April 2022 - 389-users - Fedora Mailing-Lists

ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0

by Graham Leggett

Hi all, We have a long standing 389ds master LDAP server that was found to be unable to contact it’s slaves. Most specifically, the slaves show nothing in their logs about any kind of connection, while the master is logging this: [12/Nov/2019:21:39:47.212715697 +0000] - ERR - slapi_ldap_bind - Could not send bind request for id [(anon)] authentication mechanism [EXTERNAL]: error -1 (Can't contact LDAP server), system error 0 (no error), network error 0 (Unknown error, host “ldap01:636”) Key is "system error 0 (no error)”, which leaves us stumped. The error is obviously “success”. Has anyone seen this kind of thing before? This is 389ds running on CentOS7 as follows: 389-ds-base-1.3.9.1-10.el7.x86_64 Regards, Graham —

5 months

3
9
0 / 0

Plugin development licensing

by DUVERT Vincent

Hello, I have a question regarding the licensing of developed 389-ds plugins. The FAQ (https://directory.fedoraproject.org/docs/389ds/FAQ/licensing.html#directo...) indicates that the Directory Server core code is licensed under a GPL + Exception license that allows non-GPL 389-ds plugins to link to 389-ds and to use specific header files. However, the LICENSE file in the current 389-ds-base source does not contain this exception. It was apparently removed by the following commit, when the license was changed to GPLv3+: https://pagure.io/389-ds-base/c/88cae401aee39a19ac6b07c3c36ee8daa07192e7 Does that means that the license exception does not apply to the current version of 389-ds? Regards, Vincent Duvert

1 year

2
2
0 / 0

Meta directory plugin in 389ds?

by Alex

Dear List-Members. Please can you help me to find the right plugin, if there is any, in 386ds which can be used similar to the slapd-meta and slapo-rwm? https://www.openldap.org/software/man.cgi?query=slapd-meta&sektion=5&manp... https://www.openldap.org/software/man.cgi?query=slapo-rwm&sektion=5&aprop... What I try to achieve is to create a meta directory in front on MS Active Directory for different AD Groups and propagate this group via 386ds. I have seen this plugins but I don't know the wording in 386ds therefore I hope anybody can help me to find the right wording and plugins in 386ds if this is possible. https://access.redhat.com/documentation/en-us/red_hat_directory_server/11... Thank you for any help. Regards Alex

2 years

2
5
0 / 0

AD to 389ds sync problem

by Tornóci László

Hello, we have tried to set up a synchronization from AD to our directory server, but we have a problem. We have RHEL 8.5, 389-ds-base-1.4.3.23-14 We have followed the docs here: https://access.redhat.com/documentation/en-us/red_hat_directory_server/11... We have created this agreement: dsconf dirsrv_inst repl-winsync-agmt create --suffix="dc=example,dc=hu" --host="our.ad.server.hu" --port=636 --conn-protocol="LDAPS" --bind-dn="CN=_sync_user,DC=exmaple,DC=local" --bind-passwd="passwd" --win-subtree="OU=Felhasználók,DC=example,DC=local" --ds-subtree="ou=People1,dc=example,dc=hu" --win-domain=example --one-way-sync=fromWindows --init users-sync (some data have been masked). The agreement gets accepted, init status is okay. However, no users get created on the directory server, even after setting the --sync-users option to "on" in the replication agreement as suggested by the docs. In AD, there are test users, for example this: dn:: Q049VGVzenQgVXNlciAxLE9VPUZlbGhhc3puw6Fsw7NrLERDPWV4YW1wbGUsREM9bG9jYWw= objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn:: VGVzenQgVXNlciAx sn:: UG9ydMOhbA== title:: VGVzenRlbMWR telephoneNumber: +3612345679 givenName: User distinguishedName:: Q049VGVzenQgVXNlciAxLE9VPUZlbGhhc3puw6Fsw7NrLERDPWV4YW1wbGUsREM9bG9jYWw= instanceType: 4 whenCreated: 20220324073810.0Z whenChanged: 20220405072514.0Z displayName:: VGVzenQgVXNlciAx uSNCreated: 654581 uSNChanged: 731702 department: Development name:: VGVzenQgVXNlciAx objectGUID:: ZYcqiTPzVkCifL7rP8qGlg== userAccountControl: 512 codePage: 0 countryCode: 0 pwdLastSet: 132935477968356837 primaryGroupID: 513 objectSid:: AQUAAAAAAAUVAAAAGOXkLRHqLIUsJtYXDBAAAA== accountExpires: 9223372036854775807 sAMAccountName: portal.user2 sAMAccountType: 805306368 userPrincipalName: portal.user2(a)example.local objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=example,DC=local dSCorePropagationData: 20220405072514.0Z dSCorePropagationData: 20220401092451.0Z dSCorePropagationData: 20220401092431.0Z dSCorePropagationData: 20220401092408.0Z dSCorePropagationData: 16010101000417.0Z lastLogonTimestamp: 132925820675992048 mail: portaluser2(a)example.hu homePhone: +3687654321 In the error log we get these lines about the replication of this particular test user: Received entry from dirsync: CN=Teszt User 1,OU=Felhaszn<C3><A1>l<C3><B3>k,OU=Example> (test2:637) - Looking for local entry matching AD entry [CN=Teszt User> (test2:637) - Looking for local entry by guid [65872a8933f35640a27cbeeb3fca8696] (test2:637) - Problem looking for guid: -1 (test2:637) - Looking for local entry by uid [portal.user2] (test2:637) - problem looking for username: -1 What could be the problem? Yours: Laszlo

