Overview of our setup
- Our webservers use the PHP plugin "ldap_mod_del" to execute ldap changes.
- Our 389 servers are master-master
- We are attempting to delete the displayName attribute from a user
Run from webserver in PHP:
- When performing a modify, everything works. changes are replicated
to other masters.
- When performing a delete, the delete is successful, yet the change
is not replicated to the other master.
Run from 389 Console and using "ldapmodify" on cmd line:
- Modify - works
- Delete - works
Although I feel the ldap_mod_del plugin may have something to do with
it, replication is replication. In this case the simple replication is
not functioning when a node sees new data.
I need some help understanding the difference between password policy for
user versus subtree and where it needs to be set.
Using the 389 console gui, I see that I can set the password policy under
the configuration tab in the data section. I am thinking this creates a
global policy? - but this did not lock out my test account after I told it
to lock out after 5 failed password attempts.
So I went to the directory tab, and on the subtree where my test account
is located, used the subtree option to set the same password and lockout
policy that I set under configuration tab. -- same result, my test
account did not lock out.
So then in the same directory tab subtree, I tried the user option, and
same old same old - no lock out.
Can anyone point me to where I am going wrong? If I go to my actual user
account, I can lock myself out that way but that will get pretty old for
I have an environment with multiple Active Directories Forests and several
UNIX client machines
I have another LDAP Directory to authenticate UNIX users.
The problem with this implementation is that the users used and passwords
used to authenticate in WIndows and Unix machines are different.
My idea is to use the Active Directories as main repositories for users and
I want to enable users of Active Directories to login in the UNIX client
machines (Solaris, Linux and AIX) using their regular windows users and
I have a requirement to have the UIDs and GIDs of UNIX users consistent
across all UNIX machines.
I am considering the use of 389 Directory Server to create a unique
directory with the users from both Active Directories and configure all the
Unix clients to use this directory.
I found several references to synchronisation between 389 Directory Server
and Active Directory however i found no reference to a configuration with
multiple Active Directories.
Is this possible ??
Does someone have some kind of suggestion to accomplish this goal ?
Thanks in advance
I am using 389 directory server 220.127.116.11 and I have noticed following error message in the error log and slapd process is stop responding in the mulrtimaster environment. Kindly let me know this fix got fixed in any releases, if yes please provide me the bug /url .
Error log message:
repl5_tot_create_async_result_thread failed. Netscape Portable Runtime error -5974 (Insufficient system resources.)
repl5_inc_run: repl5_tot_create_async_result_thread failed; error - -1
Thanks in Advance,
I'm trying to set up password policy on my ldap 389DS infrastructure which
is in a mutilple master Replicated Environment
I have enabled password policy trough 389DS console. At frist, I just want
to turn on the syntax check (passwordchecksyntax entry) of a user password
on a subtree. It works properly and after a few seconds it does not work.
Sometimes, I have this message in error log. [19/May/2014:14:10:54 +0200]
- Skipping CoS Definition
cn=nsPwPolicy_CoS,ou=IR44,ou=Recouvrement,dc=recouv--no CoS Templates
found, which should be added before the CoS Definition.
[20/May/2014:14:30:25 +0200] - cos_cache_query_attr: failed to normalize
dn ou=Org,ou=People,ou=IR44,ou=Recouvrement,dc=recouv. Processing the pre
I found some posts about this error but no response.
Version : CentOS release 5.5 (Final) 389DS 18.104.22.168 Console 1.1.5
Thank you for your answer and help.