|
From: Mark Reynolds <mreynolds@xxxxxxxxxx>
Sent: Thursday, September 23, 2021 12:16 PM
To: Michael Starling <mlstarling31@xxxxxxxxxxx>; General discussion list for the 389 Directory server project. <389-users@xxxxxxxxxxxxxxxxxxxxxxx>
Subject: Re: [389-users] dsidm utility inconsistencies
On 9/23/21 11:59 AM, Michael Starling wrote:
On 9/22/21 5:11 PM, Michael Starling wrote:
On 9/22/21 2:58 PM, Michael Starling wrote:
Unless I'm interpreting the man pages, and documentation wrong there seems to be some issues with the dsidm utility. Perhaps I'm doing something wrong?
This works.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account get-by-dn uid=mstarlingt,ou=People,dc=mydomain,dc=com
dn: uid=mstarlingt,ou=People,dc=mydomain,dc=com
cn: Mike Starling
gecos: Mike Starling test account
gidNumber: 100
givenName: Mike
homeDirectory: /home/mstarlingt
loginShell: /bin/ksh
mail:
mstarling@xxxxxxxxxxxx
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
shadowExpire: 99999
shadowLastChange: 18857
shadowMax: 33
shadowWarning: 1
sn: Starling
uid: mstarlingt
uidNumber: 25574
#Password reset works
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account reset_password "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
CONFIRM - Enter new password for uid=mstarlingt,ou=People,dc=mydomain,dc=com :
reset password for uid=mstarlingt,ou=People,dc=mydomain,dc=com
#Unable to lock the account.
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt
Error: No such object
I consult the help which says to specify the dn
dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock -h
usage: dsidm instance account lock [-h] [dn]
positional arguments:
dn The dn to lock
optional arguments:
-h, --help show this help message and exit
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
I think this is a known bug (which was fixed). What version of python-lib389 is installed?
Thanks Mark.
python3-lib389-1.4.3.17-1.module_el8+10764+2b5f8656.noarch is installed
Yes this is a old version, and the fix (Issue 4912) was recently made. We will have to do new builds...
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
dsidm -W -D cn=manager -Z ldaps://labdsa101.athenahealth.com -b dc=mydomain,dc=com account lock "uid=mstarlingt"
I tried changing the base to the People OU where the account lives
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b ou=People,dc=mydomain,dc=com account lock "uid=mstarlingt,ou=People,dc=mydomain,dc=com"
Error: search_ext() argument 1 must be str, not None
Enter uid to retrieve : mstarlingt
Error: No object exists given the filter criteria mstarlingt
What is in the access log?
Here's what I see in the logs.
22/Sep/2021:17:09:28.515626170 -0400] conn=3947 op=2 SRCH base="ou=people,dc=mydomain,dc=com" scope=2 filter="(&(&(objectClass=nsPerson)(objectClass=nsAccount)(objectClass=nsOrgPerson)(objectClass=posixAccount))(|(uid=mstarlingt)(displayName=mstarlingt)(cn=mstarlingt)))"
attrs="distinguishedName"
So dsidm is pretty opinionated about how it looks for users (which might need to change). It only looks for entries that have all of these objectclasses: nsPerson, nsAccount, nsOrgPerson, posixAccount. What objectclasses are in your user entry?
Mark
Ahh. That's it. The mstarlingt account was created with an LDIF and does not have the "ns" object classes.
I notice when I go to create an account with dsidm I have limited ability to specify attributes.
Is the best way to create an account still with an LDIF file? When I create an account with dsidm it has no loginShell. Is there a default template dsidm pulls from that needs to be updated with the other possible user attributes that are set as the default
and not covered by the dsidm utility?
dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user create --uid="dstest" --cn="Test dsidm" --gidNumber="100" --homeDirectory="/home/dstest" --displayName="Test Account" --uidnumber="25941" --mail="mstarling@xxxxxxxxxxxx"
--loginShell="/bin/bash"
usage: dsidm [-h] [-b BASEDN] [-v] [-D BINDDN] [-w BINDPW] [-W] [-W PWDFILE]
[-Z] [-j]
instance
{account,group,initialise,organizationalunit,posixgroup,user,client_config,role}
...
dsidm: error: unrecognized arguments: --uidnumber=25941 --mail=mstarling@xxxxxxxxxxxx --loginShell=/bin/bash
dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user create -h
usage: dsidm instance user create [-h] [--uid [UID]] [--cn [CN]]
[--displayName [DISPLAYNAME]]
[--uidNumber [UIDNUMBER]]
[--gidNumber [GIDNUMBER]]
[--homeDirectory [HOMEDIRECTORY]]
optional arguments:
-h, --help show this help message and exit
--uid [UID] Value of uid
--cn [CN] Value of cn
--displayName [DISPLAYNAME]
Value of displayName
--uidNumber [UIDNUMBER]
Value of uidNumber
--gidNumber [GIDNUMBER]
Value of gidNumber
--homeDirectory [HOMEDIRECTORY]
Value of homeDirectory
You used the wrong argument (--uidnumber), it is case sensitive, and the usage says to use "--uidNumber".
As for setting other attributes, dsidm can do it - after the entry is created. Please see:
dsidm -b o=mark localhost user modify --help
So you just can't set those custom attributes at creation time :-/ But I think that sounds like a good RFE for dsidm, something like: --attr="attr:value"
So if I create a user with dsidm and it adds the "ns" object classes I still can't run some of the dsidm commands against that account
dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get dstest
dn: uid=dstest,ou=People,dc=mydomain,dc=com
cn: Test Dsconf
displayName: Test Account
employeeNumber: 25429
gidNumber: 100
homeDirectory: /home/dstest
loginShell: /bin/bash
mail:
mstarling@xxxxxxxxxxxx
objectClass: top
objectClass: nsPerson
objectClass: nsAccount
objectClass: nsOrgPerson
objectClass: posixAccount
uid: dstest
uidNumber: 25941
dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock dstest
Error: dstest is not a valid DN
This is expected since you did not provide a DN
dsidm -W -D cn=manager -Z
ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account lock uid=dstest,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
Right, like I said, this is known bug that was recently fixed, so new builds need to done to pick that fix up. I'm not sure what platform you are on, I know it takes time for our builds to land in other distros
like centOS, etc.
Mark
Thanks for the information Mark.
I'm on Oracle Linux.
dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status uid=dstest,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status dstest
Error: dstest is not a valid DN
dsidm -W .slaplab -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com account entry-status
Enter dn to check : uid=dstest,ou=People,dc=mydomain,dc=com
Error: search_ext() argument 1 must be str, not None
Thanks,
Mark
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt,ou=People,dc=mydomain,dc=com
Error: No object exists given the filter criteria uid=mstarlingt,ou=People,dc=mydomain,dc=com
dsidm -W -D cn=manager -Z ldaps://labdsa101.mydomain.com -b dc=mydomain,dc=com user get
Enter uid to retrieve : uid=mstarlingt
Error: No object exists given the filter criteria uid=mstarlingt
_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
--
Directory Server Development Team
--
Directory Server Development Team
--
Directory Server Development Team
|
