On 04/22/2013 04:43 AM, s.varadha rajan wrote:
Hi Team,
We have implemented 389-ds in Ubuntu 12.04 LTS. Everything is working
fine.we have created ou called "groups " such as
ou=groups,dc=xxx,dc=com. same 389-ds (1.2.1-0ubuntu2)implemented in
the Ubuntu linux 10.04 LTS and we can see the "aci" attributes in
the groups OU. Same aci is not available in the "1.2.10.4-0ubuntu3.1".
For example, if i connected my *older ldap server* through
phpldapadmin and select any group from "ou=groups,dc=xxx,dc=com" , i
can see the below fields from aci attribute,
(targetattr="*")
(target="ldap:///cn=*,ou=services,ou=groups,dc=xxx,dc=com") (version
3.0;acl "<group name>"; allow (write)(userdn="ldap:///uid=<user
name>,ou=people,dc=xxx,dc=com");)
(targetattr="*")
(target="ldap:///cn=*,ou=services,ou=groups,dc=xxx,dc=com") (version
3.0;acl "<group name>"; allow (write)(userdn="ldap:///uid=<user
name>,ou=people,dc=xxx,dc=com");)
(targetattr="*")
(target="ldap:///cn=*,ou=services,ou=groups,dc=xxx,dc=com") (version
3.0;acl "<group name>"; allow (write)(userdn="ldap:///uid=<user
name>,ou=people,dc=xxx,dc=com");)
For getting the same details, if i connect to my new LDAP server
through phpldapadmin, "aci" attribute itself not displayed.
Is it the attribute is related to samba ?
The aci attribute? No.
Refered some of the blogs through net, if i search through
ldapsearch,
ldapsearch -x -h localhost -p <port no> -s base -b "cn=schema"
"objectclass=*" | grep -i samba -> output is displayed in the old
server with some values.same command if i apply in new server, no output.
For schema, 389 is now compliant with the LDAPv3 RFCs. These state that
the schema attributes such as attributeTypes, objectClasses, etc. are
OPERATIONAL attributes and must be explicitly requested by the search
command. So
ldapsearch -x -h localhost -p <port no> -s base -b "cn=schema"
"objectclass=*" attributeTypes objectClasses | grep -i samba
The other thing about cn=schema is that the ldapsearch LDIF output is
wrapped at 78 characters which makes grep difficult. See
http://richmegginson.livejournal.com/18726.html
For "aci", it too is an operational attribute - in order to see it:
ldapsearch -x -h localhost -p <port no> -b "dc=xxx,dc=com"
"aci=*" aci
My question may be silly,pls don't mistake.what could be the reason ?
Regards,
Varad
--
389 users mailing list
389-users(a)lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/389-users