Re: dsidm utility inconsistencies
by Michael Starling
________________________________
From: Michael Starling <mlstarling31(a)hotmail.com>
Sent: Thursday, September 23, 2021 10:10 AM
To: Mark Reynolds <mreynolds(a)redhat.com>; General discussion list for the 389 Directory server project. <389-users(a)lists.fedoraproject.org>
Subject: Re: [389-users] dsidm utility inconsistencies
________________________________
From: Mark Reynolds <mreynolds(a)redhat.com>
Sent: Wednesday, September 22, 2021 8:14 PM
To: Michael Starling <mlstarling31(a)hotmail.com>; General discussion list for the 389 Directory server project. <389-users(a)lists.fedoraproject.org>
Subject: Re: [389-users] dsidm utility inconsistencies
On 9/22/21 5:11 PM, Michael Starling wrote:
________________________________
From: Mark Reynolds <mreynolds(a)redhat.com><mailto:mreynolds@redhat.com>
Sent: Wednesday, September 22, 2021 3:38 PM
To: General discussion list for the 389 Directory server project. <389-users(a)lists.fedoraproject.org><mailto:389-users@lists.fedoraproject.org>; Michael Starling <mlstarling31(a)hotmail.com><mailto:mlstarling31@hotmail.com>
Subject: Re: [389-users] dsidm utility inconsistencies
On 9/22/21 2:58 PM, Michael Starling wrote:
Unless I'm interpreting the man pages, and documentation wrong there seems to be some issues with the dsidm utility. Perhaps I'm doing something wrong?
This works.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account get-by-dn uid=mstarlingt,ou=People,dc=mydomain,dc=com
dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
cn: Mike Starling
gecos: Mike Starling test account
gidNumber: 100
givenName: Mike
homeDirectory: /home/mstarlingt
loginShell: /bin/ksh
mail: mstarling(a)mydomain.com<mailto:mstarling@mydomain.com>
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowExpire: 99999
shadowLastChange: 18857
shadowMax: 33
shadowWarning: 1
sn: Starling
uid: mstarlingt
uidNumber: 25574
#Password reset works
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account reset_password "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
CONFIRM - Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
#Unable to lock the account.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt
Error: No such object
I consult the help which says to specify the dn
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock -h
usage: dsidm instance account lock [-h] [dn]
positional arguments:
dn The dn to lock
optional arguments:
-h, --help show this help message and exit
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
I think this is a known bug (which was fixed). What version of python-lib389 is installed?
Thanks Mark.
python3-lib389-1.4.3.17-1.module_el8+10764+2b5f8656.noarch is installed
Yes this is a old version, and the fix (Issue 4912) was recently made. We will have to do new builds...
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b dc=mydomain,dc=com account lock "uid=mstarlingt"
I tried changing the base to the People OU where the account lives
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b ou=People,dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : mstarlingt
Error: No object exists given the filter criteria mstarlingt
What is in the access log?
Here's what I see in the logs.
22/Sep/2021:17:09:28.515626170 -0400] conn=3947 op=2 SRCH base="ou=people,dc=mydomain,dc=com" scope=2 filter="(&(&(objectClass=nsPerson)(objectClass=nsAccount)(objectClass=nsOrgPerson)(objectClass=posixAccount))(|(uid=mstarlingt)(displayName=mstarlingt)(cn=mstarlingt)))" attrs="distinguishedName"
So dsidm is pretty opinionated about how it looks for users (which might need to change). It only looks for entries that have all of these objectclasses: nsPerson, nsAccount, nsOrgPerson, posixAccount. What objectclasses are in your user entry?
Mark
Ahh. That's it. The mstarlingt account was created with an LDIF and does not have the "ns" object classes.
I notice when I go to create an account with dsidm I have limited ability to specify attributes.
Is the best way to create an account still with an LDIF file? When I create an account with dsidm it has no loginShell. Is there a default template dsidm pulls from that needs to be updated with the other possible user attributes that are set as the default and not covered by the dsidm utility?
