confused about how to create nsslapd backends
by Jon Detert
Hello,
I have 3 root-suffixes served by 1 instance of slapd in fedora-ds v1.0.4 :
dc=example,dc=com
o=example.com
o=NetscapeRoot
I'm trying to import them into an instance of 389-ds v1.2.10, but I can only get the 1st one imported. This is how I did that:
1) run 'setup-ds' for dc=example,dc=com
2) import the dumped ldif for that root-suffix by runnint this: 'ldapmodify -h localhost -cax -S ~/import.errors -D "cn=directory manager" -W -f ~/dc-example-dc-com.ldif
To create the next 2 root-suffixes, I assumed I should not run setup-ds again, because I don't want another slapd instance. Instead, I try to create them with like this (leaving the last out for brevity):
ldapmodify -avv -h localhost -D cn="Directory Manager" -W <<EOI
dn: cn="o=example.com",cn=mapping tree,cn=config
objectclass: top
objectclass: extensibleObject
objectclass: nsMappingTree
nsslapd-state: backend
nsslapd-backend: ihcComRoot
cn: o=example.com
EOI
However, when I try to import the data from the o=example.com suffix:
a) ldapmodify fails every record with "760 # Error: No such object (32)", and
b) the error log for this slapd instance says this once for every record:
"Warning: Mapping tree node entry for o=example.com point to an unknown backend : ihcComRoot", where "ihcComRoot" is the nsslapd backend I used in the ldapmodify command above.
Any ideas what I'm doing wrong?
Thanks,
--
Jon Detert
Sr. Systems Administrator
Infinity Healthcare
Milwaukee, Wisconsin
414-290-6759
11 years, 3 months
How to set up 389 client
by Chaudhari, Rohit K.
Hello everyone,
How do I set up a 389 LDAP client to authenticate users against a 389 LDAP server? I don't have a trusted certificate authority (CA) but will create self-signed CA that signs server certificates, and then put that self-signed CA as the trusted CA on the client side. Is there anything more specific or a guide on how to set this up out there? Thanks in advance.
Rohit
11 years, 3 months
How to shrink cn=changelog db
by Picture Book
Setting nsslapd-changelogmaxage to shorter time will not automatically shrink cn=changelog db.
Is it ok to recreate cn=changelog db by:
1. turn off retro changelog plugin
2. restart DS
3. delete cn=changelog database
4. restart DS
5. enable cn=changelog, set nsslapd-changelogmaxage
6. restart DS
Thanks.
11 years, 3 months
replication with some attributes excluded leads to schema violation
by Petr Spacek
Hello 389 users and developers,
I would be very happy if somebody could give me any advice about "the right
way" to solve this problem:
I have following objectClass in the schema:
objectClasses: ( 2.16.840.1.113730.3.8.6.1 NAME 'idnsZone' DESC 'Zone class'
SUP idnsRecord STRUCTURAL MUST ( idnsName $ idnsZoneActive $ idnsSOAmName $
idnsSOArName $ idnsSOAserial $ idnsSOArefresh $ idnsSOAretry $ idnsSOAexpire $
idnsSOAminimum ) MAY ( idnsUpdatePolicy $ idnsAllowQuery $ idnsAllowTransfer $
idnsAllowSyncPTR $ idnsForwardPolicy $ idnsForwarders ) )
Please note MUST attribute idnsSOAserial.
I have two 389 servers on RHEL 6.4 with the same schema:
389-ds-base-1.2.11.15-10.el6.x86_64
There is multi master replication agreement between machines vm-115<->vm-042.
Attribute idnsSOAserial is excluded from incremental replication (export from
vm-042):
cn=meTovm-115,cn=replica,cn=dc\3Dexample,cn=mapping tree,cn=config
idnsSOAserial: (objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn
krblastsuccessfulauth krblastfailedauth krbloginfailedcount
nsDS5ReplicatedAttributeListTotal: (objectclass=*) $ EXCLUDE entryusn
krblastsuccessfulauth krblastfailedauth krbloginfailedcount
Now I create a new object with objectClass idnsZone on vm-042. The new object
is replicated to vm-115, but the attribute idnsSOAserial is missing - and this
fact violates the schema.
Is it expected behaviour?
What I misunderstood?
Which approach you recommend to application developers for dealing with such
situation?
I don't like the approach where application have to go to *all* DS to
initialize the excluded attribute, because:
What the application should do if it's unable to connect to one of DSs?
What if rollback is impossible? (E.g. attribute was initialized on replica1
and replica2 but the link from application to the world failed before replica3
was initialized.)
