I have read the document:
Howto:ChainOnUpdate - Fedora Directory Server http://directory.fedora.redhat.com/wiki/Howto:ChainOnUpdate
and have been unable to get it to work. When I attempt a write to the consumer it makes the change on the consumer and does not update the master. With the next change on the master of any kind, the mapping tree entry for this suffix changes from "nsslapd-state: backend" to "nsslapd-state: referral on update". Once this state changes, my client complains that it cannot update, since it cannot follow referrals.
In addition, there are no log entries on the master to indicate any activity back from the consumer to the master, i.e. a proxy login.
Trying to install FDS 1.0.1 from rpm on Fedora Core 4, I get the following error:
[root@localhost kieran]# rpm -ivh fedora-ds-1.0.1-1.FC4.i386.opt.rpm Preparing... ########################################### [100%] /var/tmp/rpm-tmp.3816: line 19: /opt/fedora-ds/stop-admin: No such file or directory error: %pre(fedora-ds-1.0.1-1.Linux.i386) scriptlet failed, exit status 127 error: install: %pre scriptlet failed (2), skipping fedora-ds-1.0.1-1.Linux
I get the same response trying to install v. 1.0. I can install 7.1 without issue.
Any thoughts?
Thanks in advance - Kieran
Do you happen to have /opt/fedora-ds/admin-serv/ directory? If so, it calls stop-admin in the pre-install phase. If that's the case, could you clean up /opt/fedora-ds and try rpm install again? --noriko
Kieran Murphy wrote:
Trying to install FDS 1.0.1 from rpm on Fedora Core 4, I get the following error:
[root@localhost kieran]# rpm -ivh fedora-ds-1.0.1-1.FC4.i386.opt.rpm Preparing... ########################################### [100%] /var/tmp/rpm-tmp.3816: line 19: /opt/fedora-ds/stop-admin: No such file or directory error: %pre(fedora-ds-1.0.1-1.Linux.i386) scriptlet failed, exit status 127 error: install: %pre scriptlet failed (2), skipping fedora-ds-1.0.1-1.Linux
I get the same response trying to install v. 1.0. I can install 7.1 without issue.
Any thoughts?
Thanks in advance - Kieran
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
I've been searching through both the openldap, and this mailing list for any reference to defining server-side ACLs to allow/restrict access to certain computers, or groups of computers based on the group that the user is associated with. One reference I found was this:
http://www.openldap.org/lists/openldap-software/200408/msg00280.html
But there are no responses to this query.
Neither the OReilly, or the "Understanding and Deploying Ldap Directory Services" books I have make any solid mention of this either, and online searching has uncovered little, at best.
Does anyone have any ideas if this is even possible, and if it is, are there any references I can use as a template to begin implementation and testing of this?
Thanks for any help you can offer.
Does this help? http://directory.fedora.redhat.com/wiki/Howto:Posix
Michael Montgomery wrote:
I've been searching through both the openldap, and this mailing list for any reference to defining server-side ACLs to allow/restrict access to certain computers, or groups of computers based on the group that the user is associated with. One reference I found was this:
http://www.openldap.org/lists/openldap-software/200408/msg00280.html
But there are no responses to this query.
Neither the OReilly, or the "Understanding and Deploying Ldap Directory Services" books I have make any solid mention of this either, and online searching has uncovered little, at best.
Does anyone have any ideas if this is even possible, and if it is, are there any references I can use as a template to begin implementation and testing of this?
Thanks for any help you can offer.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
I do agree that this is closer to what I'm looking for, but the first problem I see is that I wanted to allow Groups of people to login to Groups of servers like:
cn=www,ou=Group,dc=example,dc=com is a group of www servers. cn=Unix,ou=Group,dc=example,dc=com is a group of Unix users.
So basically, on the people in the Unix group, can login to the www servers, and so forth.
Is there any way, other than client side pam modules, such as: http://www.splitbrain.org/projects/pam_require That will allow this to work?
Thanks again everyone.