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user create --uid="dstest" --cn="Test dsidm" --gidNumber="100" --homeDirectory="/home/dstest" --displayName="Test Account" --uidnumber="25941" --mail="mstarling(a)mydomain.com" --loginShell="/bin/bash"
usage: dsidm [-h] [-b BASEDN] [-v] [-D BINDDN] [-w BINDPW] [-W] [-W PWDFILE]
[-Z] [-j]
instance
{account,group,initialise,organizationalunit,posixgroup,user,client_config,role}
...
dsidm: error: unrecognized arguments: --uidnumber=25941 --mail=mstarling(a)mydomain.com --loginShell=/bin/bash
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user create -h
usage: dsidm instance user create [-h] [--uid [UID]] [--cn [CN]]
[--displayName [DISPLAYNAME]]
[--uidNumber [UIDNUMBER]]
[--gidNumber [GIDNUMBER]]
[--homeDirectory [HOMEDIRECTORY]]
optional arguments:
-h, --help show this help message and exit
--uid [UID] Value of uid
--cn [CN] Value of cn
--displayName [DISPLAYNAME]
Value of displayName
--uidNumber [UIDNUMBER]
Value of uidNumber
--gidNumber [GIDNUMBER]
Value of gidNumber
--homeDirectory [HOMEDIRECTORY]
Value of homeDirectory
So if I create a user with dsidm and it adds the "ns" object classes I still can't run some of the dsidm commands against that account
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get dstest
dn: uid=dstest,ou=People,dc=mydomain,dc=com
cn: Test Dsconf
displayName: Test Account
employeeNumber: 25429
gidNumber: 100
homeDirectory: /home/dstest
loginShell: /bin/bash
mail: mstarling(a)mydomain.com
objectClass: top
objectClass: nsPerson
objectClass: nsAccount
objectClass: nsOrgPerson
objectClass: posixAccount
uid: dstest
uidNumber: 25941
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock dstest
Error: dstest is not a valid DN
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=dstest,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status uid=dstest,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status dstest
Error: dstest is not a valid DN
dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status
Enter dn to check : uid=dstest,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
Thanks,
Mark
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: No object exists given the filter criteria uid=mstarlingt,ou=People,dc=mydomain,dc=com
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt
Error: No object exists given the filter criteria uid=mstarlingt
_______________________________________________
389-users mailing list -- 389-users(a)lists.fedoraproject.org<mailto:389-users@lists.fedoraproject.org>
To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org<mailto:389-users-leave@lists.fedoraproject.org>
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--
Directory Server Development Team
--
Directory Server Development Team
2 years, 7 months
Re: dsidm utility inconsistencies
by Mark Reynolds
On 9/22/21 5:11 PM, Michael Starling wrote:
>
>
> ------------------------------------------------------------------------
> *From:* Mark Reynolds <mreynolds(a)redhat.com>
> *Sent:* Wednesday, September 22, 2021 3:38 PM
> *To:* General discussion list for the 389 Directory server project.
> <389-users(a)lists.fedoraproject.org>; Michael Starling
> <mlstarling31(a)hotmail.com>
> *Subject:* Re: [389-users] dsidm utility inconsistencies
>
>
> On 9/22/21 2:58 PM, Michael Starling wrote:
>>
>> Unless I'm interpreting the man pages, and documentation wrong there
>> seems to be some issues with the dsidm utility. Perhaps I'm doing
>> something wrong?
>>
>>
>> This works.
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com account get-by-dn
>> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>>
>> dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
>>
>> cn: Mike Starling
>>
>> gecos: Mike Starling test account
>>
>> gidNumber: 100
>>
>> givenName: Mike
>>
>> homeDirectory: /home/mstarlingt
>>
>> loginShell: /bin/ksh
>>
>> mail: mstarling(a)mydomain.com <mailto:mstarling@mydomain.com>
>>
>> objectClass: person
>>
>> objectClass: organizationalPerson
>>
>> objectClass: inetOrgPerson
>>
>> objectClass: posixAccount
>>
>> objectClass: top
>>
>> objectClass: shadowAccount
>>
>> shadowExpire: 99999
>>
>> shadowLastChange: 18857
>>
>> shadowMax: 33
>>
>> shadowWarning: 1
>>
>> sn: Starling
>>
>> uid: mstarlingt
>>
>> uidNumber: 25574
>>
>>
>> #Password reset works
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com account reset_password
>> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>>
>> Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
>>
>> CONFIRM - Enter new password for
>> uid=mstarlingt,ou=People,dc=mydomain,dc=com :
>>
>> reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
>>
>>
>>
>> #Unable to lock the account.
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com account lock uid=mstarlingt
>>
>> *Error: No such object *
>>
>> *
>> *
>>
>> *I consult the help which says to specify the dn*
>>
>> *
>> *
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com account lock -h
>>
>> usage: dsidm instance account lock [-h] [dn]
>>
>> positional arguments:
>>
>> dnThe dn to lock
>>
>> optional arguments:
>>
>> -h, --helpshow this help message and exit
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com account lock
>> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>>
>> Error: search_ext() argument 1 must be str, not None
>>
> I think this is a known bug (which was fixed). What version of
> python-lib389 is installed?
