389-users April 2014

389-users@lists.fedoraproject.org

39 participants
45 discussions

Problem browsing LDAP with Outlook
by Chris Bryant 26 Aug '20

26 Aug '20

When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS. When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well. I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also. Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration. Thanks, Chris USA.NET You Run Your Business. We'll Run Your Email. This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.

3 2

multi-valued nsAccountLock
by Pierre ROUDIER 10 Jul '15

10 Jul '15

Hi all, RedHat DS's doc states that the nsAccountLock attribute is multi-valued [1]. Some tests with 389ds led me to think it's also true for 389ds. I cannot think of any reason explaining why it would have to be multi-valued. Do you have any idea? Thank you. [1] https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server…

3 2

changelog
by Denise Cosso 16 Apr '15

16 Apr '15

Hi, How to modify the attribute nsslapd-encryptionalgorithm in Centos? Thanks, Denise Stop Master servers and set nsslapd-encryptionalgorithm. The allowed value is AES or 3DES. dn: cn=changelog5,cn=config [...] nsslapd-encryptionalgorithm: AES --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:34 On 06/04/2013 01:26 PM, Denise Cosso wrote: Hi, Rich CentOS release 6.3 (Final) 389-ds-base-libs-1.2.10.2-20.el6_3.x86_64 389-ds-1.2.2-1.el6.noarch 389-dsgw-1.1.10-1.el6.x86_64 389-ds-console-1.2.6-1.el6.noarch 389-ds-console-doc-1.2.6-1.el6.noarch 389-ds-base-1.2.10.2-20.el6_3.x86_64 As far as replication goes - you will need to use a security layer (SSL, TLS, or GSSAPI) to protect the clear text password on the wire As far as encrypting it in the changelog - not sure Denise --- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu: De: Rich Megginson <rmeggins(a)redhat.com> Assunto: Re: [389-users] changelog Para: "General discussion list for the 389 Directory server project." <389-users(a)lists.fedoraproject.org> Cc: "Denise Cosso" <guanaes51(a)yahoo.com.br> Data: Terça-feira, 4 de Junho de 2013, 16:11 On 06/04/2013 12:39 PM, Denise Cosso wrote: Hi, Description of problem: When a userPassword is changed in a server with changelog, the hashed password is logged and also a cleartext pseudo-attribute version. It looks like this: change:: replace: userPassword userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q== - replace: unhashed#user#password unhashed#user#password: secret12 This unhashed version is used in winsync where the cleartext version of the password must be written to the AD. Now if the DS is involved in replication with another DS, the change will be replayed exactly as it is logged to the other DS replicas, including the cleartext pseudo-attribute password. What platform? What version of 389-ds-base are you using? thanks, Denise -- 389 users mailing list 389-users(a)lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

2 2

389 Master - Master Replication
by Santos Ramirez 03 Oct '14

03 Oct '14

Good Morning, We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated. Santos U. Ramirez Linux Systems Administrator National DCP, LLC 150 Depot Street Bellingham, Ma. 02019 Phone: 508-422-3089 Fax: 508-422-3866 Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com> This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.

3 9

LDAP import
by Herb Burnswell 09 May '14

09 May '14

All, I'm attempting to import an LDAP schema (is that the correct term?) from one LDAP implementation to another and it appears that I may be doing it incorrectly. I created a ldif file for import as: ldapsearch -b "o=companyA" -D "dc=hq,dc=example,dc=com" -h original_system > output.ldif I then used the GUI in the new LDAP implementation to import the ldif file. Everything seemed to work find as I have the entire tree but there appears to be a problem with passwords. Am I missing the passwords for users with this export to ldif file? What is the proper procedure to import all information from a schema (is that the correct term?) to import into a new LDAP implementation? Thanks in advance for any assistance, Herb

5 10

inetUser issue
by Ssureshot 09 May '14

09 May '14

I've added the inetUser object class to the nsdefaultobjectclass the the cn=user. However when I add a new user the user does not have inetUser object class. Any idea? # extended LDIF # # LDAPv3 # base <o=netscaperoot> with scope subtree # filter: cn=user # requesting: ALL # # user + inetorgperson, defaultObjectClassesContainer, 1.1, Admin, Global Pre ferences, example.local, NetscapeRoot dn: cn=user+nsdefaultobjectclass=inetorgperson,cn=defaultObjectClassesContaine r,ou=1.1,ou=Admin,ou=Global Preferences,ou=example.local,o=NetscapeRoot objectClass: top objectClass: nsResourceRef objectClass: nsdefaultObjectClasses cn: user nsDefaultObjectClass: top nsDefaultObjectClass: person nsDefaultObjectClass: organizationalPerson nsDefaultObjectClass: inetorgperson nsDefaultObjectClass: inetUser # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 Thank you Aaron

