Hi Rich,
On Thursday 23 July 2009 20:02:37 Rich Megginson wrote:
> it seems that when I try to modify userPassword, the reference
to
> uid=admin is not forwarded and only the proxyuser rights are used..
I suppose you could turn on ACL summary logging to see what's going on.
http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting I followed your
suggestion, and I found that:
1) when I modify the givenName, the local server made a proxy auth using the
local binddn. log states:
NSACLPlugin - proxied authorization dn is (uid=u1,ou=serv
ice administrators,dc=babel,dc=it)
2) when I modify the userPassword, the remote server states:
NSACLPlugin - proxied authorization dn is ()
now I'm tcpdumping, but really strange
old details down.
Peace,
R.
Roberto Polli wrote:
> On Thursday 23 July 2009 19:10:26 Rich Megginson wrote:> >>> case1)
>
>>>>> * I bind with uid=admin to the local DS tree to modify the
>>>>> "givenName" of a user on the remote server
>>>>> * the modify is successful, as the uid=admin is proxied and the
>>>>> "uid=admin" is replicated on the remote server
>>>>>
>>>>> case2)
>>>>> * same as case1 but I try to modify "userPassword"
>>>>> * the modify fails as the remote server won't evaluate aci on
>>>>> "uid=admin" but on "dn:proxyuser"
>>
>> So the user uid=admin - is that the Directory Manager (rootdn)?
> no
>> is it a member of roledn = "ldap:///cn=SA role,dc=babel,dc=it"?
> yes, and it can modify users' attribute, but password
>> Does roledn = "ldap:///cn=SA role,dc=babel,dc=it"
exist on both the
>> local and remote servers?
> yes
> >
> it seems that when I try to modify userPassword, the reference
to
> uid=admin is not forwarded and only the proxyuser rights are used..
I suppose you could turn on ACL summary logging to see what's going on.
http://directory.fedoraproject.org/wiki/FAQ#Troubleshooting >
> > Peace,
> > R.
--
Roberto Polli
Babel S.r.l. -
http://www.babel.it
Tel. +39.06.91801075 - fax +39.06.91612446
Tel. cel +39.340.6522736
P.zza S.Benedetto da Norcia, 33 - 00040 Pomezia (Roma)
"Il seguente messaggio contiene informazioni riservate. Qualora questo
messaggio fosse da Voi ricevuto per errore, Vogliate cortesemente darcene
notizia a mezzo e-mail. Vi sollecitiamo altresì a distruggere il messaggio
erroneamente ricevuto. Quanto precede Vi viene chiesto ai fini del rispetto
della legge in materia di protezione dei dati personali."