<olof_nord_ at hotmail.com> wrote:
> we can start, but not logon to the 389-console, and we cant get
> luma to connect to our server.
My recommendation is to forget about Luma temporarily and get the basic
software (389-DS and its console) going first. 389 Directory Server is a
*very* powerful tool, but like with all advanced tools, you need to plan
for time to learn it. It will be worth it.
To begin I would temporarily disable the local firewall (iptables, I
presume). During installation, a random port number was suggested. This
port may still be blocked by the firewall so that the Java console can
not connect.
Did you manage to start Linux services "dirsrv" *and* "dirsrv-admin"?
Start with running the Java console from the same machine where you
installed 389-DS, not via network.
Also, keep checking directory server logfiles for hints to why
authentication fails. If they don't show even a connection attempt, then
you will need to to eliminate that problem first.
A handy way is the tail command:
tail --lines 100 /var/log/dirsrv/slapd-<...snip...>errors
tail --lines 100 /var/log/dirsrv/slapd-<...snip...>access
During installation of 389-DS, you created a Directory Admin ID. This is
the one you need to use for logging onto the DS console, not the
Directory Manager.
I made the exprience that apparently the Java console does not like one
or more characters in my Directory Admin IP password.
My workaround is to start the console from a terminal window (everything
has to go in one line):
389-console -u {directory_admin_id} -w {directory_admin_id_password} -a
{http://ldap-host.example.com:12345} -l en
Obviously, you will need to replace the terms in curly brackets with the
ones from your installation.
>From personal experience, I strongly recommend writing down each and
every selection you made during 389-DS installation. If not, similar
sounding terms get mixed later very easily.
A very handy trick a nice colleague taught me is to do a silent
installation though a response file - this way you can carefully think
through all selections in advance. The command to install through
response file is:
/usr/sbin/setup-ds-admin.pl -s -f setup.inf
A generic setup.ing file would look like this (remember to adjust server
names, user names, passwords etc.):
===quote===
[General]
FullMachineName= ldap-server.example.com
SuiteSpotUserID= ldap
SuiteSpotGroup= ldap
AdminDomain= example.com
ConfigDirectoryAdminID= {directory_admin_id}
ConfigDirectoryAdminPwd= {directory_admin_id_password}
ConfigDirectoryLdapURL= ldap://ldap-host.example.com:389/o=NetscapeRoot
[slapd]
SlapdConfigForMC= Yes
UseExistingMC= 0
ServerPort= 389
ServerIdentifier= ldap01
Suffix= dc=example2,dc=com
RootDN= cn=Directory Manager
RootDNPwd= {secret_pw}
[admin]
Port= 20126
ServerAdminID= {directory_admin_id}
ServerAdminPwd= {directory_admin_id_password}
===unquote===
Make sure that (Linux) user and group "ldap" exist beforehand.
Oh, and if something goes wrong
/usr/sbin/remove-ds-admin.pl -f -d -y
will completely wipe out your 389-DS installation. Delete afterwards
directory /etc/dirsrv/slapd-<...snip...>.removed and you can start over.
> Our goal is to be able to log into the 389-console and to add some users
This definitely works from the console.
> We would also like to do some more things like sharing folders
Howeve, for this goal you will have to invest more time. 389-DS in iself
can not share folders - it is "just" a directory. You can, however, let
Linux use the LDAP directory for authentication when accessing folders.
In combination with Samba it is also possible to create something like a
fileserver plus domain controller for small networks.
About Luma I an unable to comment as we don't use it.
Regards,
Wolf