On Tue, 2006-01-03 at 08:02 -0700, Richard Megginson wrote:
Does this help? http://directory.fedora.redhat.com/wiki/Howto:Posix
Michael Montgomery wrote:
I've been searching through both the openldap, and this mailing list for any reference to defining server-side ACLs to allow/restrict access to certain computers, or groups of computers based on the group that the user is associated with. One reference I found was this:
http://www.openldap.org/lists/openldap-software/200408/msg00280.html
But there are no responses to this query.
Neither the OReilly, or the "Understanding and Deploying Ldap Directory Services" books I have make any solid mention of this either, and online searching has uncovered little, at best.
Does anyone have any ideas if this is even possible, and if it is, are there any references I can use as a template to begin implementation and testing of this?
Thanks for any help you can offer.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
Michael Montgomery wrote:
I do agree that this is closer to what I'm looking for, but the first problem I see is that I wanted to allow Groups of people to login to Groups of servers like:
cn=www,ou=Group,dc=example,dc=com is a group of www servers. cn=Unix,ou=Group,dc=example,dc=com is a group of Unix users.
So basically, on the people in the Unix group, can login to the www servers, and so forth.
Right. The host attribute is per user. You could set up a Roles for your users, and use Class of Service to automatically add the host attribute to the role members.
Is there any way, other than client side pam modules, such as: http://www.splitbrain.org/projects/pam_require That will allow this to work?
Thanks again everyone.
On Tue, 2006-01-03 at 08:02 -0700, Richard Megginson wrote:
Does this help? http://directory.fedora.redhat.com/wiki/Howto:Posix
Michael Montgomery wrote:
I've been searching through both the openldap, and this mailing list for any reference to defining server-side ACLs to allow/restrict access to certain computers, or groups of computers based on the group that the user is associated with. One reference I found was this:
http://www.openldap.org/lists/openldap-software/200408/msg00280.html
But there are no responses to this query.
Neither the OReilly, or the "Understanding and Deploying Ldap Directory Services" books I have make any solid mention of this either, and online searching has uncovered little, at best.
Does anyone have any ideas if this is even possible, and if it is, are there any references I can use as a template to begin implementation and testing of this?
Thanks for any help you can offer.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
Thanks for the response. I'll read up on this, and see if I can get this working.
On Tue, 2006-01-03 at 11:29 -0700, Richard Megginson wrote:
Michael Montgomery wrote:
I do agree that this is closer to what I'm looking for, but the first problem I see is that I wanted to allow Groups of people to login to Groups of servers like:
cn=www,ou=Group,dc=example,dc=com is a group of www servers. cn=Unix,ou=Group,dc=example,dc=com is a group of Unix users.
So basically, on the people in the Unix group, can login to the www servers, and so forth.
Right. The host attribute is per user. You could set up a Roles for your users, and use Class of Service to automatically add the host attribute to the role members.
ILoveJython wrote:
I have read the document:
Howto:ChainOnUpdate - Fedora Directory Server http://directory.fedora.redhat.com/wiki/Howto:ChainOnUpdate
and have been unable to get it to work. When I attempt a write to the consumer it makes the change on the consumer and does not update the master.
This is bad. If the consumer is configured to be a read only consumer you should not be able to make a change on it. You should either get a referral returned from the consumer to the client program which the client program will follow to make the change on the master, or, if chain on update is working, you will see the operation on the consumer and the same corresponding operation sent to the master.
With the next change on the master of any kind, the mapping tree entry for this suffix changes from "nsslapd-state: backend" to "nsslapd-state: referral on update". Once this state changes, my client complains that it cannot update, since it cannot follow referrals.
Ulf, you've been able to get this running, right?
In addition, there are no log entries on the master to indicate any activity back from the consumer to the master, i.e. a proxy login.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
Richard Megginson wrote:
ILoveJython wrote:
I have read the document:
Howto:ChainOnUpdate - Fedora Directory Server http://directory.fedora.redhat.com/wiki/Howto:ChainOnUpdate
and have been unable to get it to work. When I attempt a write to the consumer it makes the change on the consumer and does not update the master.
