Re: AD proxy in OpenLDAP

2012-04-03 Thread masarati
> Hi guys, Despite the manuals reading you claim, I see many unrelated errors in your configuration/operations. > Posted a while back but didn't get far, just trying again to see if I can > get this working. We have AD on our DC server, working fine, and a list of > external clients in OpenLDAP,

Replication stops working due to objectClass=glue

2012-04-03 Thread frank . offermanns
Hi, I have a synrepl-master and one slave. I delete both databases and do a slapadd on the master. After doing so I start the slave. Our system has a few dozen processes changing values every minute, so they also do it when the inital replication is running. >From time to time replication stop

Re: modifyTimeStamp not modified on replica

2012-04-03 Thread jehan procaccia
You are right I modified my syncrepl config to attrs="*,+", then operational attributes are now correctly replicated , thanks ! I also tried to removed attrs directive completly, then the mail attribute wasn't replicated anymore :-( ... so I prefer to let it explicit to attrs="*,+" My other

Re: Active Directory connected to OpenLDAP (master)

2012-04-03 Thread Sylvain
Le 2 avril 2012 23:12, Nick Milas a écrit : > Note however the following (copying from: http://pgina.org/faq.html): > > "Do shared services and devices authenticate users via pGina? - No. pGina > is intended as a replacement for the *interactive* login process. Access to > network shared items li

Re: Ubuntu can't connect to SambaPDC

2012-04-03 Thread Jonathan Clarke
Hi, On 02/04/12 14:52, Imre Bertalan wrote: > Hi guys. > > This is not really an OpenLDAP question, but it seems we have some fine > qualified users here, so I'll ask this question here. :) > > I have a nice working Zentyal 2.2 server with DNS and SambaPDC. Windows > client's can join the domain

Convert *.schema to *.ldif

2012-04-03 Thread Francis Swasey
I don't see any description in the admin guide about how to convert a *.schema file into a *.ldif file. Google tells me that most people are using slaptest with the -F and -f parameters with a specially crafted slapd.conf file. As the person who is responsible for a *.schema file and develops i

Re: Convert *.schema to *.ldif

2012-04-03 Thread Mauricio Tavares
On Tue, Apr 3, 2012 at 9:28 AM, Francis Swasey wrote: > I don't see any description in the admin guide about how to convert a > *.schema file into a > *.ldif file.  Google tells me that most people are using slaptest with the -F > and -f parameters > with a specially crafted slapd.conf file. > >

Re: Convert *.schema to *.ldif

2012-04-03 Thread Francis Swasey
On 4/3/12 9:48 AM, Mauricio Tavares wrote: As the person who is responsible for a *.schema file and develops it not on a machine that has > the openldap server software installed, that process is not anything I'm interested in.  Looks > like it should be a f

openldap proxy to AD

2012-04-03 Thread Induni, Marco
Hi all, I'm building an openldap proxy to an AD server and adding a little of "intelligence" based on the client request. Unfortunately the client/program asking information about an account, need to be setup with user and password. There is a way to let the proxy "ignore" this user and password a

centralized sudo policies : ACL issue

2012-04-03 Thread Olivier
A quite trivial issue I have : I have installed centralized policy sudo rules in ldap server (I use "schema.OpenLDAP" from "http://www.sudo.ws"; ). I also have configured linux clients to check ldap rules to grant sudo access to certain ressources ( I declared "sudoers_base" in nslcd.conf and "su

Re: Convert *.schema to *.ldif

2012-04-03 Thread Howard Chu
Francis Swasey wrote: I don't see any description in the admin guide about how to convert a *.schema file into a *.ldif file. Google tells me that most people are using slaptest with the -F and -f parameters with a specially crafted slapd.conf file. As the person who is responsible for a *.sc

Re: openldap proxy to AD

2012-04-03 Thread Jonathan Clarke
On 03/04/12 16:47, Induni, Marco wrote: > Hi all, > I'm building an openldap proxy to an AD server and adding a little of > "intelligence" based on the client request. > > Unfortunately the client/program asking information about an account, > need to be setup with user and password. > There is a

Re: Password expiration

2012-04-03 Thread Jonathan Clarke
Hi Cris, On 27/03/12 00:46, Collins, Cris L. wrote: > I am running OpenLDAP as packaged for CentOS 5 and having problems with > password expiration. > Users are being told every time they login that their password has expired > and to change their password. When ShadowMax is changed to 9 their

Re: Convert *.schema to *.ldif

2012-04-03 Thread Francis Swasey
On 4/3/12 11:50 AM, Howard Chu wrote: >> I don't see any description in the admin guide about how to convert a >> *.schema file into a >> *.ldif file. Google tells me that most people are using slaptest with the >> -F and -f parameters >> with a specially crafted slapd.conf file. >> >> I would

Re: modifyTimeStamp not modified on replica

2012-04-03 Thread Quanah Gibson-Mount
--On Tuesday, April 03, 2012 11:00 AM +0200 jehan procaccia wrote: You are right I modified my syncrepl config to attrs="*,+", then operational attributes are now correctly replicated , thanks ! I also tried to removed attrs directive completly, then the mail attribute wasn't replicated anymo

Re: Password expiration

2012-04-03 Thread Collins, Cris
The problem was resolved by adding the following per the nis schema. My statement below was incorrect. shadowLastChange was not updating, as "getent shadow username" showed me. access to attrs=shadowLastChange,shadowMax by dn="cn=Manager,dc=domain,dc=com" write by self write

Hashing the userPassword

2012-04-03 Thread Suneet Shah
Hello, I am creating a user in OpenLDAP using Java. The user is being successfully created, but the passwords are being stored in clear text. Is there something that I need to change in the OpenLDAP configuration to enable storing the password securely using ssha? thank you for your help suneet