Questions[389-ds](server)

I am attempting to integrate FreeIPA with Active Directory to provide single-sign-on for Windows and Linux users by following this guide.

I have successfully created the 'winsync' agreement and loaded the AD data into FreeIPA but I am struggling to setup the Windows Password Synchronization from this part of the guide.

When a user changes their password, I see the following in the 389 PassSync plugin log on the Domain Controller:

06/17/16 08:47:32: Backoff time expired.  Attempting sync
06/17/16 08:47:32: Password list has 1 entries
06/17/16 08:47:32: Attempting to sync password for some.user
06/17/16 08:47:32: Searching for (ntuserdomainid=some.user)
06/17/16 08:47:32: Ldap error in QueryUsername
34: Invalid DN syntax
06/17/16 08:47:32: Deferring password change for some.user
06/17/16 08:47:32: Backing off for 1024000ms

When I run the query from the CLI, using the same user and password used by the PassSync plugin, it is successful:

$ ldapsearch -x -h ldaps://localhost -p 636 -D 'uid=passsync,cn=sysaccounts,cn=etc,dc=dc,my=domain,dc=com' -w 'password'  -b 'cn=users,cn=accounts,dc=my,dc=domain,dc=com' '(ntuserdomainid=some.user)'

Can anyone point out what I doing wrong?

I'm looking to deploy 389 Directory in my environment to replace an existing iPlanet installation. I would be using it primarily to store user account data for authentication purposes. I have two physically separate data centers that I would like to share the same directory tree. My initial thinking is to setup 389 DS as follows:

• A Master/Consumer in DataCenter A
• A Master/Consumer in DataCenter B
• Replication agreement between both masters, to mirror the directory tree in both environments.

Does this sound like a reasonable approach? Is there a better way to do it? (ie: four masters?) Is there documentation for best practices when setting up 389 DS in situations such as this?

I've got 389 Directory Server running on RHEL 5 with groups, users, posix etc. RHEL clients are authenticating users with LDAP - no problems, everything works perfect, but passwords are sent in plaintext and are visible with network sniffer. So, decided to run with SSL:

1. Created CA - got both private and public CA certificates
2. Using CA certs: generated both of private and public certificates and combined (1st file) for 389DS according to 389DS certificate request, imported with CA public cert to 389DS from graphical console (2nd file).
3. Enabled SSL in 389DS
4. On the client, using authconfig-gtk enabled SSL for LDAP, specified only CA public certificate

Doesn't work.

Howto? What is the best way to integrate safely?

I have setup Graphite Web 0.9.9 on CentOS 6.2 x86_64 at EC2 and I'm trying to get LDAP authentication to work against 389 Directory Server. I have configured local_settings.py with:

• USE_LDAP_AUTH
• LDAP_URI
• LDAP_SEARCH_BASE
• LDAP_BASE_USER
• LDAP_BASE_PASS
• LDAP_USER_QUERY

But I still get "Authentication attempt failed" every time I try to log in. Looking at the logs on the LDAP server, it doesn't look like graphite-web is connecting to the LDAP server at all. Unfortunately, I don't see anything useful in the logs on the graphite server - I only see "access.log" and "info.log". "error.log" and "exception.log" are empty.

Any bright ideas on what can I do to further troubleshoot this?

I am trying to use 389 ds with large amounts of data as children of entries. I have tried doing a search on these entries using ldapsearch but I keep getting the following error:

result: 11 Administrative limit exceeded

When I went to browse these entries using the server console application it said to create a "Browsing Index". I did this, and I can now view these entries inside the Server Console application however I still can not execute the ldapsearch.

I tried to delete the parent entry of all of these children using the Server Console application but it gives me the same error as the search:

Administrative limit exceeded.

I have set the "nssizelimit" attribute to -1 in config. I have also set "nslookthroughlimit" to -1 in config but I am still getting the same errors.

How can I configure my 389 ds (CentOS ds) server to stop these errors?