2 years, 1 month

2
5
0 / 0

Posible bug in Schema Reload plug-in validator?

by Jan Tomasek

Hello, I'm running 389DS version 1.4.4.11-2 on Debian Bullseye and when I try dynamic schema reload I get this error: > [08/Apr/2022:09:50:38.481339672 +0200] - INFO - schemareload - schemareload_thread - Schema reload task starts (schema dir: default) ... > [08/Apr/2022:09:50:38.528960187 +0200] - ERR - parse_attr_str - Cannot find parent attribute type "certSubjectDN" > [08/Apr/2022:09:50:38.534608629 +0200] - ERR - dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-ldap33/schema/96radoc.ldif (lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type raOfficerSubjectDN: Missing parent attribute syntax OID > [08/Apr/2022:09:50:38.539912128 +0200] - ERR - schema_reload - slapi_validate_schema_files failed > [08/Apr/2022:09:50:38.544588257 +0200] - ERR - schemareload - schemareload_thread - Schema validation failed. raOfficerSubjectDN is defined this way: attributeTypes: ( raOfficerSubjectDN-oid NAME 'raOfficerSubjectDN' DESC 'RA office subject DN; KDO' SUP certSubjectDN SINGLE-VALUE X-ORIGIN 'CESNET RA DOC' ) and certSubjectDN is defined: attributeTypes: ( certSubjectDN-oid NAME 'certsubjectdn' DESC 'CESNET Attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 X-ORIGIN 'CESNET' ) It is interesting that when I restart whole server it starts correctly and in schema is attribute present: ldapsearch -H ldaps://ldap33 -x -b 'cn=schema' -o ldif-wrap=no + ... attributeTypes: ( raOfficerSubjectDN-oid NAME 'raOfficerSubjectDN' DESC 'RA office subject DN; KDO' SUP certSubjectDN SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE X-ORIGIN 'CESNET RA DOC' ) I was looking for attributeType syntax and in RFC 2252 is written: > ... Servers SHOULD provide at least one of the "SUP" and "SYNTAX" > fields for each AttributeTypeDescription. Isn't there a bug in validator which is used by Schema Reload plug-in? Best regards -- ----------------------- Jan Tomasek aka Semik http://www.tomasek.cz/

2 years, 1 month

2
1
0 / 0

multimaster replcation port used

by Ghiurea, Isabella

Hi Please I need to know to know if we can block port 389 presently used for replication multimaster replication and replaced with port 636 will this work ?

2 years, 1 month

3
2
0 / 0

passwordExpirationTime vs password admin

by Mike Wohlgemuth

Hi! We are running Red Hat Enterprise Linux release 8.3 with 389-ds-base-1.4.3.16-19.module+el8.4.0+11894+f5bb5c43.x86_64 installed. We have configured password expiration, and passwordExpirationTime is getting updated properly when the end user binds and changes the password, or when cn=directory manager changes the password. We have an API that is invoked to allow the users to change their password when they have forgotten it, so it cannot bind as the end user, but we also do not want it to have to bind as cn=directory manager. However, we haven't had any luck getting any other user to update passwordExpirationTime when updating the password. Looking at the code, it looks like password admins should be allowed to update passwordExpirationTime, but we have those configured and it's not working. Is there something we are missing? Thanks!

2 years, 1 month

3
7
0 / 0

389DS + Ubuntu

by iyagomailru Alexander Yakovlev

Good afternoon. I installed 389-ds on Ubuntu. I need to use mdb instead of bdb. But the installed dconf utility does not contain the 'config' option: # dsconf usage: dsconf [-h] [-v] [-D BINDDN] [-b BASEDN] [-Z] instance {{backend,schema,healthcheck,plugin,memberof,usn,rootdn,whoami,referint} ... dsconf: error: the following arguments are required: instance Tell me what are the possible solutions, please.

2 years, 1 month

6
10
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

389-users April 2022