Problem browsing LDAP with Outlook
by Chris Bryant
When configuring Microsoft Outlook (not Outlook Express) to access an LDAP directory, there is an option to 'Enable Browsing (requires server support)'. If this option is chosen and the directory server supports it, then you should be able to open the LDAP address book and page up and down through the results. I have been unable to get this working properly with 389 DS.
When I try to browse from Outlook against the 389 DS directory, I am able to see the first page of results perfectly. However, if I move to the next page, only the first object returned will have any attributes included, and all of the rest of the objects in the page will have no attributes. I have a test perl script that duplicates this functionality as well.
I can get this to work properly with an older version of Netscape Directory Server, and I can get it working with OpenDS. Since 389 DS advertises support for the controls that are required for this to work, just like the other two servers, then I would expect it to work there also.
Has anyone out there gotten this to work with 389 DS? If so, can you share if there was anything special that you needed to do to get this to work? I'm trying to determine if this is a bug in the server, or if I'm just missing something in the configuration.
Thanks,
Chris
USA.NET
You Run Your Business. We'll Run Your Email.
This message is for the sole use of the intended recipient(s) and may contain confidential and/or privileged information of USA.NET, Inc. Any unauthorized review, use, copying, disclosure, or distribution is prohibited. If you are not the intended recipient, please immediately contact the sender by reply email and delete all copies of the original message.
3 years, 3 months
changelog
by Denise Cosso
Hi,
How to modify the attribute nsslapd-encryptionalgorithm in Centos?
Thanks,
Denise
Stop Master servers and set nsslapd-encryptionalgorithm. The allowed value is AES or 3DES.
dn: cn=changelog5,cn=config
[...]
nsslapd-encryptionalgorithm: AES
--- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com> escreveu:
De: Rich Megginson <rmeggins(a)redhat.com>
Assunto: Re: [389-users] changelog
Para: "Denise Cosso" <guanaes51(a)yahoo.com.br>
Data: Terça-feira, 4 de Junho de 2013, 16:34
On 06/04/2013 01:26 PM, Denise Cosso
wrote:
Hi, Rich
CentOS release 6.3 (Final)
389-ds-base-libs-1.2.10.2-20.el6_3.x86_64
389-ds-1.2.2-1.el6.noarch
389-dsgw-1.1.10-1.el6.x86_64
389-ds-console-1.2.6-1.el6.noarch
389-ds-console-doc-1.2.6-1.el6.noarch
389-ds-base-1.2.10.2-20.el6_3.x86_64
As far as replication goes - you will need to use a security layer
(SSL, TLS, or GSSAPI) to protect the clear text password on the wire
As far as encrypting it in the changelog - not sure
Denise
--- Em ter, 4/6/13, Rich Megginson <rmeggins(a)redhat.com>
escreveu:
De: Rich Megginson <rmeggins(a)redhat.com>
Assunto: Re: [389-users] changelog
Para: "General discussion list for the 389 Directory
server project."
<389-users(a)lists.fedoraproject.org>
Cc: "Denise Cosso" <guanaes51(a)yahoo.com.br>
Data: Terça-feira, 4 de Junho de 2013, 16:11
On
06/04/2013 12:39 PM, Denise Cosso wrote:
Hi,
Description of problem:
When a userPassword is changed in a server with changelog, the hashed password
is logged and also a cleartext pseudo-attribute version. It looks like this:
change::
replace: userPassword
userPassword: {SHA256}vqtiN2LHdrEUOJUKu+IBVqAVFsAlvFw+11kD/Q==
-
replace: unhashed#user#password
unhashed#user#password: secret12
This unhashed version is used in winsync where the cleartext version of the
password must be written to the AD.
Now if the DS is involved in replication with another DS, the change will be
replayed exactly as it is logged to the other DS replicas, including the
cleartext pseudo-attribute password.
What platform? What version of 389-ds-base are you
using?
thanks,
Denise
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users
8 years, 8 months
389 GUI/Console
by Gonzalo Fernandez Ordas
Hi
I got 389 running on a remote linux box,and I would like to get use of
the Console without the need of exporting the X-Windows whenever I want
to make a change as I also would prefer not to keep tweaking the
configuration files all the time.
is there anyway of doing this through any remote client?
Any advise on this matter?
Thanks very much
8 years, 9 months
389 Master - Master Replication
by Santos Ramirez
Good Morning,
We have a master - master replication agreement. When we initialize the replication it works perfectly we can see changes to a test user we have set up go up and down from the two servers. However at some point the replication stops and we cannot get replication to start once again. The only way we can get replication to start once again is to recreate the replication agreement and then it fails again. Can anyone please point us in a direction. I am relatively new to 389 so any help would be greatly appreciated.
