constraint averlay
by rayane karim
Hi All
is constraint overlay implemented on DS like olcConstraintAttribute
for attribute syntax checking like regex
Regards
Rayane
9 years, 10 months
Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)
by Graham Leggett
Hi all,
Some more digging reveals that when an attempt is made for serverb to try and commence replication with serverc, I get the following in the error log:
[04/May/2014:17:46:55 +0100] NSMMReplicationPlugin - Beginning total update of replica "agmt="cn=Agreement serverc.example.com" (serverc:636)".
[04/May/2014:17:47:02 +0100] NSMMReplicationPlugin - agmt="cn=Agreement serverc.example.com" (serverc:636): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)
[04/May/2014:17:47:02 +0100] NSMMReplicationPlugin - agmt="cn=Agreement serverc.example.com" (serverc:636): Received error -1 (Can't contact LDAP server): for total update operation
[04/May/2014:17:47:03 +0100] NSMMReplicationPlugin - agmt="cn=Agreement serverc.example.com" (serverc:636): Warning: unable to send endReplication extended operation (Can't contact LDAP server)
[04/May/2014:17:47:04 +0100] NSMMReplicationPlugin - agmt="cn=Agreement serverc.example.com" (serverc:636): Replication bind with SIMPLE auth resumed
Unfortunately the error message "Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)" is too vague to be useful because there is no clear and unambiguous indication of *which* server it is unable to connect to and on what port. The "(serverc:636)" would imply that it is trying to connect to "serverc", but "serverc" is the name of the instance, it is not the name of the server, so any attempt to connect to this will fail. The server is called serverc.example.com, and this name appears exclusively in the replication agreement:
dn: cn=Agreement serverc.example.com,cn=replica,cn=o\3DFoo\,c\3Dza,cn=mapping tr
ee,cn=config
objectClass: nsDS5ReplicationAgreement
objectClass: top
cn: Agreement serverc.example.com
description: Replication agreement between serverb.example.com and serverc.example.com
nsds5BeginReplicaRefresh: start
nsDS5ReplicaBindDN: cn=Replication Manager,cn=config
nsDS5ReplicaBindMethod: SIMPLE
nsds5replicaChangesSentSinceStartup:
nsDS5ReplicaCredentials:: xxx
nsDS5ReplicaHost: serverc.example.com
nsds5replicaLastInitEnd: 0
nsds5replicaLastInitStart: 20140504164654Z
nsds5replicaLastInitStatus: 0
nsds5replicaLastUpdateEnd: 20140504164652Z
nsds5replicaLastUpdateStart: 20140504164652Z
nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental u
pdate started
nsDS5ReplicaPort: 636
nsDS5ReplicaRoot: o=Foo,c=ZA
nsDS5ReplicaTransportInfo: SSL
nsds5replicaUpdateInProgress: FALSE
At the same time, ssldump reveals that serverb.example.com and serverc.example.com are successfully speaking to one another, and have a lot to say - data seems to be constantly flowing between them, but not to any successful end.
Does any of this behaviour look familiar to anybody?
Regards,
Graham
--
9 years, 10 months
dsgw not checking passwords during auth
by Ted Strother
I have a web server running dsgw which is pointing at an ldap instance
on another server in the config. Searches work fine, actions tht
require auth work fine when the password was correct.
When an incorrect password is entered it is still accepted, a cookie
is created, and as soon as an operation that requires auth is tried it
errors out. Incorrect users are still rejected, it is only when a
correct user but incorrect password is entered that this behavior is
seen.
Has anyone seen this before?
--
Ted Strother
Systems Administrator Senior
Information Technology Services
University of Michigan-Dearborn
19000 Hubbard Drive, 238 FCN
Dearborn, MI 48126
9 years, 11 months
archive2db: Failed to read backup file set. Either the directory specified doesn't exist, or it exists but doesn't contain a valid backup set, or file permissions prevent the server reading the backup set. error=53 (Invalid request descriptor)
by Graham Leggett
Hi all,
I am now trying to use the bak2db.pl script in an effort to restore a backup as follows, and receive the error below. Can anyone point out what I am doing wrong?
