Ah, I did not do that as I thought the filter would make the change to
users with objectClass inetOrgPerson. I am virtually certain the users
do not explicitly have inetUser as an object class. Are they supposed
overlooked by me!).
Post by Andrey IvanovCan you show me the result of
/usr/lib64/mozldap/ldapsearch -b
"ou=Desks,o=a100,o=Internal,dc=ssiservices,dc=biz" -D "cn=Directory
Manager" -w - -h ldap uid=jasiii objectClass
inetUser" is not present in the result of this search you should, as i
said in the previous message, add this objectClass to all the entries
dn: uid=jasiii,ou=Desks,o=a100,o=Internal,dc=ssiservices,dc=biz
changetype: add
objectclass: inetUser
Hope it helps .
2009/5/22 John A. Sullivan III <jsullivan at opensourcedevel.com>
I'm starting to feel really stupid here - still not working.
I thought the filter must be the problem for sure. I assumed from the
documentation that no filter meant the task would add the attribute for
everything that could take a memberOf attribute. I did not realize it
defaulted to inetuser. So I recreated the task with a filter of
(objectClass=inetOrgPerson) but it still did not seem to work.
I thought perhaps I was doing ldapmodify wrong (enter the parameters,
double enter, then CTL D) so I edited the fixup-memberof.pl script
according to Rich's instructions. It ran without error (by the way, it
reflects the admin password when using -w - !!!). But still no success.
Perhaps I am checking incorrectly. I did not expect to see memberOf
listed as an attribute in the advanced console screen for the user since
It should be visible as an attribute you can add (provided your entry
has "objectClass: inetUser")
/usr/lib64/mozldap/ldapsearch -b
"ou=Desks,o=a100,o=Internal,dc=ssiservices,dc=biz" -D
"cn=Directory
Manager" -w - -h ldap uid=jasiii memberOf
Is this how I would check for success?
There is nothing suspicious in the error log. I do have the audit log
enabled. I see the creation and automatic deletion of the task but I do
not see any changes to objects to add and populate the
memberOf
attribute. I'll paste in some excerpts below.
What next? Thanks - John
time: 20090520221132
dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
changetype: add
objectClass: top
objectClass: extensibleObject
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
creatorsName: cn=xxxx
modifiersName: cn=xxx
createTimestamp: 20090521021132Z
modifyTimestamp: 20090521021132Z
time: 20090520221333
dn: cn=fixmemberof,cn=memberof task,cn=tasks,cn=config
changetype: delete
modifiersname: cn=server,cn=plugins,cn=config
time: 20090520222242
dn: cn=fixMemberOf,cn=memberof task,cn=tasks,cn=config
changetype: add
objectClass: top
objectClass: extensibleObject
cn: fixMemberOf
basedn: ou=Desks,o=a100,o=Internal,dc=ssiservices,dc=biz
creatorsName: cn=xxxx
modifiersName: cn=xxxx
createTimestamp: 20090521022242Z
modifyTimestamp: 20090521022242Z
time: 20090520222442
dn: cn=fixmemberof,cn=memberof task,cn=tasks,cn=config
changetype: delete
modifiersname: cn=server,cn=plugins,cn=config
.
.
.
time: 20090521183523
dn: cn=memberOf_fixup_2009_5_21_18_35_23, cn=memberOf task, cn=tasks,
cn=config
changetype: add
objectClass: top
objectClass: extensibleObject
cn: memberOf_fixup_2009_5_21_18_35_23
basedn: o=Internal,dc=ssiservices,dc=biz
filter: (objectClass=inetOrgPerson)
creatorsName: cn=xxxx
modifiersName: cn=xxxx
createTimestamp: 20090521223523Z
modifyTimestamp: 20090521223523Z
time: 20090521183724
dn: cn=memberof_fixup_2009_5_21_18_35_23,cn=memberof
task,cn=tasks,cn=config
changetype: delete
modifiersname: cn=server,cn=plugins,cn=config
time: 20090521185804
cn=general,ou=1.1,ou=console,ou=cn=xxxxx,ou=userpreferences,ou=ssiservices.biz,o=netscaperoot
changetype: modify
replace: nsPreference
IwojVGh1IE1heSAyMSAxODo1ODowNSBFRFQgMjAwOQpXaWR0aD0xMjgwClNob3
dTdGF0dXNCYXI9dHJ1ZQpTaG93QmFubmVyQmFyPXRydWUKWT0wCkhlaWdodD03NjkKWD0wCg==
-
replace: modifiersname
modifiersname: cn=xxxxx
-
replace: modifytimestamp
modifytimestamp: 20090521225804Z
-
Post by Andrey Ivanov2009/5/21 John A. Sullivan III
<jsullivan at opensourcedevel.com>
Post by Andrey IvanovThank you, Andrey. I did do an updatedb and then
locate - no
Post by Andrey Ivanovfixup-member0f.pl - just
template.fixup-memberOf.pl :-(
Post by Andrey IvanovIt is very strange. Normally during the server installation
the
Post by Andrey Ivanovtemplate should be converted to the "normal" perl script.
