389-users June 2013

389-users@lists.fedoraproject.org

29 participants
28 discussions

DES hash values in replicationAgreement with Simple Bind
by Jovan.VUKOTIC＠sungard.com 21 Jun '13

21 Jun '13

Hi, We have four 389 DS masters, version 1.2.11 that we are organizing in multi-master replication topology. On one host we do not have admin server and consequently do not have an option to use 389 Management Console to configure replication agreements. I configured it from the command line as per Administration Guide( replication manager, changelog, supplier replica and replication agreements entries), but could not establish connection to neither servers from the Agreement due to Invalid credentials error (49). I suspect the problem is DES hash of nsDS5ReplicaCredentials attribute value. I copied it from another Replication Agreement from the other DS instance pointing to the same Multi-Master replica. That replication Agreement was created in 389 Console and worked fine (i.e. replica got acquired). Hence, I thought since the replication manager entry is the same, copied DES hash would be OK. It did not work. Furthermore, when compared with the DES hash created for that very replication manager entry on the third server( again via 389 Console, just for the sake of the test) it turned out to be different. Do you know any command analog to pwdhash that can generate hash in DES format? If not, how then to provide nsDS5ReplicaCredentials attribute value of replication agreement entry? FY reference, I used the following entry to do create Replication agreement: dn: cn=rAgrmnt1,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn =config objectClass: top objectClass: nsDS5ReplicationAgreement description: inst1 supplies inst2 cn: rAgrmnt1 nsDS5ReplicaRoot: dc=example,dc=com nsDS5ReplicaHost: consumer.replica.com nsDS5ReplicaPort: 389 nsDS5ReplicaBindDN: uid=ReplManager,cn=config nsDS5ReplicaTransportInfo: TLS nsDS5ReplicaBindMethod: SIMPLE nsDS5ReplicaCredentials: {DES}secret //copied from another servers dse.ldif file, from its agreement with the same nsDS5ReplicaHost I will appreciate any help. Thank you Jovan Vukotić * Senior Software Engineer * Ambit Treasury Management * SunGard * Banking * Bulevar Milutina Milankovića 136b, Belgrade, Serbia * tel: +381.11.6555-66-1 * jovan.vukotic(a)sungard.com<mailto:jovan.vukotic@sungard.com> [Description: Description: Description: Description: Description: coc-signature-03-2012]<http://www.capitalize-on-change.com/?email=70150000000Y1Et> Join the online conversation with SunGard's customers, partners and Industry experts and find an event near you at: www.sungard.com/ten<http://www.capitalize-on-change.com/?email=70150000000Y1Et>.

2 2

svn authentication
by Elizabeth Jones 20 Jun '13

20 Jun '13

Have any of you run into problems using 389 DS for svn ldap authentication? I just discovered that our svn instance is not authenticating successfully with our 389 DS, although I can see from tcpdumps that it is successfully pulling the password back. I'm wondering if there is something in the 389 DS that needs to be configured for svn that I haven't been able to find yet. thanks, Elizabeth J