Santos U. Ramirez
Linux Systems Administrator
National DCP, LLC
150 Depot Street
Bellingham, Ma. 02019
Phone: 508-422-3089
Fax: 508-422-3866
Santos.Ramirez(a)natdcp.com<mailto:Santos.Ramirez@natdcp.com>
This email and any attachments are intended only for use by the addressee(s) named herein and may contain legally privileged and/or confidential information. If you are not the intended recipient of this e-mail, do not copy or forward to any unauthorized persons, permanently delete the original and notify the sender by replying to this email.
9 years, 2 months
1.2.11.30 ETA?
by Michael Gettes
Kind 389 devs,
i am on 1.2.11.29 and for my environment - it’s been great!
I have been watching the tickets with respect to 1.2.11.30 and I am curious as to when this release may be available? There are a few items pertaining to my environment which we would so dearly appreciate. 346 would be a HUGE win for us. We are seeing periodic problems which seem to indicate 47773/4 may address as well. I recognize you guys bust your butts and I truly hate asking this question - but please know your work is so appreciated.
thank you so much!
/mrg
9 years, 5 months
sub-suffix help
by Stephen Harris
Hi folks.
I am building a new 389 DS to replace an openldap directory.
The root dn is known as o=producer ( actually is something else but has been this for the last 10 yrs through 2 previous upgrades and I do not want to change it to o=producers,o=co,o=nz)
So what I want to achieve is to create a sub suffix, ou=webusers,o=producers and ou=staff,o=producers
The idea being the users in webusers will be searched for a web application and the staff users remain unsearched to the outside world.
I can make my sub suffixes no problem in the configuration tab of the 389-console.
But that gives me a blank database, how do I get to the next step of being able to create groups and people inside of this and manipulate this in the directory tab?
Or is there some other way of doing this that I am not seeing?
Sorry if this is a dumb question, but it seems to be lacking in any documentation anywhere.
Best Regards
Stephen
9 years, 5 months
about drcom
by 狼性天下
when I use drcom to connect the Internet through my school's gateway,I failed .
Fail message is that I'm using a router,which I never use.
What should I do?
Thanks sinerely.
From a student in china.
9 years, 5 months
Removing entries with invalid DN syntax
by Audun Røe
Hello,
I'm trying to delete some problematic entries from our 389 directory. The
entry DNs contain < and > (probably found their way into the directory
years ago). This causes problems with JNDI where DNs from search results
are fed directly back into more searches because these particular DNs are
somehow returned in in escaped form. E.g.
ou=my<problematic>entry,dc=example,dc=com becomes
ou=my\<problematic\>entry,dc=example,dc=com, causing error 32. I'm not sure
if it's the directory server or JNDI adding the escaping, as ldapsearch
from the command line doesn't seem to behave this way, but it doesn't
really matter: I want to remove the entries and get rid of the issue.
Unfortunately, I'm unable to:
$ ldapdelete -D "cn=directory manager" -WxH "ldap://example.com:389"
"ou=my<problematic>entry,dc=example,dc=com"
Enter LDAP Password:
ldap_delete: Invalid DN syntax (34)
additional info: DN value invalid per syntax
I've also tried deleting through Apache Directory Studio, error 34 there as
well.
So, any ideas on how to get rid of them? The only thing I can think of is
to db2ldif the entire directory, manually excise the entries from the LDIF
file and then re-import. But I'd rather not take this step unless there's
no other way.
-Audun
9 years, 5 months
Errors after upgrade
by Ted Strother
We upgraded from
fedora-ds-base-1.1.3-2
to
389-ds-base-1.2.11.29-2
And are getting the following errors on startup, does anyone have any advice?:
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreMatch] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.26] for the attribute [icsDWPHost]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreMatch] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.26] for the attribute [icsDomainNames]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseExactMatch] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.26] for the attribute [icsPartition]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreMatch] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.26] for the attribute [icsDWPBackEndHosts]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalOperatingPrefs]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalTimezone]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalAdmd]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalSysopCanWritePassword]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalOrgUnit4]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalFlags]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalOrgUnit1]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalOrgUnit3]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalDefaultReminder]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalPrmd]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalLanguageId]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalXItemId]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalCountry]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalAccessDomain]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalResourceCapacity]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalPasswordRequired]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalDisplayPrefs]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalPreferredSMSCPhoneNumber]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalNotifMechanism]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalOrganization]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalDefaultNoteReminder]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalRefreshPrefs]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalServerVersion]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalNodeAlias]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalHost]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalMobileTelephoneType]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalAccess]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalSMSTimeRange]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalResourceNumber]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalOrgUnit2]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute
[ctCalDefaultTaskReminder]
[25/Jun/2014:09:39:54 -0400] attr_syntax_create - Error: the EQUALITY
matching rule [caseIgnoreIA5Match] is not compatible with the syntax
[1.3.6.1.4.1.1466.115.121.1.15] for the attribute [ctCalPublishedType]
--
Ted Strother
Systems Administrator Senior
Information Technology Services
University of Michigan-Dearborn
19000 Hubbard Drive, 238 FCN
Dearborn, MI 48126
9 years, 5 months