(I had to manually hack the bak2db.pl script to change the host to localhost, the script blindly assumes the box is accessible on port 389 when it is not)
[root@joey ~]# /usr/lib64/dirsrv/slapd-serverc/bak2db.pl -v -D "cn=Directory Manager" -j /etc/dirsrv/slapd-serverc.secret -a /tmp/replicate/userRoot/ -n userRoot
ldap_initialize( ldap://localhost:389 )
add objectclass:
top
extensibleObject
add cn:
restore_2014_5_5_15_14_40
add nsInstance:
userRoot
add nsArchiveDir:
/tmp/replicate/userRoot/
add nsDatabaseType:
ldbm database
adding new entry "cn=restore_2014_5_5_15_14_40, cn=restore, cn=tasks, cn=config"
modify complete
So far so good.
In the logfile:
[05/May/2014:15:14:39 +0200] - Beginning restore to 'ldbm database'
[05/May/2014:15:14:39 +0200] - Warning: Unable to read dbversion file in /tmp/replicate/userRoot
[05/May/2014:15:14:39 +0200] - Bringing userRoot offline...
[05/May/2014:15:14:39 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica o=wired,c=za is going offline; disabling replication
[05/May/2014:15:14:40 +0200] - Waiting for 4 database threads to stop
[05/May/2014:15:14:41 +0200] - All database threads now stopped
[05/May/2014:15:14:41 +0200] - Restore: backup directory /tmp/replicate/userRoot does not exist.
[05/May/2014:15:14:41 +0200] - archive2db: Failed to read backup file set. Either the directory specified doesn't exist, or it exists but doesn't contain a valid backup set, or file permissions prevent the server reading the backup set. error=53 (Invalid request descriptor)
[05/May/2014:15:14:41 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica o=wired,c=za is coming online; enabling replication
[05/May/2014:15:14:41 +0200] - Restore finished.
Yes, the directory does exist:
[root@joey ~]# ls -al /tmp/replicate/userRoot
total 239624
drwx------. 2 nobody nobody 4096 May 5 12:08 .
drwx------. 4 nobody nobody 4096 May 5 12:08 ..
-rw-------. 1 nobody nobody 49 May 5 12:08 DBVERSION
-rw-------. 1 nobody nobody 16384 May 5 12:08 aci.db4
-rw-------. 1 nobody nobody 2482176 May 5 12:08 ancestorid.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 associatedDomain.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 certificateUUID.db4
-rw-------. 1 nobody nobody 24117248 May 5 12:08 cn.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 contractClass.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 contractCustomerCounterparty.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 contractRecipientCounterparty.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 contractVendorCounterparty.db4
-rw-------. 1 nobody nobody 22487040 May 5 12:08 entryrdn.db4
-rw-------. 1 nobody nobody 5316608 May 5 12:08 givenName.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 hushkeyAddress.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 hushkeyReference.db4
-rw-------. 1 nobody nobody 159891456 May 5 12:08 id2entry.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 ipHostNumber.db4
-rw-------. 1 nobody nobody 11468800 May 5 12:08 mail.db4
-rw-------. 1 nobody nobody 40960 May 5 12:08 mailAlternateAddress.db4
-rw-------. 1 nobody nobody 24576 May 5 12:08 mailHost.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 memberCertificateIssuerDN.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 memberCertificateSubjectDN.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 nscpEntryDN.db4
-rw-------. 1 nobody nobody 6430720 May 5 12:08 nsuniqueid.db4
-rw-------. 1 nobody nobody 24576 May 5 12:08 numsubordinates.db4
-rw-------. 1 nobody nobody 2473984 May 5 12:08 objectclass.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 owner.db4
-rw-------. 1 nobody nobody 802816 May 5 12:08 parentid.db4
-rw-------. 1 nobody nobody 5308416 May 5 12:08 sn.db4
-rw-------. 1 nobody nobody 16384 May 5 12:08 uid.db4
-rw-------. 1 nobody nobody 4243456 May 5 12:08 uniquemember.db4
Anyone see any reason why this wouldn't work?