3 4

List of errors
by Manel Gimeno Zaragozá 19 Jun '13

19 Jun '13

Hello, I'm having problems adding new users to a 389 -dirsrv form a web admin page, and this is what access the log shows when I send the order to add a new user to the LDAP: [19/Jun/2013:15:35:35 +0200] conn=1345 op=8 ADD dn="uid=test,ou=people,dc=new,dc=domain,dc=es" [19/Jun/2013:15:35:35 +0200] conn=1345 op=8 RESULT err=10 tag=105 nentries=0 etime=0 Also I paste all the transaccion log [19/Jun/2013:15:35:35 +0200] conn=1345 fd=72 slot=72 connection from 192.168.xx.xx to 192.168.xx.xx [19/Jun/2013:15:35:35 +0200] conn=1345 op=0 BIND dn="uid=new-service,ou=Special Users,dc=new,dc=domain,dc=es" method=128 version=3 [19/Jun/2013:15:35:35 +0200] conn=1345 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=new-service,ou=special users,dc=new,dc=domain,dc=es" [19/Jun/2013:15:35:35 +0200] conn=1345 op=1 BIND dn="cn=orcladmin" method=128 version=3 [19/Jun/2013:15:35:35 +0200] conn=1345 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=orcladmin" [19/Jun/2013:15:35:35 +0200] conn=1345 op=2 SRCH base="cn=config" scope=2 filter="(objectClass=vlvsearch)" attrs="* aci" [19/Jun/2013:15:35:35 +0200] conn=1345 op=2 RESULT err=0 tag=101 nentries=0 etime=0 [19/Jun/2013:15:35:35 +0200] conn=1345 op=3 SRCH base="cn=new,cn=config" scope=2 filter="(&(&(associatedDomain=*))(associatedDomain=new.domain.es))" attrs="* aci" [19/Jun/2013:15:35:35 +0200] conn=1345 op=3 RESULT err=0 tag=101 nentries=1 etime=0 [19/Jun/2013:15:35:35 +0200] conn=1345 op=4 BIND dn="uid=new-service,ou=Special Users,dc=new,dc=domain,dc=es" method=128 version=3 [19/Jun/2013:15:35:35 +0200] conn=1345 op=4 RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=new-service,ou=special users,dc=new,dc=domain,dc=es" [19/Jun/2013:15:35:35 +0200] conn=1345 op=5 BIND dn="cn=orcladmin" method=128 version=3 [19/Jun/2013:15:35:35 +0200] conn=1345 op=5 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=orcladmin" [19/Jun/2013:15:35:35 +0200] conn=1345 op=6 SRCH base="cn=config" scope=2 filter="(objectClass=vlvsearch)" attrs="* aci" [19/Jun/2013:15:35:35 +0200] conn=1345 op=6 RESULT err=0 tag=101 nentries=0 etime=0 [19/Jun/2013:15:35:35 +0200] conn=1345 op=7 SRCH base="cn=new,cn=config" scope=2 filter="(&(&(associatedDomain=*))(associatedDomain=new.domain.es))" attrs="* aci" [19/Jun/2013:15:35:35 +0200] conn=1345 op=7 RESULT err=0 tag=101 nentries=1 etime=0 [19/Jun/2013:15:35:35 +0200] conn=1345 op=8 ADD dn="uid=test,ou=people,dc=new,dc=domain,dc=es" [19/Jun/2013:15:35:35 +0200] conn=1345 op=8 RESULT err=10 tag=105 nentries=0 etime=0 [19/Jun/2013:15:35:35 +0200] conn=1345 op=9 UNBIND [19/Jun/2013:15:35:35 +0200] conn=1345 op=9 fd=72 closed - U1 My question is: how I know what "err=10" means? is there any error code table to know it? I've been searching but I was not able to find any answer. Thanks & Regards. Manel