3 3

Re: [389-users] Sync from RDBMS to LDAP
by Fong, Trevor 02 May '14

02 May '14

*Bump* Surely we can't be the only ones who want to this? Trev From: Fong, Trevor Sent: April-22-14 3:33 PM To: '389-users(a)lists.fedoraproject.org' Subject: Sync from RDBMS to LDAP Hi Everyone, We are in the process of migrating from an old OpenLDAP service to 389-DS. We currently synchronise users and attributes from an Oracle DB to OpenLDAP service using an aging set of custom scripts and DB triggers. We would like to do something similar for 389-DS but using a commercial-off-the-shelf solution. I was wondering what the good people on this list use or would recommend? Thanks in advance, Trev --------------------------------------------------------- Trevor Fong - Senior Programmer Analyst Identity and Access Management Group University of British Columbia - Information Technology 6356 Agricultural Road, Vancouver, BC, V6T 1Z2, Canada Ph: (604) 827-5247

4 4

cannot find name for group ID
by Enrico Morelli 01 May '14

01 May '14

Dear all, I'm a new user about 389 DS. I installed it on a RHEL 6 (32bit) server: 89-admin-console-doc-1.1.8-1.el6.noarch 389-ds-1.2.2-1.el6.noarch 389-ds-base-1.2.11.15-32.el6_5.i686 389-ds-base-libs-1.2.11.15-32.el6_5.i686 389-ds-console-1.2.6-1.el6.noarch 389-admin-console-1.1.8-1.el6.noarch 389-dsgw-1.1.11-1.el6.i686 389-admin-1.1.35-1.el6.i686 389-adminutil-1.1.19-1.el6.i686 389-ds-console-doc-1.2.6-1.el6.noarch 389-console-1.1.7-1.el6.noarch I've troubles with groups. I created posix user and group. I'm able to login on the Linux client (SL 6 32bit) but I receive the error: cannot find name for group ID. I had search on google to find a solution, but all the suggestions I've find didn't work for me. This is the sssd.conf on the client, with all attempts to solve the problem ----------------------------------------------- [domain/default] ldap_schema = rfc2307bis ldap_id_use_start_tls = True cache_credentials = True ldap_search_base = dc=mydomain,dc=it #krb5_realm = EXAMPLE.COM #krb5_server = kerberos.example.com id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldaps://myserver ldap_tls_cacertdir = /etc/openldap/cacerts entry_cache_timeout = 600 ldap_network_timeout = 3 #ldap_group_name = uniqueMember ldap_group_object_class = groupofuniquenames [sssd] services = nss, pam config_file_version = 2 domains = default ----------------------------------------------------------------- If I add the member to the group through the management console group->Members->Static Group, switch on the ldap_group_name = uniqueMember parameter on the client, clear cache, restart sssd and type id user I obtain: uid=1001(morelli) gid=1001(uid=morelli,cn=students,ou=Groups,dc=mydoman,dc=it) groups=1001(uid=morelli,cn=students,ou=Groups,dc=mydomain,dc=it) There is a way to solve the problem? Thanks -- ------------------------------------------------------------- Enrico Morelli System Administrator | Programmer | Web Developer CERM - Polo Scientifico Via Sacconi, 6 - 50019 Sesto Fiorentino (FI) - ITALY phone: +39 055 457 4269 fax: +39 055 457 4927 -------------------------------------------------------------

3 4

Export/Import: openldap-2.3.27 to 389-ds-1.2.2-1
by Brian Arthur 28 Apr '14

28 Apr '14

Hi, I’m trying to import an openldap-2.3.27 export into 389-ds-1.2.2-1 and am getting the follow errors in the “rejects” file: Invalid syntax. cn: value #0 invalid per syntax Sample: cn:: TWFyaW8gUmH6bCBDaGFuZw== I’ve determined (I think) that these errors are from CN value pair that are base64 encoded LATIN1 characters. If I decode string(base64 command), convert it to UTF8(via iconv), I can import into Fedora389 successfully. I have a lot of entries with these values and am looking for an easy solution. Has anyone come across this before and written a script to process an LDIF file or a different way to transfer the data? I’m not much of a programmer but I do have programmers in my organization that could assist me if a script is the best solution. Thanks!

3 5

Installing dsgw web interface
by harry.devine＠faa.gov 23 Apr '14

23 Apr '14

I'd like to try out the web interface, and I'm trying to follow along with some tips I've found online. I have dsgw installed on my server (389-dsgw-1.1.11-1.el6.x86_64). I ran the setup-ds-dsgw script and restarted the admin server, but going to http:<my_ip>:9830 just times out. If I copy /etc/dirsrv/dsgw/dsgw-httpd.conf to my server's apache directory, restart apache, and try going to http://<my_ip>/dsgw, I get an error stating "Problem Bad or missing configuration file (Cannot open "/etc/dirsrv/dsgw/default.conf"). That file is there, so what do I have to do to make this work? Do I have to edit the dsgw-httpd.conf and configure that further? Thanks for any tips! Harry Devine Common ARTS Software Development AJM-245 (609)485-4218 Harry.Devine(a)faa.gov

2 4

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2014