On 9/22/21 5:11 PM, Michael Starling wrote:
------------------------------------------------------------------------
*From:* Mark Reynolds <mreynolds(a)redhat.com>
*Sent:* Wednesday, September 22, 2021 3:38 PM
*To:* General discussion list for the 389 Directory server project.
<389-users(a)lists.fedoraproject.org>; Michael Starling
<mlstarling31(a)hotmail.com>
*Subject:* Re: [389-users] dsidm utility inconsistencies
On 9/22/21 2:58 PM, Michael Starling wrote:
>
> Unless I'm interpreting the man pages, and documentation wrong there
> seems to be some issues with the dsidm utility. Perhaps I'm doing
> something wrong?
>
>
> This works.
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account get-by-dn
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> cn: Mike Starling
>
> gecos: Mike Starling test account
>
> gidNumber: 100
>
> givenName: Mike
>
> homeDirectory: /home/mstarlingt
>
> loginShell: /bin/ksh
>
> mail: mstarling(a)mydomain.com <mailto:mstarling@mydomain.com>
>
> objectClass: person
>
> objectClass: organizationalPerson
>
> objectClass: inetOrgPerson
>
> objectClass: posixAccount
>
> objectClass: top
>
> objectClass: shadowAccount
>
> shadowExpire: 99999
>
> shadowLastChange: 18857
>
> shadowMax: 33
>
> shadowWarning: 1
>
> sn: Starling
>
> uid: mstarlingt
>
> uidNumber: 25574
>
>
> #Password reset works
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account reset_password
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
>
> CONFIRM - Enter new password for
> uid=mstarlingt,ou=People,dc=mydomain,dc=com :
>
> reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
>
>
> #Unable to lock the account.
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock uid=mstarlingt
>
> *Error: No such object *
>
> *
> *
>
> *I consult the help which says to specify the dn*
>
> *
> *
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock -h
>
> usage: dsidm instance account lock [-h] [dn]
>
> positional arguments:
>
> dnThe dn to lock
>
> optional arguments:
>
> -h, --helpshow this help message and exit
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> Error: search_ext() argument 1 must be str, not None
>
I think this is a known bug (which was fixed). What version of
python-lib389 is installed?
Thanks Mark.
python3-lib389-1.4.3.17-1.module_el8+10764+2b5f8656.noarch is installed
Yes this is
a old version, and the fix (Issue 4912) was recently made.
We will have to do new builds...
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com account lock
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Error: search_ext() argument 1 must be str, not None
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.athenahealth.com -b
> dc=mydomain,dc=com account lock "uid=mstarlingt"
>
>
> I tried changing the base to the People OU where the account lives
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> ou=People,dc=mydomain,dc=com account lock
> "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
>
> Error: search_ext() argument 1 must be str, not None
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : mstarlingt
>
> Error: No object exists given the filter criteria mstarlingt
>
What is in the access log?
Here's what I see in the logs.
22/Sep/2021:17:09:28.515626170 -0400] conn=3947 op=2 SRCH
base="ou=people,dc=mydomain,dc=com" scope=2
filter="(&(&(objectClass=nsPerson)(objectClass=nsAccount)(objectClass=nsOrgPerson)(objectClass=posixAccount))(|(uid=mstarlingt)(displayName=mstarlingt)(cn=mstarlingt)))"
attrs="distinguishedName"
So dsidm is pretty opinionated about how it looks for users (which might
need to change). It only looks for entries that have all of these
objectclasses: nsPerson, nsAccount, nsOrgPerson, posixAccount. What
objectclasses are in your user entry?
Mark
Thanks,
Mark
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
> Error: No object exists given the filter criteria
> uid=mstarlingt,ou=People,dc=mydomain,dc=com
>
>
> dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b
> dc=mydomain,dc=com user get
>
> Enter uid to retrieve : uid=mstarlingt
>
> Error: No object exists given the filter criteria uid=mstarlingt
>
>
>
>
> _______________________________________________
> 389-users mailing list --389-users(a)lists.fedoraproject.org
<mailto:389-users@lists.fedoraproject.org>
> To unsubscribe send an email to389-users-leave(a)lists.fedoraproject.org
<mailto:389-users-leave@lists.fedoraproject.org>
> Fedora Code of
Conduct:https://docs.fedoraproject.org/en-US/project/code-of-conduct/
<
https://docs.fedoraproject.org/en-US/project/code-of-conduct/>
> List
Guidelines:https://fedoraproject.org/wiki/Mailing_list_guidelines
<
https://fedoraproject.org/wiki/Mailing_list_guidelines>
> List
Archives:https://lists.fedoraproject.org/archives/list/389-users@lists.fe...
<
https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproje...
> Do not reply to spam on the list, report it:https://pagure.io/fedora-infrastructure
<
https://pagure.io/fedora-infrastructure>
--
Directory Server Development Team
--
Directory Server Development Team