>
>
> Thanks Mark.
>
>
> python3-lib389-1.4.3.17-1.module_el8+10764+2b5f8656.noarch is installed
Yes this is a old version, and the fix (Issue 4912) was recently made.
We will have to do new builds...
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com account lock
>> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>>
>> Error: search_ext() argument 1 must be str, not None
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b
>> dc=mydomain,dc=com account lock "uid=mstarlingt"
>>
>>
>> I tried changing the base to the People OU where the account lives
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> ou=People,dc=mydomain,dc=com account lock
>> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>>
>> Error: search_ext() argument 1 must be str, not None
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com user get
>>
>> Enter uid to retrieve : mstarlingt
>>
>> Error: No object exists given the filter criteria mstarlingt
>>
> What is in the access log?
>
>
>
> Here's what I see in the logs.
>
>
> 22/Sep/2021:17:09:28.515626170 -0400] conn=3947 op=2 SRCH
> base="ou=people,dc=mydomain,dc=com" scope=2
> filter="(&(&(objectClass=nsPerson)(objectClass=nsAccount)(objectClass=nsOrgPerson)(objectClass=posixAccount))(|(uid=mstarlingt)(displayName=mstarlingt)(cn=mstarlingt)))"
> attrs="distinguishedName"
So dsidm is pretty opinionated about how it looks for users (which might
need to change). It only looks for entries that have all of these
objectclasses: nsPerson, nsAccount, nsOrgPerson, posixAccount. What
objectclasses are in your user entry?
Mark
>
> Thanks,
>
> Mark
>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com user get
>>
>> Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
>>
>> Error: No object exists given the filter criteria
>> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>>
>>
>> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
>> dc=mydomain,dc=com user get
>>
>> Enter uid to retrieve : uid=mstarlingt
>>
>> Error: No object exists given the filter criteria uid=mstarlingt
>>
>>
>>
>>
>> _______________________________________________
>> 389-users mailing list --389-users(a)lists.fedoraproject.org <mailto:389-users@lists.fedoraproject.org>
>> To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org <mailto:389-users-leave@lists.fedoraproject.org>
>> Fedora Code of Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/ <https://docs.fedoraproject.org/en-US/project/code-of-conduct/>
>> List Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines <https://fedoraproject.org/wiki/Mailing_list_guidelines>
>> List Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fe... <https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...>
>> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure <https://pagure.io/fedora-infrastructure>
> --
> Directory Server Development Team
--
Directory Server Development Team
2 years, 7 months
Re: dsidm utility inconsistencies
by Mark Reynolds
On 9/22/21 2:58 PM, Michael Starling wrote:
>
> Unless I'm interpreting the man pages, and documentation wrong there
> seems to be some issues with the dsidm utility. Perhaps I'm doing
> something wrong?
>
>
> This works.
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account get-by-dn
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> cn: Mike Starling
>
> gecos: Mike Starling test account
>
> gidNumber: 100
>
> givenName: Mike
>
> homeDirectory: /home/mstarlingt
>
> loginShell: /bin/ksh
>
> mail: mstarling(a)mydomain.com
>
> objectClass: person
>
> objectClass: organizationalPerson
>
> objectClass: inetOrgPerson
>
> objectClass: posixAccount
>
> objectClass: top
>
> objectClass: shadowAccount
>
> shadowExpire: 99999
>
> shadowLastChange: 18857
>
> shadowMax: 33
>
> shadowWarning: 1
>
> sn: Starling
>
> uid: mstarlingt
>
> uidNumber: 25574
>
>
> #Password reset works
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account reset_password
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
>
> CONFIRM - Enter new password for
> uid=mstarlingt,ou=People,dc=mydomain,dc=com :
>
> reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
>
>
> #Unable to lock the account.
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock uid=mstarlingt
>
> *Error: No such object*
>
> *
> *
>
> *I consult the help which says to specify the dn*
>
> *
> *
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock -h
>
> usage: dsidm instance account lock [-h] [dn]
>
> positional arguments:
>
> dnThe dn to lock
>
> optional arguments:
>
> -h, --helpshow this help message and exit
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> Error: search_ext() argument 1 must be str, not None
>
I think this is a known bug (which was fixed). What version of
python-lib389 is installed?
