Yes this is a old version, and the fix (Issue 4912) was recently made. We will have to do new builds...
From: Mark Reynolds <mreynolds@redhat.com>
Sent: Wednesday, September 22, 2021 3:38 PM
To: General discussion list for the 389 Directory server project. <389-users@lists.fedoraproject.org>; Michael Starling <mlstarling31@hotmail.com>
Subject: Re: [389-users] dsidm utility inconsistencies
On 9/22/21 2:58 PM, Michael Starling wrote:
Unless I'm interpreting the man pages, and documentation wrong there seems to be some issues with the dsidm utility. Perhaps I'm doing something wrong?
This works.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account get-by-dn uid=mstarlingt,ou=People,dc=mydomain,dc=com
dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
cn: Mike Starling
gecos: Mike Starling test account
gidNumber: 100
givenName: Mike
homeDirectory: /home/mstarlingt
loginShell: /bin/ksh
mail: mstarling@mydomain.com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowExpire: 99999
shadowLastChange: 18857
shadowMax: 33
shadowWarning: 1
sn: Starling
uid: mstarlingt
uidNumber: 25574
#Password reset works
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account reset_password "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
CONFIRM - Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
#Unable to lock the account.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt
Error: No such object
I consult the help which says to specify the dn
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock -h
usage: dsidm instance account lock [-h] [dn]
positional arguments:
dn The dn to lock
optional arguments:
-h, --help show this help message and exit
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
I think this is a known bug (which was fixed). What version of python-lib389 is installed?
Thanks Mark.
python3-lib389-1.4.3.17-1.module_el8+10764+2b5f8656.noarch is installed
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b dc=mydomain,dc=com account lock "uid=mstarlingt"
I tried changing the base to the People OU where the account lives
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b ou=People,dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : mstarlingt
Error: No object exists given the filter criteria mstarlingt
What is in the access log?
Here's what I see in the logs.
22/Sep/2021:17:09:28.515626170 -0400] conn=3947 op=2 SRCH base="ou=people,dc=mydomain,dc=com" scope=2 filter="(&(&(objectClass=nsPerson)(objectClass=nsAccount)(objectClass=nsOrgPerson)(objectClass=posixAccount))(|(uid=mstarlingt)(displayName=mstarlingt)(cn=mstarlingt)))" attrs="distinguishedName"
So dsidm is pretty opinionated about how it looks for users (which might need to change). It only looks for entries that have all of these objectclasses: nsPerson, nsAccount, nsOrgPerson, posixAccount. What objectclasses are in your user entry?
Mark
Thanks,
Mark
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: No object exists given the filter criteria uid=mstarlingt,ou=People,dc=mydomain,dc=com
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt
Error: No object exists given the filter criteria uid=mstarlingt
_______________________________________________ 389-users mailing list -- 389-users@lists.fedoraproject.org To unsubscribe send an email to 389-users-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/389-users@lists.fedoraproject.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure-- Directory Server Development Team
-- Directory Server Development Team
No comments:
Post a Comment