[389-users] using PWM with 389 DS

I was wondering if anyone here has integrated PWM into your 389 DS and might be able to help me out. We want to use PWM just for allowing users to change their passwords. I followed the documentation that is here https://docs.google.com/document/d/1I9u1xaVrIOTFj8Le7uzCM5zGqrODCi9Udo2gGZyAapc/edit

Re: [389-users] using PWM with 389 DS

rator > Primatics Financial > > > > -----Original Message- > From: 389-users-boun...@lists.fedoraproject.org > [mailto:389-users-boun...@lists.fedoraproject.org] On Behalf Of Elizabeth > Jones > Sent: Tuesday, March 05, 2013 12:12 PM > To: 389-users@lists.fedoraproject.

[389-users] problem connecting with old solaris servers

We are trying to move our servers off a very old version of iplanet (circa 2002) to 389 DS. The data in both ldaps is almost identical, except that there was some stuff in the iplanet that couldn't convert over to 389. I'm not sure exactly what wouldn't convert, except that I couldn't do an export

[389-users] svn authentication

Have any of you run into problems using 389 DS for svn ldap authentication? I just discovered that our svn instance is not authenticating successfully with our 389 DS, although I can see from tcpdumps that it is successfully pulling the password back. I'm wondering if there is something in the 389

Re: [389-users] svn authentication

> On 12/06/2013 12:35 AM, Elizabeth Jones wrote: > > > Hello, > > what do you mean by "not authenticating successfully"? Anything in > apache logs? The logs show this -- [Tue Jun 11 17:02:08 2013] [warn] [client a.b.c.d] [23830] auth_ldap authenticate: user myus

[389-users] default password parameters

We recently discovered that some of our users can pad their login passwords with additional characters and still get authenticated by our 389DS. Our server was migrated from another server and we didn't set anything as far as password requirements in the 389DS because we didn't want to end up locki

[389-users] directory manager password changed

my cn=directory manager password has somehow gotten changed or corrupted. I have a 389-console session open that I'm hoping I can use to reset directory manager back to where its supposed to be, but I don't know where in 389-console I would do this. Can anyone point me in the right direction? than

[389-users] find the password encryption hash from the command line?

Is there an ldap command that I can use to determine what encryption is being used for the passwords in my 389 DS? Elizabeth J -- 389 users mailing list 389-users@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

[389-users] non-unique UID

I'm trying to scrub our LDAP data - we imported existing data from an old sun LDAP to our current 389 DS. I just noticed that there are 5 accounts in our LDAP that all have the same UID - I didn't think that was possible? Elizabeth J -- 389 users mailing list 389-users@lists.fedoraproject.org htt

[389-users] replication error

Hi - I have just encountered a replication error on our 389DS. We are running Version 1.2.10.12 Build number 2012.180.1623. We had the following error earlier today from our ldap1 server (running multimaster) - 07/Feb/2014:13:06:52 -0600] NSMMReplicationPlugin - changelog program - agmt="cn=ldap

Re: [389-users] replication error

> On 02/07/2014 10:16 PM, Elizabeth Jones wrote: >> Hi - I have just encountered a replication error on our 389DS. We are >> running Version 1.2.10.12 Build number 2012.180.1623. We had the >> following error earlier today from our ldap1 server (running >> multima

Re: [389-users] replication error

>> >> It's going to be practically impossible to support 1.2.10. Can you >> upgrade to 1.2.11? >> > > I'm heading that way right now. I found a bug on redhat that looks like > it is exactly what I'm running into -- > > https://bugzilla.redhat.com/show_bug.cgi?id=947583 Can I have different vers

Re: [389-users] replication error

> On 02/10/2014 02:40 PM, Elizabeth Jones wrote: >> Can I have different versions of 389DS running together? I have >> upgraded >> the server that I think is my problem and I want to try to initialize it >> from one of my other servers, but it just occurred to me that

[389-users] Importing database to new server

I'm having some problems trying to import an existing database into a new server. I know I was able to do this in the past, but since I'm an idiot I did not take notes on what I did and now I can't seem to recreate it. The new server was built from scratch and I configured a vanilla 389DS on it.

Re: [389-users] Importing database to new server

> How are you taking a backup, and how are you doing the import? What > backend/database are you trying to restore? What do you mean it turns > into ldap2? What is the exact problem as it sounds like the import is > working? I'm taking the backup off my production server with db2bak.pl script

[389-users] 389 training?

