_mtn_referrals: could not set referrals
for replica dc=xxx,dc=xxx,dc=xxx,dc=xxx: 32
When the MMR has been deleted the referrals has not been cleared
automatically and I have removed them manually, but I don't remember
exactly the syntax. I need some help adding them back.
Regards,
Andreas
10 years, 10 months
db2* backup scripts - location and recreating
by Orion Poplawski
Couple related issue around the generated db2* and similar scripts in
/usr/lib{,64}/dirsrv/slapd-%{instance}.
- Can these be recreated easily without messing with an otherwise working
instance?
- I think this is a bad location to put generated files. I would suggest
/var/lib/dirsrv/slapd-%{instance}/bin instead. The use of /usr seems to
violate the FHS:
http://www.pathname.com/fhs/pub/fhs-2.3.html#THEUSRHIERARCHY
/usr is the second major section of the filesystem. /usr is shareable,
read-only data. That means that /usr should be shareable between various
FHS-compliant hosts and must not be written to. Any information that is
host-specific or varies with time is stored elsewhere.
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA, Boulder Office FAX: 303-415-9702
3380 Mitchell Lane orion(a)nwra.com
Boulder, CO 80301 http://www.nwra.com
10 years, 10 months