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Error: search_ext() argument 1 must be str, not None
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b
> dc=mydomain,dc=com account lock "uid=mstarlingt"
>
>
> I tried changing the base to the People OU where the account lives
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> ou=People,dc=mydomain,dc=com account lock
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Error: search_ext() argument 1 must be str, not None
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : mstarlingt
>
> Error: No object exists given the filter criteria mstarlingt
>
What is in the access log?
Thanks,
Mark
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> Error: No object exists given the filter criteria
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
>
> dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : uid=mstarlingt
>
> Error: No object exists given the filter criteria uid=mstarlingt
>
>
>
>
> _______________________________________________
> 389-users mailing list -- 389-users(a)lists.fedoraproject.org
> To unsubscribe send an email to 389-users-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--
Directory Server Development Team
2 years, 7 months
dsidm utility inconsistencies
by Michael Starling
Unless I'm interpreting the man pages, and documentation wrong there seems to be some issues with the dsidm utility. Perhaps I'm doing something wrong?
This works.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account get-by-dn uid=mstarlingt,ou=People,dc=mydomain,dc=com
dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
cn: Mike Starling
gecos: Mike Starling test account
gidNumber: 100
givenName: Mike
homeDirectory: /home/mstarlingt
loginShell: /bin/ksh
mail: mstarling(a)mydomain.com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowExpire: 99999
shadowLastChange: 18857
shadowMax: 33
shadowWarning: 1
sn: Starling
uid: mstarlingt
uidNumber: 25574
#Password reset works
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account reset_password "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
CONFIRM - Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
#Unable to lock the account.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt
Error: No such object
I consult the help which says to specify the dn
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock -h
usage: dsidm instance account lock [-h] [dn]
positional arguments:
dn The dn to lock
optional arguments:
-h, --help show this help message and exit
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b dc=mydomain,dc=com account lock "uid=mstarlingt"
I tried changing the base to the People OU where the account lives
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b ou=People,dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : mstarlingt
Error: No object exists given the filter criteria mstarlingt
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: No object exists given the filter criteria uid=mstarlingt,ou=People,dc=mydomain,dc=com
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt
Error: No object exists given the filter criteria uid=mstarlingt
2 years, 7 months
attribute passwordMinLength cfg issues/error
by Ghiurea, Isabella
As part of user global policy we need to configure user password min length , see my cfg in dse.ldif , when trying to update a user password to a password with length > 0 seeing the following error:.
Result: Constraint violation (19)
Additional info: Failed to update password
Is there a plugin I need to install or what I am missing from this cfg ?
Here is my only changes I have in dse.ldif :
nsslapd-pwpolicy-inherit-global: on
nsslapd-pwpolicy-local: off
passwordTrackUpdateTime: on
passwordCheckSyntax: on
passwordMinLength: 8
Isabella
2 years, 7 months
can't get admin console to connect
by Chase Miller
I have done many of 389 ldap server setups.
Have a new install, and I can't get for the life of me able to get the
admin console to connect to the server.
Message i get is
[Tue Sep 21 14:55:44.279828 2021] [:notice] [pid 1337:tid 140593598555904]
[client xx.xx.xx.xxx:61796] admserv_check_authz(): passing
[/admin-serv/authenticate] to the userauth handler
Yes, I have read the documentation; i have modified the
any suggestions?
replace: nsAdminAccessAddresses
nsAdminAccessAddresses: 192.168.1.*
-
replace: nsAdminAccessHosts
nsAdminAccessHosts: *
2 years, 7 months
ns-newpolicy/pl documentation/use case
by Ghiurea, Isabella
Hi List
I am searching for some documentation for ns-newpolicy.pl file , as per RH Doc I can use that script to add the attribute : pwdUpdateTime to each uid entry after I already cfg in DS Password TrackUpdateTime and pwdpolicy- inherit -global to 'on';
Thank you
Isabella
2 years, 7 months
Announcing 389 Directory Server 1.4.4.17
by Mark Reynolds
389 Directory Server 1.4.4.17
The 389 Directory Server team is proud to announce 389-ds-base
version 1.4.4.17
Fedora packages are available on Fedora 33.