2 1

changelog deadlock replication failures with DNA
by Mahadevan, Venkat 18 Jun '13

18 Jun '13

Hello, While doing multiple adds using POSIX uidNumbers and the DNA plugin, I have noticed errors such as the following: [12/Jun/2013:11:43:24 -0700] NSMMReplicationPlugin - changelog program - _cl5WriteOperationTxn: retry (49) the transaction (csn=51b8c148001e02be0000) failed (rc=-30994 (DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock)) [12/Jun/2013:11:43:24 -0700] NSMMReplicationPlugin - changelog program - _cl5WriteOperationTxn: failed to write entry with csn (51b8c148001e02be0000); db error - -30994 DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock [12/Jun/2013:11:43:24 -0700] NSMMReplicationPlugin - write_changelog_and_ruv: can't add a change for uid=jmeter429,dc=tst,dc=id,dc=ubc,dc=ca (uniqid: e62c908c-d38f11e2-96fdeacd-f14f05d6, optype: 16) to changelog csn 51b8c148001e02be0000 [12/Jun/2013:11:43:36 -0700] NSMMReplicationPlugin - changelog program - _cl5WriteOperationTxn: retry (49) the transaction (csn=51b8c154004002be0000) failed (rc=-30994 (DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock)) [12/Jun/2013:11:43:36 -0700] NSMMReplicationPlugin - write_changelog_and_ruv: can't add a change for uid=jmeter797,dc=tst,dc=id,dc=ubc,dc=ca (uniqid: e62c9143-d38f11e2-96fdeacd-f14f05d6, optype: 16) to changelog csn 51b8c154004002be0000 The net effect of these errors is that an entry will be added to the Replication master but will not sync down to any of the consumers. I am assuming because it is not added to the changelog database correctly. Doing a bit of research, I tracked this down: https://bugzilla.redhat.com/show_bug.cgi?format=multiple&id=907985 And there is also an advisory from RedHat that this bug has been fixed: https://rhn.redhat.com/errata/RHSA-2013-0742.html "A problem in the lock timing in the DNA plug-in caused a deadlock if the DNA operation was executed with other plug-ins. This update moves the release timing of the problematic lock, and the DNA plug-in does not cause the deadlock. (BZ#929196)" I am running RHEL 6.4 and 389-ds-base.x86_64 1.2.11.15-14.el6_4 @rhel-x86_64-server-6 So this bug should not be occurring? Should I upgrade to a version of 389-ds-base supplied by EPEL instead of Redhat? Any insight is most appreciated. Thank you. Kind regards, VM

3 10

compiling 389 DS
by Alberto Viana 17 Jun '13

17 Jun '13

Hello all, I´m trying to compile a new version of 389 DS (389-ds-base-1.3.0.4) and I´m getting this error: gcc -DHAVE_CONFIG_H -I. -DBUILD_NUM=\"2013.168.127\" "-DVENDOR=\"389 Project\"" -DBRAND=\"389\" -DCAPBRAND=\"389\" -UPACKAGE_VERSION -UPACKAGE_TARNAME -UPACKAGE_STRING -UPACKAGE_BUGREPORT -I./ldap/include -I./ldap/servers/slapd -I./include -I. -DLOCALSTATEDIR=\"/opt/dirsrv/var\" -DSYSCONFDIR=\"/opt/dirsrv/etc\" -DLIBDIR=\"/opt/dirsrv/lib\" -DBINDIR=\"/opt/dirsrv/bin\" -DDATADIR=\"/opt/dirsrv/share\" -DDOCDIR=\"/opt/dirsrv/share/doc/389-ds-base\" -DSBINDIR=\"/opt/dirsrv/sbin\" -DPLUGINDIR=\"/opt/dirsrv/lib/dirsrv/plugins\" -DTEMPLATEDIR=\"/opt/dirsrv/share/dirsrv/data\" -I/usr/include/nspr -I/usr/include/nss -I/usr/include/mozldap -I/usr/include/nss -I/usr/include/nspr -I/usr/include/nspr -I/usr/include/sasl -I/usr/include -I/usr/include/nspr -I/usr/include/nss -g -O2 -MT ldap/servers/slapd/libslapd_la-opshared.lo -MD -MP -MF ldap/servers/slapd/.deps/libslapd_la-opshared.Tpo -c ldap/servers/slapd/opshared.c -fPIC -DPIC -o ldap/servers/slapd/.libs/libslapd_la-opshared.o ldap/servers/slapd/opshared.c: In function âop_shared_searchâ: ldap/servers/slapd/opshared.c:470:16: error: âLDAP_CANCELLEDâ undeclared (first use in this function) ldap/servers/slapd/opshared.c:470:16: note: each undeclared identifier is reported only once for each function it appears in ldap/servers/slapd/opshared.c: In function âop_shared_log_error_accessâ: ldap/servers/slapd/opshared.c:1702:23: warning: format â%lluâ expects argument of type âlong long unsigned intâ, but argument 3 has type âPRUint64â [-Wformat] Also tried 389-ds-base-1.3.0.3 and 389-ds-base-1.2.11.19 with the same error. Can anyone point me how to fix it? Thanks. Alberto Viana