Does anyone know of any 389 training that they could recommend? My manager has decided that he wants me to have "ldap training", but I am not aware of anything for 389 DS other than all the online documentation. thanks - EJ -- 389 users mailing list 389-users@lists.fedoraproject.org https://admi

[389-users] Long distance replication

Have any of you encountered issues with replication over long distances, such as between data centers? We have a master in each of our data centers and a consumer at each data center, but all changes are pretty much made at data center A and then replicated to its local consumer, then across our m

[389-users] initialization issue

We upgraded our servers to 389-ds-base-1.2.11.25-1.el6.x86_64 a couple of months ago, and earlier this evening I tried to initialize a corrupted replica but it did not initialize successfully. I was using the 389-console gui, not sure if that makes any difference. My logs showed that the initiali

Re: [389-users] initialization issue

the size in the consumers' > config file. > > Thanks, > --noriko > > Elizabeth Jones wrote: >> We upgraded our servers to 389-ds-base-1.2.11.25-1.el6.x86_64 a couple >> of >> months ago, and earlier this evening I tried to initialize a corrupted >> replica but it

[389-users] glue entry problem

I have all kinds of borkage in my ldap today. I created a new ou in one of my data centers, ou=cdc,ou=service accts,ou=staff,ou=people,dc=mycompany,dc=com under this I added 2 users. About 5 minutes later I got an alarm from my monitoring system saying that replication had failed, and I discover

Re: [389-users] glue entry problem

> rpm -q 389-ds-base 389-ds-base-1.2.11.25-1.el6.x86_64 -- 389 users mailing list 389-users@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/389-users

Re: [389-users] glue entry problem

As an added bonus, I now see this when I try to ldapsearch for this ou in my first ldap and in its local consumer -- ldap1: dn: nsuniqueid=dde5bb01-ca5811e3-af3cad6b-9c050417,ou=CDC,ou=Service Accts,ou=People,dc=mycompany,dc=com ldap2 (local consumer): dn: ou=CDC,ou=Service Accts,ou=People,dc=myc

Re: [389-users] glue entry problem

> > You mentioned 2 servers ldap1 and ldap2. Are they both masters? You put > "local consumer" to ldap2. Does that mean ldap2 is a read only replica? We have two data centers and each data center has an ldap1 and ldap2. All 4 are masters, but we only ever send updates to DCA-ldap1. That then

[389-users] enforcing password policy

I finally have permission to configure password policy in our ldap servers, but have a question about how it is enforced. Our service desk is able to access our LDAPs using LDAP Account Manager (LAM) and other admins can use LAM or tools like jexplorer. Once I have password policy in place, does a

[389-users] encryption and load balancing

I'm kind of confused about how to handle encryption certificates with a load balancer in place. I'm using the setupssl.sh script to create our certs and insert them into the LDAP instances - and this uses each LDAP servers hostname. Our current configuration is that ldap requests go to a GTM, whi

Re: [389-users] encryption and load balancing

> no need for wildcard certs… use the Subject Alt Name. Works fine. Been > doing it for years. certutil supports it as well. > > /mrg Thanks, this looks like it is what I need. I do have a question about this though - we have a single url that we use that is on our GTM - the GTM routes the re

[389-users] change internal token password

I'm finally ready to configure encryption on our LDAP servers, but I just discovered the previous admin had already set the password - to something I don't know. The previous admin was summarily dismissed one morning and would not be the type of guy who I could call and say by the way what was the

Re: [389-users] change internal token password

> I'm finally ready to configure encryption on our LDAP servers, but I just > discovered the previous admin had already set the password - to something > I don't know. The previous admin was summarily dismissed one morning and > would not be the type of guy who I could call and say by the way what

[389-users] last login

I'm trying to figure out if 389 supports a way to track users last login. I found this page http://directory.fedoraproject.org/wiki/Account_Policy_Design#Logging Does anyone know of any other documentation on implementing this? thanks - EJ -- 389 users mailing list 389-users@lists.fedoraproject

[389-users] password policy - user vs subtree

I need some help understanding the difference between password policy for user versus subtree and where it needs to be set. Using the 389 console gui, I see that I can set the password policy under the configuration tab in the data section. I am thinking this creates a global policy? - but this d

[389-users] password policy settings

The password policy settings that I have configured in my ldap don't seem to be taking effect. For instance - I just set the policy on a user account so that the password has to contain 8 characters, alpha, numeral, uppercase and lowercase and special character. Then I changed and saved the passw

[389-users] changing replication to use ssl

We currently have 4 way multi-master replication running over port 389 but I need to secure it. In looking at what we have now, it looks to me like I can't edit the existing replication agreements but will have to make all new replication agreements - is this correct? I was looking at this doc ht