Regards,
Graham
--
9 years, 11 months
bak2db script: how do you use it?
by Graham Leggett
Hi all,
I am now trying to make the initial replication happen manually through the restoration of a backup. This is also turning out to be strangely difficult.
After backing up servera I have the following directory on serverc:
[root@serverc ~]# ls -al /tmp/replicate/
total 16
drwx------. 4 nobody nobody 4096 May 5 12:08 .
drwxrwxrwt. 6 root root 4096 May 5 13:30 ..
drwx------. 2 nobody nobody 4096 May 5 12:08 NetscapeRoot
drwx------. 2 nobody nobody 4096 May 5 12:08 userRoot
I want to restore the contents of userRoot to serverc, which looks like this:
[root@serverc ~]# ls -al /var/lib/dirsrv/slapd-serverc/db/
total 20604
drwxrwx---. 3 nobody nobody 4096 May 5 13:31 .
drwxrwx---. 5 nobody nobody 4096 May 5 13:30 ..
-rw-------. 1 nobody nobody 49 May 5 13:31 DBVERSION
-rw-------. 1 nobody nobody 24576 May 5 13:31 __db.001
-rw-------. 1 nobody nobody 1736704 May 5 13:37 __db.002
-rw-------. 1 nobody nobody 10002432 May 5 13:31 __db.003
-rw-------. 1 nobody nobody 1081344 May 5 13:37 __db.004
-rw-------. 1 nobody nobody 8134656 May 5 13:31 __db.005
-rw-------. 1 nobody nobody 90112 May 5 13:31 __db.006
-rw-------. 1 nobody nobody 10485760 May 5 13:31 log.0000000001
drwx------. 2 nobody nobody 4096 May 5 13:30 userRoot
I try and import the backup like so:
[root@serverc ~]# /usr/lib64/dirsrv/slapd-serverc/bak2db /tmp/replicate/ -n userRoot
[05/May/2014:13:49:53 +0200] 389-Directory/1.2.11.15 - debug level: backend (524288)
[05/May/2014:13:49:53 +0200] - Warning: Unable to read dbversion file in /tmp/replicate
[05/May/2014:13:49:53 +0200] - Restore: backup directory /tmp/replicate does not contain a complete backup
[05/May/2014:13:49:53 +0200] - archive2db: Failed to read backup file set. Either the directory specified doesn't exist, or it exists but doesn't contain a valid backup set, or file permissions prevent the server reading the backup set. error=53 (Invalid request descriptor)
No luck. Let's guess again:
[root@serverc ~]# /usr/lib64/dirsrv/slapd-serverc/bak2db /tmp/replicate/userRoot/ -n userRoot
Lots of encouraging looking output, but the server is now completely empty - the root DSE is gone.
Looking at serverc, we see the userRoot directory has been ignored and we now have a totally different directory structure:
[root@joey ~]# ls -al /var/lib/dirsrv/slapd-joey/db/
total 260252
drwxrwx---. 3 nobody nobody 4096 May 5 13:43 .
drwxrwx---. 5 nobody nobody 4096 May 5 13:30 ..