2 1

How to enable "directory browsing" and "Search People" in Outlook 2013?
by Christopher Cheng 16 Jun '13

16 Jun '13

I have setup 389 Server on CentOS and configure the followings. I am able to search with "Advanced Find" using Address Book, but when I click on the "Name only" in the search option, I cannot list all users in "ou=Peoples,dc=example,dc=com" and I cannot use the "Search People" in the ribbon bar to search for users. # Replace ldap:///all (authentified users) by ldap:///anyone (everyone, including anonymous) # old aci: (targetattr != "aci")(version 3.0; acl "VLV Request Control"; allow(read ,search, compare) userdn = "ldap:///all";) dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config changetype: modify replace: aci aci: (targetattr != "aci")(version 3.0; acl "VLV Request Control"; allow(read,search,compare) userdn = "ldap:///anyone";) # Add a special index for Outlook VLV dn: cn=Outlook Browse,cn=userRoot,cn=ldbm database,cn=plugins,cn=config changetype: add cn: Outlook Browse objectClass: top objectClass: vlvsearch aci: (targetattr != "aci")(version 3.0; acl "VLV Request Control"; allow(read,search,compare) userdn = "ldap:///anyone";) vlvBase: ou=Users,dc=example,dc=com vlvFilter: (&(mail=*)(cn=*)) vlvScope: 2 dn: cn=Outlook Browse Index,cn=Outlook Browse,cn=userRoot,cn=ldbm database,cn=plugins,cn=config changetype: add cn: Outlook Browse Index objectClass: top objectClass: vlvindex aci: (targetattr != "aci")(version 3.0; acl "VLV Request Control"; allow(read,search,compare) userdn = "ldap:///anyone";) vlvEnabled: 1 vlvSort: cn

1 0

inf file directive for CA certificate file
by Jovan.VUKOTIC＠sungard.com 14 Jun '13

14 Jun '13

Hi, We are starting installations of four 389 DS, version 1.2.11 and would like to pass an inf file together with command line parameters to setup-ds-admin.pl script. At the moment we have one 389 DS instance installed where Configuration Directory (o=NetscapeRoot ) is placed and where TLS/SSL is enabled. However, I cannot find an inf file directive for CA certificate file that we are prompted to supply when the script is run interactively. We need that file since a ldap URL to configuration directory is supplied in the form ldaps://ds1.example.com:636/o=NetscapeRoot Thanks in advance, Jovan Vukotic Jovan Vukotić * Senior Software Engineer * Ambit Treasury Management * SunGard * Banking * Bulevar Milutina Milankovića 136b, Belgrade, Serbia * tel: +381.11.6555-66-1 * jovan.vukotic(a)sungard.com<mailto:jovan.vukotic@sungard.com> Join the online conversation with SunGard's customers, partners and Industry experts and find an event near you at: www.sungard.com/ten<http://www.capitalize-on-change.com/?email=70150000000Y1Et>.