This is bad. If the consumer is configured to be a read only consumer you should not be able to make a change on it. You should either get a referral returned from the consumer to the client program which the client program will follow to make the change on the master, or, if chain on update is working, you will see the operation on the consumer and the same corresponding operation sent to the master.
With the next change on the master of any kind, the mapping tree entry for this suffix changes from "nsslapd-state: backend" to "nsslapd-state: referral on update". Once this state changes, my client complains that it cannot update, since it cannot follow referrals.
Ulf, you've been able to get this running, right?
In addition, there are no log entries on the master to indicate any activity back from the consumer to the master, i.e. a proxy login.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
I have yet to get it working. I have pretty much tried everything I can think of to get it going, but no success. I would be quite happy to provide as much detail as is necessary to get it going, since in my environment, this functionality would be quite helpful.
Richard Megginson wrote:
ILoveJython wrote:
I have read the document:
Howto:ChainOnUpdate - Fedora Directory Server http://directory.fedora.redhat.com/wiki/Howto:ChainOnUpdate
and have been unable to get it to work. When I attempt a write to the consumer it makes the change on the consumer and does not update the master.
This is bad. If the consumer is configured to be a read only consumer you should not be able to make a change on it. You should either get a referral returned from the consumer to the client program which the client program will follow to make the change on the master, or, if chain on update is working, you will see the operation on the consumer and the same corresponding operation sent to the master.
With the next change on the master of any kind, the mapping tree entry for this suffix changes from "nsslapd-state: backend" to "nsslapd-state: referral on update". Once this state changes, my client complains that it cannot update, since it cannot follow referrals.
Ulf, you've been able to get this running, right?
Yes, I was testing this a few weeks ago with the 7.1 release on HP-UX. It was configured with the instructions in the wiki document with a minor change to a malformed ACI (but that shouldn't cause this problem): http://directory.fedora.redhat.com/wiki?title=Howto%3AChainOnUpdate&diff...
There was also a minor issue with a spurious warning being logged. It doesn't cause any harm, just an inconvenience: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176293
Danney, can you paste us these entries from your consumer's dse.ldif? dn: cn="{your replicated suffix}", cn=mapping tree, cn=config dn: cn=replica, cn="{your replicated suffix}", cn=mapping tree, cn=config dn: cn=config, cn=chaining database, cn=plugins, cn=config dn: cn={name of your chaining backend}, cn=chaining database, cn=plugins, cn=config
In the fourth one you can blank out the "nsmultiplexorcredentials" value before you send it.
In addition, there are no log entries on the master to indicate any activity back from the consumer to the master, i.e. a proxy login.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
Ulf Weltman wrote:
Richard Megginson wrote:
ILoveJython wrote:
I have read the document:
Howto:ChainOnUpdate - Fedora Directory Server http://directory.fedora.redhat.com/wiki/Howto:ChainOnUpdate
and have been unable to get it to work. When I attempt a write to the consumer it makes the change on the consumer and does not update the master.
This is bad. If the consumer is configured to be a read only consumer you should not be able to make a change on it. You should either get a referral returned from the consumer to the client program which the client program will follow to make the change on the master, or, if chain on update is working, you will see the operation on the consumer and the same corresponding operation sent to the master.
With the next change on the master of any kind, the mapping tree entry for this suffix changes from "nsslapd-state: backend" to "nsslapd-state: referral on update". Once this state changes, my client complains that it cannot update, since it cannot follow referrals.
Ulf, you've been able to get this running, right?
Yes, I was testing this a few weeks ago with the 7.1 release on HP-UX. It was configured with the instructions in the wiki document with a minor change to a malformed ACI (but that shouldn't cause this problem): http://directory.fedora.redhat.com/wiki?title=Howto%3AChainOnUpdate&diff...