Re: [389-users] changing replication to use ssl

> We currently have 4 way multi-master replication running over port 389 but > I need to secure it. In looking at what we have now, it looks to me like > I can't edit the existing replication agreements but will have to make all > new replication agreements - is this correct? > > I was looking at

[389-users] encryption and self signed certs

I'm suddenly stumped by self-signed certs. I used the setupssl2.sh script to generate my certs and install them into my ldap. I end up with this -- # certutil -L -d . Certificate Nickname Trust Attributes

[389-users] TLS replication

Have a question on TLS replication with 4 LDAP servers. Each of the 4 LDAP servers has its own CA cert (each with a unique nickname and serial number). If I install just one of the CA certs onto the master and then initialize one of its consumers, its fine. But if I install a second CA cert on t

Re: [389-users] TLS replication

User error, as usual. My certs had ^M at the end of the lines. Once I found and deleted those all the certs worked. > Have a question on TLS replication with 4 LDAP servers. > > Each of the 4 LDAP servers has its own CA cert (each with a unique > nickname and serial number). > > If I install ju

[389-users] password policy

We seem to have something odd going on with our password policy. I configured global password policy on our LDAPs so that all accounts under our userRoot subtree expire, then under the subtrees that contain our service accounts I configured to never expire. But I just noticed that the accounts un

[389-users] service desk account can no longer modify passwords

We have a service desk account that I created in our LDAP that has the ability to add/delete/modify all our user accounts. Except that now that we have password policy in place, it can no longer modify our user account passwords. I have confirmed that the password changes that it is doing conform

[389-users] password policy not deleted when user deleted

Doing some experimenting with user password policies. I created an account and then applied a user level fine grained password policy on that account. Then I deleted the account. Then I recreated the account, and the fine grained password policy still exists/is associated with this account. Why

[389-users] ns-inactivate.pl

I'm trying to use ns-inactivate.pl to deactivate user accounts, but I don't know how to get it to use port 636. It works fine on 389 but if I use -p 636 no dice. I dont see that there is a flag to tell it where to find the cert that it needs to make the connection. Elizabeth J -- 389 users mai

[389-users] secure replication failing

I have multimaster replication set up on 4 LDAP servers but can't get secure replication working on one of the servers. The setup is like this -- data center 1data center 2 ldap1 <---> ldap1 ^ | ^ |

Re: [389-users] secure replication failing

additional info - I increased logging on my supplier and see this error now - TLS: hostname does not match CN in peer certificate When I created the replication agreement, it is giving me a default consumer, I don't know why. The default is ldap1.mycompany.com:389. The certificate from ldap1 has

Re: [389-users] secure replication failing

> > On 08/20/2014 03:58 PM, Elizabeth Jones wrote: >> additional info - >> I increased logging on my supplier and see this error now - >> >> TLS: hostname does not match CN in peer certificate >> >> When I created the replication agreement, it is giving

Re: [389-users] secure replication failing

> > On 08/22/2014 10:34 AM, Elizabeth Jones wrote: >>> On 08/20/2014 03:58 PM, Elizabeth Jones wrote: >>>> additional info - >>>> I increased logging on my supplier and see this error now - >>>> >>>> TLS: hostname does not match

Re: [389-users] secure replication failing

I don't know if this is relevant to my on-going replication woes... On my consumer, I have the following certs - Server-Cert u,u,u CA certificate CTu,u,u CAcertva2

Re: [389-users] secure replication failing

none of them returned the fully qualified name for the certs, but only one had a problem with it. I changed it from hostname to the fully qualified name in the script. Elizabeth > > On 08/25/2014 10:21 AM, Elizabeth Jones wrote: >>> On 08/22/2014 10:34 AM, Elizabeth Jones wrote:

[389-users] slapd crashing and changing permissions on log files

We have a 389DS instance that has started having a strange problem when it runs its backups - [04/Sep/2014:01:05:01 -0500] - Backup finished. [04/Sep/2014:05:55:01 -0500] - chown_dir_files: file (/var/log/dirsrv/slapd-vadc-ldap2-prod/errors) chown failed (13) Permission denied. [04/Sep/2014:05:55:

Re: [389-users] slapd crashing and changing permissions on log files

Actually, it seems to be happening every time the instance is restarted. Just had it happen again: --. 1 nobody nobody 2960 Sep 5 09:19 errors > We have a 389DS instance that has started having a strange problem when it > runs its backups - > > [04/Sep/2014:01:05:01 -0500] - Back