2 3

Console window problems
by Herb Burnswell 14 Jun '13

14 Jun '13

All, I did a new install of 389 DS on RHEL 6.4 via yum. The list of installed packages/dependencies is: Jun 06 18:12:33 Installed: libicu-4.2.1-9.1.el6_2.x86_64 Jun 06 18:12:33 Installed: perl-Mozilla-LDAP-1.5.3-4.el6.x86_64 Jun 06 18:12:33 Installed: 389-adminutil-1.1.15-1.el6.x86_64 Jun 06 18:12:33 Installed: jss-4.2.6-24.el6.x86_64 Jun 06 18:12:33 Installed: svrcore-4.0.4-5.1.el6.x86_64 Jun 06 18:12:33 Installed: 389-ds-base-libs-1.2.11.15-14.el6_4.x86_64 Jun 06 18:12:34 Installed: ldapjdk-4.18-6.el6.x86_64 Jun 06 18:12:34 Installed: idm-console-framework-1.1.7-2.el6.noarch Jun 06 18:12:34 Installed: 389-console-1.1.7-1.el6.noarch Jun 06 18:12:34 Installed: libsemanage-python-2.0.43-4.2.el6.x86_64 Jun 06 18:12:35 Installed: mod_nss-1.0.8-18.el6.x86_64 Jun 06 18:12:35 Installed: perl-NetAddr-IP-4.027-7.el6.x86_64 Jun 06 18:12:35 Installed: cyrus-sasl-md5-2.1.23-13.el6_3.1.x86_64 Jun 06 18:12:35 Installed: cyrus-sasl-gssapi-2.1.23-13.el6_3.1.x86_64 Jun 06 18:12:35 Installed: perl-Socket6-0.23-3.el6.x86_64 Jun 06 18:12:35 Installed: openldap-clients-2.4.23-32.el6_4.1.x86_64 Jun 06 18:12:36 Installed: setools-libs-3.3.7-4.el6.x86_64 Jun 06 18:12:36 Installed: setools-libs-python-3.3.7-4.el6.x86_64 Jun 06 18:12:36 Installed: audit-libs-python-2.2-2.el6.x86_64 Jun 06 18:13:43 Installed: policycoreutils-python-2.0.83-19.30.el6.x86_64 Jun 06 18:13:44 Installed: 389-ds-base-1.2.11.15-14.el6_4.x86_64 Jun 06 18:13:44 Installed: 389-admin-1.1.29-1.el6.x86_64 Jun 06 18:13:44 Installed: 389-admin-console-1.1.8-1.el6.noarch Jun 06 18:13:45 Installed: 389-ds-console-1.2.6-1.el6.noarch Jun 06 18:13:45 Installed: 389-ds-console-doc-1.2.6-1.el6.noarch Jun 06 18:13:45 Installed: 389-admin-console-doc-1.1.8-1.el6.noarch Jun 06 18:13:45 Installed: 389-dsgw-1.1.10-1.el6.x86_64 Jun 06 18:13:45 Installed: 389-ds-1.2.2-1.el6.noarch The install worked fine but when I launch the console window via 389-console, the java windows do not work properly. The full window is not visible, the buttons on the bottom of the window are not in view. If I try to drag the window size larger the buttons still do not come into view. I've set the JAVA_HOME variable to be JAVA_HOME=/usr/lib/jvm/java-1.6.0-openjdk.x86_64. I am launching the console via Windows 7, using X-Win-32 2010. Can anyone point me in the right direction as to how to fix this issue? Is it the java version? If so, is there a known version of java that will work with this configuration? Any guidance would be greatly appreciated. TIA, Herb

2 2

Questions about replication schedules
by Rodney 13 Jun '13

13 Jun '13

I'm running 389 DS version 1.2.10.14 for all servers on RHEL 5.8 hosts. First question, when defining the nsDS5ReplicaUpdateSchedule attribute for the replication agreement. The Administration manual says the format should look like this (with no dash in the time range): nsDS5ReplicaUpdateSchedule: 0030 0045 0123456 The Configuration and Command-Line Tool Reference shows the format of this attribute with a dash in the time range: nsDS5ReplicaUpdateSchedule: 0030-0045 0123456 I was wondering which format is correct or do they both work? I have chosen that 2nd format and get no errors. Also in the errors log file for the LDAP master where the above agreement is created, I see this in the log file one minute after the replication time period is finished and would like to know if this normal for scheduled replcations: [13/Jun/2013:00:46:00 -0400] NSMMReplicationPlugin -agmt="cn=ldaphost(ldaphost:636): Incremental protocol: event update_window_closed should not occur in state wait_for_window_to_open; going to sleep Thanks, Rodney

2 1

ldbm errors when adding/modifying/deleting entries
by Mahadevan, Venkat 12 Jun '13