-rw-------. 1 nobody nobody 49 May 5 13:43 DBVERSION
-rw-------. 1 nobody nobody 24576 May 5 13:43 __db.001
-rw-------. 1 nobody nobody 1736704 May 5 13:44 __db.002
-rw-------. 1 nobody nobody 10002432 May 5 13:44 __db.003
-rw-------. 1 nobody nobody 1081344 May 5 13:44 __db.004
-rw-------. 1 nobody nobody 8134656 May 5 13:44 __db.005
-rw-------. 1 nobody nobody 90112 May 5 13:44 __db.006
-rw-------. 1 nobody nobody 16384 May 5 13:41 aci.db4
-rw-------. 1 nobody nobody 2482176 May 5 13:41 ancestorid.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 associatedDomain.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 certificateUUID.db4
-rw-------. 1 nobody nobody 24117248 May 5 13:41 cn.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 contractClass.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 contractCustomerCounterparty.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 contractRecipientCounterparty.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 contractVendorCounterparty.db4
-rw-------. 1 nobody nobody 22487040 May 5 13:41 entryrdn.db4
-rw-------. 1 nobody nobody 5316608 May 5 13:41 givenName.db4
-rw-------. 1 nobody nobody 159891456 May 5 13:41 id2entry.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 ipHostNumber.db4
-rw-------. 1 nobody nobody 10485760 May 5 13:44 log.0000000001
-rw-------. 1 nobody nobody 11468800 May 5 13:41 mail.db4
-rw-------. 1 nobody nobody 40960 May 5 13:41 mailAlternateAddress.db4
-rw-------. 1 nobody nobody 24576 May 5 13:41 mailHost.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 memberCertificateIssuerDN.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 memberCertificateSubjectDN.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 nscpEntryDN.db4
-rw-------. 1 nobody nobody 6430720 May 5 13:41 nsuniqueid.db4
-rw-------. 1 nobody nobody 24576 May 5 13:41 numsubordinates.db4
-rw-------. 1 nobody nobody 2473984 May 5 13:41 objectclass.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 owner.db4
-rw-------. 1 nobody nobody 802816 May 5 13:41 parentid.db4
-rw-------. 1 nobody nobody 5308416 May 5 13:41 sn.db4
-rw-------. 1 nobody nobody 16384 May 5 13:41 uid.db4
-rw-------. 1 nobody nobody 4243456 May 5 13:41 uniquemember.db4
What is the secret to the bak2db? What command line should I use that is compatible with the server? How do you convince bak2db to restore into the userRoot directory instead of just dumping everything in the root of the directory, to be ignored by the server?
Anyone used bak2db before?
Regards,
Graham
--
9 years, 11 months
Replication hell - picking apart info/warning/error messages
by Graham Leggett
Hi all,
I am into my second day of hell trying to get server C to replicate to servers B and A in a multimaster replication setup.
For reasons unknown it appears getting servers A and B to be blown away completely by the contents of (initially empty) server C is trivial in the extreme, cue two three hour outages and restores from backup. I cannot for the life of me get this to work the other way around.
After running the scripts to deploy server C from scratch, and adding the replication agreement to server A, I get the following in server C's log below.
I have a number of questions:
- "Replica has a different generation ID than the local data." - what does this mean? Is it simply information to be ignored, a warning to be heeded (if so, how?), or an error (if so, what action must be taken?).
- "ERROR bulk import abandoned". I am assuming this means that the replication failed, but it gives no indication as to *why* it failed. Anyone know of a way to coax a reason out of 389ds?
- "NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica". Again, is this purely for information, is this a warning, is this an error, what should I do in response to this?
All I want to do is make serverc have the same data as servera. Does anyone have a clear and concise set of instructions for how this is to be achieved safely?
[04/May/2014:15:50:17 +0200] NSMMReplicationPlugin - agmt="cn=Agreement servera.example.com" (servera:636): Replica has a different generation ID than the local data.
[04/May/2014:15:50:21 +0200] NSMMReplicationPlugin - agmt="cn=Agreement serverb.example.com" (serverb:636): Replica has a different generation ID than the local data.
[04/May/2014:15:51:36 +0200] NSMMReplicationPlugin - multimaster_be_state_change: replica o=Foo,c=za is going offline; disabling replication
[04/May/2014:15:51:36 +0200] - WARNING: Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database
[04/May/2014:15:51:40 +0200] - ERROR bulk import abandoned
[04/May/2014:15:51:40 +0200] - import userRoot: Aborting all Import threads...
[04/May/2014:15:51:45 +0200] - import userRoot: Import threads aborted.
[04/May/2014:15:51:45 +0200] - import userRoot: Closing files...
[04/May/2014:15:51:45 +0200] - libdb: userRoot/aci.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/cn.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/parentid.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/mailAlternateAddress.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/objectclass.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/entryrdn.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/givenName.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/uniquemember.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/nsuniqueid.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/mailHost.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/mail.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/id2entry.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/sn.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - libdb: userRoot/uid.db4: unable to flush: No such file or directory
[04/May/2014:15:51:45 +0200] - import userRoot: Import failed.
