El 21/05/18 a las 11:20, Mark Reynolds escribió:
>
> On 05/21/2018 10:16 AM, ipa(a)tecnoaccion.com.ar wrote:
>> El 18/05/18 a las 20:02, Mark Reynolds escribió:
>>> On 05/18/2018 04:07 PM, None via FreeIPA-users wrote:
>>>> El 18/05/18 a las 16:52, Mark Reynolds escribió:
>>>>> On 05/18/2018 03:13 PM, ipa(a)tecnoaccion.com.ar wrote:
>>>>>> El 18/05/18 a las 16:09, Mark Reynolds escribió:
>>>>>>> On 05/18/2018 03:01 PM, None via FreeIPA-users wrote:
>>>>>>>> hi!
>>>>>>>>
>>>>>>>> I'm new to FreeIPA, I inherited a FreeIPA
infrastructure, and I'm
>>>>>>>> trying to have a Nagios check for the replication status
(without
>>>>>>>> indicating a password). I found this article:
>>>>>>>>
<
https://danieljamesscott.org/11-articles/application-guides/26-freeipa-re...;.
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>>
>>>>>>>> It's exactly what I want to do
>>>>>>>>
>>>>>>>> but, when I try to do the ldapmodify thing with
>>>>>>>> grant_anonymous_replication_view.ldif (only changing
>>>>>>>> cn="dc=example,dc=com" according to my
installation), I get:
>>>>>>>>
>>>>>>>> $ ldapmodify -x -D "cn=directory manager" -W
-f
>>>>>>>> grant_anonymous_replication_view.ldif -h
ipa.mydomain.com.ar
>>>>>>>> Enter LDAP Password:
>>>>>>>>
>>>>>>>>
>>>>>>>> and it doesn't accept admin or directory manager
password (?)
>>>>>>> Do you get an invalid credentials error (49), or?
>>>>>> that's right, I get:
>>>>>> ldap_bind: Invalid credentials (49)
>>>>>>
>>>>>>
>>>>>>
>>>>>>>> do I have to make other changes to the ldif?
>>>>>>> No
>>>>>>>> or, what is the password I need?
>>>>>>> Only you would know, if you don't know it then you can
always
>>>>>>> reset
>>>>>>> the
>>>>>>> directory manager password:
>>>>>>>
>>>>>>>
http://www.port389.org/docs/389ds/howto/howto-resetdirmgrpassword.html
>>>>>>>
>>>>>>>
>>>>>> I do have admin and directory manager password, I tried with
both,
>>>>>> and
>>>>>> I got the same result (?)
>>>>> Sounds like you don't have the correct password if you are
getting
>>>>> error
>>>>> 49. The only other thing it could be is that the "cn=directory
>>>>> manager"
>>>>> account is not setup as "cn=directory manager" in your
setup.
>>>>> You can
>>>>> confirm by grepping for "nsslapd-rootdn" from
>>>>> /etc/dirsrv/slapd-YOUR_INSTANCE/dse.ldif. If it is set to
>>>>> "cn=directory
>>>>> manager', then you have the wrong password and you should reset
it.
>>>>> Otherwise you have the wrong DN. It's one or the other.
>>>> great!
>>>>
>>>> it was the wrong password... Now I get this:
>>>>
>>>> ldapmodify: wrong attributeType at line 5, entry
>>>> "cn="dc=example,dc=com",cn=mapping tree,cn=config"
>>>>
>>>>
>>>> the full ldif is:
>>>>
>>>> dn: cn="dc=example,dc=com",cn=mapping tree,cn=config
>>>> changetype: modify
>>>> add: aci
>>>> aci:
>>>>
(targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)(objectclass=nsDSWindowsReplicationAgreement))")(version
>>>>
>>>>
>>>> 3.0; aci "permission:Read Replication Agreements"; allow
(read,
>>>> search, compare) groupdn = "ldap:///anyone";)
>>> I think the problem is the aci value. Its multiple lines, maybe its
>>> wrapped weird. There s a few ways to fix it. In LDAP you would
>>> precede
>>> a line break with a space. So something like this:
>>>
>>> dn: cn="dc=example,dc=com",cn=mapping tree,cn=config
>>> changetype: modify
>>> add: aci
>>> aci:
>>> (targetattr=*)(targetfilter="(|(objectclass=nsds5replicationagreement)
>>> (objectclass=nsDSWindowsReplicationAgreement))")(version
>>> 3.0; aci "permission:Read Replication Agreements"; allow
>>> (read, search, compare) groupdn = "ldap:///anyone";)
>>>
>>> Or, it has to be one long line. I am attaching a ldif with two
>>> examples
>>> you can pick from.
>>
>> hi!
>>
>> I tried both ldifs, they report the same:
>>
>> # ldapmodify -x -D "cn=Directory Manager" -W -f 1.ldif -h
>> ipa.example.com.ar
>> Enter LDAP Password:
>> modifying entry "cn="dc=example,dc=com",cn=mapping
tree,cn=config"
>> ldap_modify: No such object (32)
>>
>> # ldapmodify -x -D "cn=Directory Manager" -W -f 2.ldif -h
>> example.tecnoaccion.com.ar
>> Enter LDAP Password:
>> modifying entry "cn="dc=example,dc=com",cn=mapping
tree,cn=config"
>> ldap_modify: No such object (32)
> Its probably the quotes around dc=example,dc=com
>
> Try replacing it with;
>
> cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config
So the problem is that you
really don't have a backend suffix
"dc=example,dc=com"
Try this:
ldapsearch -xLLL -D "cn=Directory Manager" -W -b cn=config nsslapd-backend=*
This will dump your backends, find DN from the entry for your database
and put that in the LDIF file
Mark
hi Mark!
thank you very much for your help
the result in both ldifs continues to be:
ldap_modify: No such object (32)
I'm attaching the sanitized ldifs just in case
best regards,
René