12 Jun '13

Hello, My apologies if this has been discussed before but I couldn't find anything in the archives beyond this: https://lists.fedoraproject.org/pipermail/389-commits/2011-January/004560.h… The issue I am encountering are the following errors when an entry is being added to the directory or deleted from the directory - it seems an operations error err=1 corresponds to a failure in the backend ldbm (see log snippets below). I can reproduce these errors consistently by running a JMeter test to add and delete entries. It always transpires that some entries will fail to add or delete and will throw an operations error err=1 and a corresponding ldbm error. ---------------- In the error log I see things like: [10/Jun/2013:14:46:43 -0700] - ldbm_back_delete: modify_switch_entries failed [10/Jun/2013:14:50:58 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:50:59 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:50:59 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:50:59 -0700] - ldbm_back_add: modify_switch_entries failed [10/Jun/2013:14:50:59 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:51:00 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:51:00 -0700] - ldbm_back_add: modify_switch_entries failed [10/Jun/2013:14:51:00 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:51:01 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:51:02 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:51:04 -0700] - ldbm_back_modify: modify_switch_entries failed [10/Jun/2013:14:51:04 -0700] - ldbm_back_add: modify_switch_entries failed In the access log I see things like: [10/Jun/2013:14:50:59 -0700] conn=3516 SSL 256-bit AES [10/Jun/2013:14:50:59 -0700] conn=3516 op=0 BIND dn="cn=Directory Manager" method=128 version=3 [10/Jun/2013:14:50:59 -0700] conn=3516 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [10/Jun/2013:14:50:59 -0700] conn=3516 op=1 ADD dn="uid=jmeter25,dc=dev,dc=id,dc=ubc,dc=ca" [10/Jun/2013:14:50:59 -0700] conn=3516 op=1 RESULT err=1 tag=105 nentries=0 etime=0 csn=51b64a46001b01f50000 [10/Jun/2013:14:50:59 -0700] conn=3516 op=2 DEL dn="uid=jmeter25,dc=dev,dc=id,dc=ubc,dc=ca" [10/Jun/2013:14:50:59 -0700] conn=3516 op=2 RESULT err=32 tag=107 nentries=0 etime=0 [10/Jun/2013:14:50:59 -0700] conn=3516 op=3 UNBIND [10/Jun/2013:14:50:59 -0700] conn=3516 op=3 fd=107 closed - U1 [10/Jun/2013:14:51:00 -0700] conn=3533 SSL 256-bit AES [10/Jun/2013:14:51:00 -0700] conn=3533 op=0 BIND dn="cn=Directory Manager" method=128 version=3 [10/Jun/2013:14:51:00 -0700] conn=3533 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=directory manager" [10/Jun/2013:14:51:00 -0700] conn=3533 op=1 ADD dn="uid=jmeter57,dc=dev,dc=id,dc=ubc,dc=ca" [10/Jun/2013:14:51:00 -0700] conn=3533 op=1 RESULT err=1 tag=105 nentries=0 etime=0 csn=51b64a46004d01f50000 [10/Jun/2013:14:51:00 -0700] conn=3533 op=2 DEL dn="uid=jmeter57,dc=dev,dc=id,dc=ubc,dc=ca" [10/Jun/2013:14:51:00 -0700] conn=3533 op=2 RESULT err=32 tag=107 nentries=0 etime=0 [10/Jun/2013:14:51:00 -0700] conn=3533 op=3 UNBIND [10/Jun/2013:14:51:00 -0700] conn=3533 op=3 fd=110 closed - U1 Our configuration is as follows: 2 Master servers (writes always go to one) in a MMR config. 3 Replica servers with replication agreements to each of the 2 masters. RHEL 6.4 x64 Linux 2.6.32-358.2.1.el6.x86_64 389-ds-base.x86_64 1.2.11.15-14.el6_4 @rhel-x86_64-server-6 Has anyone seen this before and solved the issue? This is a big blocker for us before we can deploy in production. So far, I am really liking 389 and want to see it in use at our institution. Thank you for any assistance. Kind regards, -------------------------------------------------------------------- Venkat Mahadevan Programmer Analyst II, Identity and Access Management Information Technology | Engage. Envision. Enable. The University of British Columbia Tel: 604.822.4112

3 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users June 2013