Have you verified the configuration of the memberOf plugin,
especially
Post by Andrey Ivanovthe arguments/attributes "memberofgroupattr" and
"memberofattr" ?
Post by Andrey IvanovUnless I'm missing something, you're ldapmodify
looks just
Post by Andrey Ivanovlike mine
except for the cn (I believe the documentation says
it can be
Post by Andrey Ivanovcalled
anything) and I did not use a filter (again, I
believe the
Post by Andrey Ivanovdocumentation
says it is optional and our dit is still rather
small).
Post by Andrey IvanovIf you do not put the filter into the ldif then the default
filter is
Post by Andrey Ivanovused : "(objectClass=inetuser)". Do all your user entries
include this
Post by Andrey IvanovobjectClass (inetuser)? If not, you should add this
objectClass to all
Post by Andrey Ivanovthe entries where you want the memberOf attribute to appear.
I did create a new group and add myself to it as you
suggested
Post by Andrey Ivanov(thank
you). Surprisingly, it did not appear to work. I
did not see
Post by Andrey Ivanova
memberOf attribute populated for me. I then thought
I would
Post by Andrey Ivanovsee if I
need to manually add that attribute to each user (I
hope not!)
Post by Andrey Ivanovand I did
not see memberOf as an attribute I could add to my
user
Post by Andrey Ivanovobject.
No. You should not add it manually, the memberOf attribute
is
Post by Andrey Ivanovmaintained automatically based on the group membership.
Do you see any message in error log? There should be
something about
Post by Andrey Ivanovthe impossibility to write the memberof attribute i think.
If you cannot add this attribute manually to your entry it
means that
Post by Andrey Ivanovyour entry does not containe "objectClass: inetuser". Add
this
Post by Andrey IvanovobjectClass to all the entries that should be "managed" by
the plug-in
Post by Andrey Ivanovto allow the attribute memberOf to be written to that
entries.
Post by Andrey IvanovI have verified that the plugin is defined in
dse.ldif and it
Post by Andrey Ivanovis
enabled. I also see memberOf defined in
20subscriber.ldif and
Post by Andrey Ivanovdid not
see anything in the documentation about needing to
extend the
Post by Andrey Ivanovschema.
No, you don't need to extend the schema but you need to make
sure that
Post by Andrey IvanovobjectClasses: ( 2.16.840.1.113730.3.2.130 NAME 'inetUser'
DESC
Post by Andrey Ivanov'Auxiliary class which must be present in an entry for
delivery of
Post by Andrey Ivanovsubscriber services' SUP top AUXILIARY MAY ( uid $
inetUserStatus $
Post by Andrey IvanovinetUserHTTPURL $ userPassword $ memberOf ) X-ORIGIN
'Netscape
Post by Andrey Ivanovsubscriber interoperability' )
So, at this point, I am still at a loss for what I
did wrong.
Post by Andrey IvanovWhat do I
check next? Thanks - John
Try to add the "objectClass: inetuser" to the entries
concerned and
Post by Andrey Ivanovtake a closer look to the "errors" log file.
@+
On Thu, 2009-05-21 at 12:59 +0200, Andrey Ivanov
Post by Andrey IvanovHi,
there are two things to be verified and/or taken
into
Post by Andrey IvanovPost by Andrey Ivanov* the pair of the attributes that is maintained
(the
Post by Andrey Ivanovarguments
Post by Andrey Ivanov"memberofgroupattr" and "memberofattr" of the
plug-in)
Post by Andrey IvanovPost by Andrey Ivanov* presence of these two attributes in the classes
of your
Post by Andrey Ivanovusers and
Post by Andrey Ivanovgroups
To find fixup-memberof.pl try "locate
fixup-memberof.pl".
Post by Andrey IvanovPost by Andrey IvanovTo launch it manually you need to add something
like that
Post by Andrey Ivanovto the
Post by Andrey Ivanovdn: cn=memberOf_fixup_2009_5_21_12_39_21,
cn=memberOf task,
Post by Andrey Ivanovcn=tasks,
Post by Andrey Ivanovcn=config
changetype: add
objectclass: top
objectclass: extensibleObject
cn: memberOf_fixup_2009_5_21_12_39_21
basedn: dc=example,dc=com
filter: (objectClass=inetOrgPerson)
As for your account, you may remove/add yourself
from a
Post by Andrey Ivanovgroup to see
Post by Andrey Ivanovif it changes the memberof attribute. Verify the
objectClass
Post by Andrey Ivanovof your
Post by Andrey Ivanoventry and make sure the attribute memberOf is an
optional
Post by Andrey Ivanovattribute of
Post by Andrey Ivanovat least one of these objectClasses...