[04/May/2014:15:51:45 +0200] - process_bulk_import_op: NULL target sdn
[04/May/2014:15:51:49 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=Foo,c=ZA: LDAP error - 1
[04/May/2014:15:51:53 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=Foo,c=ZA: LDAP error - 1
[04/May/2014:15:51:57 +0200] NSMMReplicationPlugin - replica_replace_ruv_tombstone: failed to update replication update vector for replica o=Foo,c=ZA: LDAP error - 1
Regards,
Graham
--
9 years, 11 months
Re: [389-users] Sync from RDBMS to LDAP
by Fong, Trevor
*Bump*
Surely we can't be the only ones who want to this?
Trev
From: Fong, Trevor
Sent: April-22-14 3:33 PM
To: '389-users(a)lists.fedoraproject.org'
Subject: Sync from RDBMS to LDAP
Hi Everyone,
We are in the process of migrating from an old OpenLDAP service to 389-DS.
We currently synchronise users and attributes from an Oracle DB to OpenLDAP service using an aging set of custom scripts and DB triggers.
We would like to do something similar for 389-DS but using a commercial-off-the-shelf solution.
I was wondering what the good people on this list use or would recommend?
Thanks in advance,
Trev
---------------------------------------------------------
Trevor Fong - Senior Programmer Analyst
Identity and Access Management Group
University of British Columbia - Information Technology
6356 Agricultural Road, Vancouver, BC, V6T 1Z2, Canada
Ph: (604) 827-5247
9 years, 11 months
cannot find name for group ID
by Enrico Morelli
Dear all,
I'm a new user about 389 DS. I installed it on a RHEL 6 (32bit) server:
89-admin-console-doc-1.1.8-1.el6.noarch
389-ds-1.2.2-1.el6.noarch
389-ds-base-1.2.11.15-32.el6_5.i686
389-ds-base-libs-1.2.11.15-32.el6_5.i686
389-ds-console-1.2.6-1.el6.noarch
389-admin-console-1.1.8-1.el6.noarch
389-dsgw-1.1.11-1.el6.i686
389-admin-1.1.35-1.el6.i686
389-adminutil-1.1.19-1.el6.i686
389-ds-console-doc-1.2.6-1.el6.noarch
389-console-1.1.7-1.el6.noarch
I've troubles with groups. I created posix user and group. I'm able to
login on the Linux client (SL 6 32bit) but I receive the error: cannot
find name for group ID.
I had search on google to find a solution, but all the suggestions I've
find didn't work for me.
This is the sssd.conf on the client, with all attempts to solve the
problem
-----------------------------------------------
[domain/default]
ldap_schema = rfc2307bis
ldap_id_use_start_tls = True
cache_credentials = True
ldap_search_base = dc=mydomain,dc=it
#krb5_realm = EXAMPLE.COM
#krb5_server = kerberos.example.com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://myserver
ldap_tls_cacertdir = /etc/openldap/cacerts
entry_cache_timeout = 600
ldap_network_timeout = 3
#ldap_group_name = uniqueMember
ldap_group_object_class = groupofuniquenames
[sssd]
services = nss, pam
config_file_version = 2
domains = default
-----------------------------------------------------------------
If I add the member to the group through the management console
group->Members->Static Group, switch on the ldap_group_name =
uniqueMember parameter on the client, clear cache, restart sssd and
type id user I obtain:
uid=1001(morelli)
gid=1001(uid=morelli,cn=students,ou=Groups,dc=mydoman,dc=it)
groups=1001(uid=morelli,cn=students,ou=Groups,dc=mydomain,dc=it)
There is a way to solve the problem?
Thanks
--
-------------------------------------------------------------
Enrico Morelli
System Administrator | Programmer | Web Developer
CERM - Polo Scientifico
Via Sacconi, 6 - 50019 Sesto Fiorentino (FI) - ITALY
phone: +39 055 457 4269
fax: +39 055 457 4927
-------------------------------------------------------------
9 years, 11 months