There was also a minor issue with a spurious warning being logged. It doesn't cause any harm, just an inconvenience: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176293
Danney, can you paste us these entries from your consumer's dse.ldif? dn: cn="{your replicated suffix}", cn=mapping tree, cn=config dn: cn=replica, cn="{your replicated suffix}", cn=mapping tree, cn=config dn: cn=config, cn=chaining database, cn=plugins, cn=config dn: cn={name of your chaining backend}, cn=chaining database, cn=plugins, cn=config
In the fourth one you can blank out the "nsmultiplexorcredentials" value before you send it.
In addition, there are no log entries on the master to indicate any activity back from the consumer to the master, i.e. a proxy login.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
When I could not get it to work, I removed everything. I repeated the process with the values I used and they are below.
dn: cn="ou=CDE,o=FSL",cn=mapping tree, cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree nsslapd-state: backend cn: "ou=CDE,o=FSL" cn: ou=CDE,o=FSL nsslapd-parent-suffix: "o=FSL" nsslapd-backend: CDE creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20060104155644Z modifyTimestamp: 20060104164545Z nsslapd-distribution-plugin: /var/fedora/servers/lib/replication-plugin.so nsslapd-distribution-funct: repl_chain_on_update numSubordinates: 1 nsslapd-referral: ldap://vs31-tx32.am.freescale.net:389/ou%3DCDE%2Co%3DFSL
dn: cn="ou=CDE,o=FSL",cn=mapping tree, cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree nsslapd-state: backend cn: "ou=CDE,o=FSL" cn: ou=CDE,o=FSL nsslapd-parent-suffix: "o=FSL" nsslapd-backend: CDE creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20060104155644Z modifyTimestamp: 20060104164545Z nsslapd-distribution-plugin: /var/fedora/servers/lib/replication-plugin.so nsslapd-distribution-funct: repl_chain_on_update numSubordinates: 1 nsslapd-referral: ldap://vs31-tx32.am.freescale.net:389/ou%3DCDE%2Co%3DFSL
dn: cn=chaining database,cn=plugins,cn=config cn: chaining database nsslapd-pluginDescription: LDAP chaining backend database plugin nsslapd-pluginEnabled: on nsslapd-pluginId: chaining database nsslapd-pluginInitfunc: chaining_back_init nsslapd-pluginPath: /var/fedora/servers/lib/chainingdb-plugin.so nsslapd-pluginType: database nsslapd-pluginVendor: Fedora Project nsslapd-pluginVersion: 7.1 objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20051220230831Z modifyTimestamp: 20051220230831Z numSubordinates: 4
dn: cn=CDE,cn=chaining database,cn=plugins,cn=config nschecklocalaci: on nsslapd-suffix: ou=CDE,o=FSL objectClass: top objectClass: extensibleObject nsmultiplexorbinddn: cn=Replication Manager,cn=replication,cn=config nsfarmserverurl: ldap://vs31-tx32:389/ou=CDE,o=FSL cn: CDE nsmultiplexorcredentials: {DES}MY_VALUE_GOES_HERE creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20060104162022Z modifyTimestamp: 20060104162022Z
Hmm - there are two entries for
dn: cn="ou=CDE,o=FSL",cn=mapping tree, cn=config
That's bad. In addition, there is only 1 nsslapd-backend for that suffix - there should be two - one for the 'local' backend which is the replica of the master, and one for the chaining backend. e.g. nsslapd-backend: userRoot Only the chaining backend is there.
ILoveJython wrote:
Ulf Weltman wrote:
Richard Megginson wrote:
ILoveJython wrote:
I have read the document:
Howto:ChainOnUpdate - Fedora Directory Server http://directory.fedora.redhat.com/wiki/Howto:ChainOnUpdate
and have been unable to get it to work. When I attempt a write to the consumer it makes the change on the consumer and does not update the master.
This is bad. If the consumer is configured to be a read only consumer you should not be able to make a change on it. You should either get a referral returned from the consumer to the client program which the client program will follow to make the change on the master, or, if chain on update is working, you will see the operation on the consumer and the same corresponding operation sent to the master.