2009/5/21 John A. Sullivan III
<jsullivan at opensourcedevel.com>
Post by Andrey IvanovHello, all. We are in the process of
upgrading from
Post by Andrey Ivanov8.0 to
Post by Andrey Ivanov8.1. We've
hit a few glitches along the way but most
has gone
Post by Andrey Ivanovwell.
Post by Andrey IvanovHowever, we
wanted to implement the new memberOf
functionality.
Post by Andrey IvanovWe
Post by Andrey Ivanovsuccessfully
added the plugin by editing dse.ldif and
enabled it
Post by Andrey Ivanovfrom the
Post by Andrey Ivanovconsole.
However, we've been unsuccessful in having
existing
Post by Andrey Ivanovgroup
Post by Andrey Ivanovmembership
assigned to the memberOf attribute.
We first tried to run fixup-memberOf.pl
but the
Post by Andrey Ivanovscript does
Post by Andrey Ivanovnot exist.
There is a template.fixup-memberOf.pl but
this does
Post by Andrey Ivanovnot seem
Post by Andrey Ivanovto have
been built into a final script.
We then thought we would use the new task
feature of
task,cn=tasks,cn=config and
Post by Andrey Ivanovtried to
Post by Andrey Ivanovcreate the task
object. There was no
nsDirectoryServerTask
Post by Andrey Ivanovobjectclass. We
Post by Andrey Ivanovadded an
nstask but then found there was no basedn
attribute
Post by Andrey Ivanovwe could
Post by Andrey Ivanovadd. We
then created an extensibleobject instead
but still
Post by Andrey Ivanovnot basedn
Post by Andrey Ivanovattribute.
Finally, we resorted to ldapmodify (we
hesitated
Post by Andrey Ivanovjust because
Post by Andrey Ivanovwe are not
very familiar with the command line
tools). First,
Post by Andrey IvanovPost by Andrey Ivanovdn: cn=fixMemberOf,cn=memberof
task,cn=tasks,cn=config
Post by Andrey Ivanovchangetype: add
objectclass: top
objectclass: extensibleObject
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
The Internal Organization has several
organizations
Post by Andrey Ivanovunder it
Post by Andrey Ivanov(for
various clients) and then user
organizational units
Post by Andrey Ivanovunder
Post by Andrey Ivanovthose
organizations. Although it generated no
errors, it
Post by Andrey Ivanovdid not
Post by Andrey Ivanovseem to
work. Perhaps I just don't know how to
test it.
Post by Andrey IvanovHowever, the
Post by Andrey Ivanovfollowing
/usr/lib64/mozldap/ldapsearch -b
"ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D
Post by Andrey IvanovPost by Andrey Ivanov"cn=Directory
Manager" -w - -h ldap uid=myid memberOf
Doing /usr/lib64/mozldap/ldapsearch -b
"ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz" -D
Post by Andrey IvanovPost by Andrey Ivanov"cn=Directory
Manager" -w - -h ldap uid=myid
showed me plenty of attributes but nothing
for
Post by Andrey IvanovmemberOf
Post by Andrey IvanovI also tried creating the task with a
basedn of
ou=Users,o=client1,o=Internal,dc=ssiservices,dc=biz
Post by Andrey Ivanovin case it
Post by Andrey Ivanovdid not
change objects lower in the tree. Still
no success.
Post by Andrey IvanovPost by Andrey Ivanovdn: cn=fixMemberOf,cn=memberof
task,cn=tasks,cn=config
Post by Andrey Ivanovchangetype: add
objectclass: top
objectclass: nsDirectoryServerTask
cn: fixMemberOf
basedn: o=Internal,dc=ssiservices,dc=biz
adding new entry
cn=fixMemberOf,cn=memberof
Post by Andrey IvanovPost by Andrey Ivanovtask,cn=tasks,cn=config
ldap_add: Object class violation
ldap_add: additional info: unknown object
class
Post by Andrey IvanovPost by Andrey Ivanov"nsDirectoryServerTask"
And received the expected unknown object
class
documentation
Post by Andrey Ivanovbugs? Are
Post by Andrey Ivanovthere
application bugs or do we simply not know
what we
Post by Andrey Ivanovare doing
Post by Andrey Ivanovwith tasks
and memberOf? How do we get the memberOf
information
Post by Andrey Ivanovinto our
Post by Andrey Ivanovexisting
user objects? Thanks - John
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan at opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to
secular society
Post by Andrey IvanovPost by Andrey Ivanov--
Fedora-directory-users mailing list
Fedora-directory-users at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
Post by Andrey IvanovPost by Andrey Ivanov--
Fedora-directory-users mailing list
Fedora-directory-users at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
Post by Andrey Ivanov--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan at opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
--
Fedora-directory-users mailing list
Fedora-directory-users at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
Post by Andrey Ivanov--
Fedora-directory-users mailing list
Fedora-directory-users at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan at opensourcedevel.com
http://www.spiritualoutreach.com
Making Christianity intelligible to secular society
--
Fedora-directory-users mailing list
Fedora-directory-users at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users
--
Fedora-directory-users mailing list
Fedora-directory-users at redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users