Would it be possible to configure DS to replicate the attribute when object is
created but not replicate further changes? It would defer all problems above
to DS replication mechanism and simplify applications :-)
Thank you for your time!
I'm not subscribed to this list, please include me in Cc explicitly.
--
Petr Spacek
Software engineer
Red Hat Czech, BRQ
11 years, 3 months
seach cn=changelog notes=P
by Picture Book
Hi,
What's the meaning of "notes=P" in access log search result?
After "Retro Changelog plugin" is enable,
[13/Jan/2013:14:34:59 -0500] conn=4161 fd=64 slot=64 SSL connection from to
[13/Jan/2013:14:34:59 -0500] conn=4161 op=0 BIND dn="uid=somebody" method=128 version=3
[13/Jan/2013:14:34:59 -0500] conn=4161 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=somebody"
[13/Jan/2013:14:34:59 -0500] conn=4161 op=1 SRCH base="cn=changelog" scope=1 filter="(changeNumber>=1570)" attrs=ALL
[13/Jan/2013:14:34:59 -0500] conn=4161 op=1 RESULT err=0 tag=101 nentries=0 etime=0 notes=P
[13/Jan/2013:14:34:59 -0500] conn=4161 op=-1 fd=64 closed - B1
11 years, 3 months
dirsrv won't start
by Doug Tucker
So I've gone from bad to worse. Googling and googling and no response
on my auth issue from the list yesterday, I coudn't stand doing
nothing. The only thing I saw that made me curious was some thread
where a guy could not auth and he changed the password hash to something
else and it worked. I looked at our current password hash in openldap
and it was ssha. For the life of me I could not find how to see what
the current one was in 389. The only thing I could find in the docs was
how to set a password policy which allowed you to set the hash. So I
did so according to the documentation on the Users cn. The only thing I
did was turn it on, and make sure password hash was set to ssha. I left
the rest default which was no expiration, etc. I saved, and tried to
restart according to the docs, it woudn't restart. I shut down with the
init script instead, and tried to start, and now I get this:
[root@lyleauth1 schema]# /etc/init.d/dirsrv start
Starting dirsrv:
lyleauth1...[09/Jan/2013:16:23:05 -0600] dse_read_one_file - The
entry cn=schema in file /etc/dirsrv/slapd-lyleauth1/schema/99user.ldif
(lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type
olcOverlay: Missing parent attribute syntax OID
[09/Jan/2013:16:23:05 -0600] dse - Please edit the file to correct the
reported problems and then restart the server.
[FAILED]
*** Warning: 1 instance(s) failed to start
Looking at the time stamp on that file, it is: Dec 20 16:36 99user.ldif
. So what I did yesterday did not touch it. Anyone have any idea how
to fix this?
--
Sincerely,
Doug Tucker
11 years, 3 months
id works, cannot auth though
by Doug Tucker
I still can't seem to figure out how to import my groups to 389 from
openldap, but the users transferred fine. However moving forward, I
created a group manually in 389 and added my username to the group. Now
from my client, if I do: id tuckerd, i get the results I'm looking for:
# id tuckerd
uid=4011(tuckerd) gid=500(seasadm) groups=500(seasadm)
However, attempts to log in at the console with tuckerd it fails
authentication. On this clients in secure.log I get this:
Jan 9 13:06:18 asteriskvm sshd[4546]: pam_sss(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
rhost=172.16.76.1 user=tuckerd
Jan 9 13:06:18 asteriskvm sshd[4546]: pam_sss(sshd:auth): received for
user tuckerd: 4 (System error)
Jan 9 13:06:19 asteriskvm sshd[4546]: Failed password for tuckerd from
172.16.76.1 port 57093 ssh2
Jan 9 13:06:33 asteriskvm sshd[4546]: pam_sss(sshd:auth):
authentication failure; logname= uid=0 euid=0 tty=ssh ruser=
rhost=172.16.76.1 user=tuckerd
Jan 9 13:06:33 asteriskvm sshd[4546]: pam_sss(sshd:auth): received for
user tuckerd: 9 (Authentication service cannot retrieve authentication info)
Jan 9 13:06:35 asteriskvm sshd[4546]: Failed password for tuckerd from
172.16.76.1 port 57093 ssh2
Jan 9 13:06:36 asteriskvm sshd[4547]: Connection closed by 172.16.76.1
Jan 9 13:06:36 asteriskvm sshd[4546]: PAM 1 more authentication
failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.16.76.1 user=tuckerd
I have changed the password in 389 for tuckerd and am confident it is
being typed correctly.