With the next change on the master of any kind, the mapping tree entry for this suffix changes from "nsslapd-state: backend" to "nsslapd-state: referral on update". Once this state changes, my client complains that it cannot update, since it cannot follow referrals.
Ulf, you've been able to get this running, right?
Yes, I was testing this a few weeks ago with the 7.1 release on HP-UX. It was configured with the instructions in the wiki document with a minor change to a malformed ACI (but that shouldn't cause this problem): http://directory.fedora.redhat.com/wiki?title=Howto%3AChainOnUpdate&diff...
There was also a minor issue with a spurious warning being logged. It doesn't cause any harm, just an inconvenience: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176293
Danney, can you paste us these entries from your consumer's dse.ldif? dn: cn="{your replicated suffix}", cn=mapping tree, cn=config dn: cn=replica, cn="{your replicated suffix}", cn=mapping tree, cn=config dn: cn=config, cn=chaining database, cn=plugins, cn=config dn: cn={name of your chaining backend}, cn=chaining database, cn=plugins, cn=config
In the fourth one you can blank out the "nsmultiplexorcredentials" value before you send it.
In addition, there are no log entries on the master to indicate any activity back from the consumer to the master, i.e. a proxy login.
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
When I could not get it to work, I removed everything. I repeated the process with the values I used and they are below.
dn: cn="ou=CDE,o=FSL",cn=mapping tree, cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree nsslapd-state: backend cn: "ou=CDE,o=FSL" cn: ou=CDE,o=FSL nsslapd-parent-suffix: "o=FSL" nsslapd-backend: CDE creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20060104155644Z modifyTimestamp: 20060104164545Z nsslapd-distribution-plugin: /var/fedora/servers/lib/replication-plugin.so nsslapd-distribution-funct: repl_chain_on_update numSubordinates: 1 nsslapd-referral: ldap://vs31-tx32.am.freescale.net:389/ou%3DCDE%2Co%3DFSL
dn: cn="ou=CDE,o=FSL",cn=mapping tree, cn=config objectClass: top objectClass: extensibleObject objectClass: nsMappingTree nsslapd-state: backend cn: "ou=CDE,o=FSL" cn: ou=CDE,o=FSL nsslapd-parent-suffix: "o=FSL" nsslapd-backend: CDE creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20060104155644Z modifyTimestamp: 20060104164545Z nsslapd-distribution-plugin: /var/fedora/servers/lib/replication-plugin.so nsslapd-distribution-funct: repl_chain_on_update numSubordinates: 1 nsslapd-referral: ldap://vs31-tx32.am.freescale.net:389/ou%3DCDE%2Co%3DFSL
dn: cn=chaining database,cn=plugins,cn=config cn: chaining database nsslapd-pluginDescription: LDAP chaining backend database plugin nsslapd-pluginEnabled: on nsslapd-pluginId: chaining database nsslapd-pluginInitfunc: chaining_back_init nsslapd-pluginPath: /var/fedora/servers/lib/chainingdb-plugin.so nsslapd-pluginType: database nsslapd-pluginVendor: Fedora Project nsslapd-pluginVersion: 7.1 objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20051220230831Z modifyTimestamp: 20051220230831Z numSubordinates: 4
dn: cn=CDE,cn=chaining database,cn=plugins,cn=config nschecklocalaci: on nsslapd-suffix: ou=CDE,o=FSL objectClass: top objectClass: extensibleObject nsmultiplexorbinddn: cn=Replication Manager,cn=replication,cn=config nsfarmserverurl: ldap://vs31-tx32:389/ou=CDE,o=FSL cn: CDE nsmultiplexorcredentials: {DES}MY_VALUE_GOES_HERE creatorsName: cn=directory manager modifiersName: cn=directory manager createTimestamp: 20060104162022Z modifyTimestamp: 20060104162022Z
-- Fedora-directory-users mailing list Fedora-directory-users@redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users
389-users@lists.fedoraproject.org
-
ILoveJython -
Kieran Murphy -
Michael Montgomery -
Noriko Hosoi -
Rich Megginson -
Ulf Weltman