Questions[edirectory](server)

I have a Novell LDAP server running on RHEL. and I want to authenticate my LDAP users from the Website on one of my machine having HTTP, so I use in the httpd.conf

<Directory /var/www/html>
   AuthType Basic
   AuthName "Stooges Web Site: Login with user id"
   AuthBasicProvider ldap
   AuthzLDAPAuthoritative off
   AuthLDAPURL "ldaps://ldap1.server.com:636/o=ae-name?cn"
   AuthLDAPBindDN "cn=psg_admin,o=ae-name"
   AuthLDAPBindPassword ldappass
   require valid-user

</Directory>

the error I recieve is ......

[31231] auth_ldap authenticate: user ldap-user1 authentication failed; URI / [LDAP: ldap_simple_bind_s() failed][Invalid credentials]
[Thu Feb 02 08:04:39 2012] [error] [client 10.231.101.113] user ldap-user1: authentication failure for "/": Password Mismatch

Is there anything missing or am I making any mistake please guide me in this respect.

A customer asked if it's possible to authenticate windows users (on XP or Win7 machines) against an eDirectory server to be able to open a session on a Windows 2008 server.

Let me try to clarify my setup:

+--------+                    +------------+              +---------+
| Win XP |-- ask permision -->| eDirectory |-- connects ->| Win2008 |
+--------+                    +------------+              +---------+

eDirectory contains the centralized list of users/passwords that can connect to many servers in the company, including this Win2008. My customer wants to log-in to a Windows XP machine with some credentials, then be able to open a session in Win2008 to use a specific program.

If this is possible, could you give me some pointers on how can this be accomplished?.

I have Configured LDAP Authentication for my Linux Machines. The LDAP Server is Novell eDirectory. The LDAP Users are able to login into the machine. But when i am issuing passwd command it is asking LDAP password then asking to give me new password. After that i am getting a message saying that all the authentication tokens are successfully updated.

But when i try to login with the new password into the machine it is not allowing but when i tried with the old password it is allowing me to loign. Even the eDirectory password also didn't got changed?

What's wrong i am doing?

I have a legacy NetWare 6.5 server that offers file shares to about 40 clients. It also acts as the router between our two internal subnets and our parent agency's network. We are planning on replacing the routing functionality with a Juniper product. At the same time we are refactoring our physical network infrastructure - currently the NetWare server has an IP presence on both subnets. I would like to disable two of its three interfaces so it only has one connection to the network.

Unfortunately, I cannot figure out how the Novell Client (4.91.5.20080922 on Windows XP SP3) resolves the NDS tree netware_server.department.mycorp to an actual IP address. Testing has shown that if those interfaces are no longer there, clients will fail to "resolve" the NDS object to the correct (still existant) IP address and chaos will ensue.

I have tried setting the "Server Cache Timeout" to 0 in an effort to force a "name resolution" of netware_server so I can look at the actual TCP/IP conversation in Wireshark. I have also tried adding an entry to the C:\WINDOWS\system32\drivers\etc\hosts file with the NetWare server's NDS Object Name and then limiting the Novell's Client's Name Space Providers (Properties - Protocol Preferences) to just "Host File" trying to force a new "lookup" using the /etc/hosts file instead of whatever arcane method is currently used. Both of these attempts came from this TID10057730. Both have failed.

How does the Novell Client resolve an NDS Object Name like netware_server.department.mycorp to an actual IP address? How can I force the clearing of any client-side "NDS name" cache? How can I force that "NDS name" resolution to always resolve to an IP address that I manually specify?

EDIT: First off, we're running pure IP. If you happen to still be running IPX the Novell Client behaves quite differently.

The Novell Client needs to identify what IP address/es the server hosting NetWare Services is located at before it can actually login. This information is gathered through what Novell calls "Name Space Providers" (NSPs); since we're on IP only we're limited to using just SLP, DNS, a HOST/NWHOST file, or DHCP (TID10057730). You can access and disable which of these NSPs is available for the Novell Client to use by selecting or de-selecting them in the Properties - Protocol Preferences as mentioned earlier. According to the same TID after NT/2000 the Novell Client polls the NSPs in an "asynchronous" manner, so there is no "order" (unfortunately) in which they're polled.

Additionally, the Novell Client will cache these "service names" locally. The default setting is to hold this cache for 21 days. If, you're trying to force the clients to look for the same NDS tree on a different IP address clearing this cache might be something to consider (Advanced Settings - Server Cache Timeout or HKLM\SYSTEM\CurrentControlSet\Services\NetWareWorkstation\Parameters\ServerCacheTimeout). More information about how the Novell Client uses which "Name Service" provider can be found here. SLP however seems to be a method that is used in my shop. Novell has info out about how the Novell Client uses SLP here.

However, as mentioned the best most "fool-proof" way to force the Novell Client to only access NetWare Service from one IP address is to manually specifying that IP in the 'Server:' prompt of the utility. This should in theory override any of the hints (i.e., netware_server.department.mycorp) and anything in the cache, but you will probably want to double-check somehow.

I'm currently trying to use OpenLDAP as a proxy to a Novell LDAP server and running in to a few problems. It seems that only certain objects are coming through and there's almost no hierarchy. (I can set a base DN and view a particular object... but if I set the real base DN... I can only see it... and no children.) My suspicion is that I need to find a Novell/eDirectory/DNS schema to use in OpenLDAP. Does anyone know where I can find one? I saw a few LDIF files in the schema directory, and I believe I can get an LDIF copy from eDirectory but I only see .schema files being used in the config. The slapd.conf file is below... thanks for any help or suggestions. Please let me know if any further information would be helpful

include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/inetorgperson.schema include /usr/local/etc/openldap/schema/nis.schema

pidfile /usr/local/var/run/slapd.pid argsfile /usr/local/var/run/slapd.args

database ldap

uri ldap://10.10.1.27:389/

binddn "cn=adminuser,ou=office,o=au" bindpw "password"

suffix "o=au"

idassert-bind mode=self

access to * by * read