[09/Jan/2013:13:10:48 -0600] conn=2458 fd=64 slot=64 connection from
129.119.103.59 to 129.119.113.231
[09/Jan/2013:13:10:48 -0600] conn=2458 op=0 SRCH base="" scope=0
filter="(objectClass=*)" attrs="* altServer namingContexts
supportedControl supportedExtension supportedFeatures
supportedLDAPVersion supportedSASLMechanisms defaultnamingcontext
lastusn highestcommittedusn aci"
[09/Jan/2013:13:10:48 -0600] conn=2458 op=0 RESULT err=0 tag=101
nentries=1 etime=0
[09/Jan/2013:13:10:48 -0600] conn=2458 op=1 BIND dn="" method=128 version=3
[09/Jan/2013:13:10:48 -0600] conn=2458 op=1 RESULT err=0 tag=97
nentries=0 etime=0 dn=""
[09/Jan/2013:13:10:48 -0600] conn=2458 op=2 SRCH
base="dc=engr,dc=smu,dc=edu" scope=2
filter="(&(uid=tuckerd)(objectClass=posixAccount))" attrs="objectClass
uid userPassword uidNumber gidNumber gecos homeDirectory loginShell
krbprincipalname cn modifyTimestamp modifyTimestamp shadowLastChange
shadowMin shadowMax shadowWarning shadowInactive shadowExpire shadowFlag
krblastpwdchange krbpasswordexpiration pwdAttribute authorizedService
accountexpires useraccountcontrol nsAccountLock host logindisabled
loginexpirationtime loginallowedtimemap"
[09/Jan/2013:13:10:48 -0600] conn=2458 op=2 RESULT err=0 tag=101
nentries=1 etime=0
[09/Jan/2013:13:10:48 -0600] conn=2458 op=3 SRCH
base="dc=engr,dc=smu,dc=edu" scope=2
filter="(&(memberUid=tuckerd)(objectClass=posixGroup)(cn=*)(&(gidNumber=*)(!(gidNumber=0))))"
attrs="objectClass cn userPassword gidNumber memberUid modifyTimestamp
modifyTimestamp"
[09/Jan/2013:13:10:48 -0600] conn=2458 op=3 RESULT err=0 tag=101
nentries=1 etime=0 notes=U,P
[09/Jan/2013:13:10:48 -0600] conn=2459 fd=65 slot=65 connection from
129.119.103.59 to 129.119.113.231
[09/Jan/2013:13:10:48 -0600] conn=2459 op=0 EXT oid="1.3.6.1.4.1.1466.20037"
[09/Jan/2013:13:10:48 -0600] conn=2459 op=0 RESULT err=2 tag=120
nentries=0 etime=0
[09/Jan/2013:13:10:48 -0600] conn=2459 op=-1 fd=65 closed error 34
(Numerical result out of range) - B2
Which has to be the most cryptic error logging I've ever seen :). Can
anyone help me make sense of this and what it means?
--
Sincerely,
Doug Tucker
11 years, 3 months
request for access logs...
by Mark Reynolds
I'm working on some improvements to the logconv.pl script (access log
analyzer) - particularly memory usage. I would be greatly interested in
getting some "real world" access logs to use for my testing - ideally
from a replication environment, with many clients, and unique search
filters and bases.
If anyone is interested in helping me out, please email me directly.
Thanks,
Mark
--
Mark Reynolds
Red Hat, Inc
mreynolds(a)redhat.com
11 years, 3 months
Swap Master Hardware.
by Shardul Kerkar
Hi Folks,
I have recently been tasked with moving a Single Ldap Master from a dying machine to a spanking new blade. After doing some research it appears to me that the optimum way to do this will be installing a fresh instance of the application on the new server, import the database and then recreate and reinitialize all the hubs and replicas. The problem I face is that this work place has a humongous LDAP database will 3 mil+ entries. Re-initialization is taking upto 3 hours in some cases. With 5 hubs and 20 replicas to reinitialize, the downtime is unacceptable to the client.
If I stop writes to the Master, then export the database to the new box and recreate the New-Master-Hub replication after removing the old Master , will I still need to re-initialize the hubs? Is there any way to do this swap without reinitializing or fooling the hubs and reps into thinking that they are still talking to the same Master albeit on a new machine (same ip address/dns).
The client is still using ver. 1.1.2 on Centos 5.4
Thanks,
Shar Ker
11 years, 3 months