Fedora 33:
https://koji.fedoraproject.org/koji/taskinfo?taskID=76027095
<https://koji.fedoraproject.org/koji/taskinfo?taskID=76027095> - Koji
https://bodhi.fedoraproject.org/updates/FEDORA-2021-1c2247a1ec
<https://bodhi.fedoraproject.org/updates/FEDORA-2021-1c2247a1ec> - Bohdi
The new packages and versions are:
*
389-ds-base-1.4.4.17-1
Source tarballs are available for download at Download
389-ds-base Source
<https://github.com/389ds/389-ds-base/archive/389-ds-base-1.4.4.17.tar.gz>
Highlights in 1.4.4.17
*
Bug fixes
*
Cockpit UI migrated to Patternfly 4 (fixed all security vulnerabilities)
Installation and Upgrade
See Download <https://www.port389.org/docs/389ds/download.html> for
information about setting up your yum repositories.
To install the server use **dnf install 389-ds-base**
To install the Cockpit UI plugin use **dnf install cockpit-389-ds**
After rpm install completes, run **dscreate interactive**
For upgrades, simply install the package. There are no further
steps required.
There are no upgrade steps besides installing the new rpms
See Install_Guide
<https://www.port389.org/docs/389ds/howto/howto-install-389.html> for
more information about the initial installation and setup
See Source
<https://www.port389.org/docs/389ds/development/source.html> for
information about source tarballs and SCM (git) access.
Feedback
We are very interested in your feedback!
Please provide feedback and comments to the 389-users mailing list:
https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...
<https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...>
If you find a bug, or would like to see a new feature, file it in our
GitHub project: https://github.com/389ds/389-ds-base
<https://github.com/389ds/389-ds-base>
*
Bump version to 1.4.4.17
*
Issue 4927 - rebase lib389 and cockpit in 1.4.4
*
Issue 4908 - Updated several dsconf –help entries (typos, wrong
descriptions, etc.)
*
Issue 4912 - Account Policy plugin does not set the config entry DN
*
Issue 4796 - Add support for nsslapd-state to CLI & UI
*
Issue 4894 - IPA failure in ipa user-del –preserve (#4907)
*
Issue 4169 - backport lib389 cert list fix
*
Issue 4912 - dsidm command crashing when account policy plugin
is enabled
*
Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
*
Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks
*
Issue 4696 - Password hash upgrade on bind (#4840)
*
Issue 4875 - CLI - Add some verbosity to installer
*
Issue 4884 - server crashes when dnaInterval attribute is set to zero
*
Issue 4877 - RFE - EntryUUID to validate UUIDs on fixup (#4878)
*
Issue 4734 - import of entry with no parent warning (#4735)
*
Issue 4872 - BUG - entryuuid enabled by default causes replication
issues (#4876)
*
Issue 4763 - Attribute Uniqueness Plugin uses wrong subtree on
ModRDN (#4871)
*
Issue 4851 - Typos in “dsconf pwpolicy set –help” (#4867)
*
Issue 4736 - lib389 - fix regression in certutil error checking
*
Issue 4736 - CLI - Errors from certutil are not propagated
*
Issue 4460 - Fix isLocal and TLS paths discovery (#4850)
*
Issue 4443 - Internal unindexed searches in syncrepl/retro changelog
*
Issue 4817 - BUG - locked crypt accounts on import may allow all
passwords (#4819)
*
Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
*
Issue 4262 - Fix Index out of bound in fractional test (#4828)
*
Issue 4822 - Fix CI temporary password: fixture leftover breaks
them (#4823)
*
Issue 4656 - remove problematic language from ds-replcheck
*
Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
*
Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
*
Issue 4788 - CLI should support Temporary Password Rules
attributes (#4793)
*
Issue 4506 - Improve SASL logging
*
Issue 4093 - Fix MEP test case
*
Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
*
Issue 4789 - Temporary password rules are not enforce with local
password policy (#4790)
*
Issue 4797 - ACL IP ADDRESS evaluation may corrupt
c_isreplication_session connection flags (#4799)
*
Issue 4447 - Crash when the Referential Integrity log is manually edited
*
Issue 4773 - Add CI test for DNA interval assignment
*
Issue 4750 - Fix compiler warning in retrocl (#4751)
2 years, 7 months
Audit entries of Account Policy Plug-In behavior
by Claudionor Raymundo
Hi folks.
There is any way to deactivate audit of lastlogintime in audit file, in the directory server with Account Policy Plug-In enabled?
My directory server have 190,000+ users, and many of then logs 200 a 300 times a day (emails clients, development tools, etc) and this behavior pollutes the audit log. But i want to maintain Account Policy Plug-In enabled to control inactive users.
Thanks for any help you can provide.
2 years, 7 months