Directory Server Replica and Messaging Server 6

I install Directory Server 5.2 as Master Replica in one machine (V120) and on the other machine (V240) I install the following:
1. SunONE Directory Server 5.2 (Consumer
Replica) or slave replica.
2. SunONE Identity Server
3. SunONE Messaging Server 6
I have successfully install and configured the 3 Servers, when they are running on just one machine (one box). But when I try to run them in two separate machines as described above, the messaging server acts strangely and it's configuration fails, when i try to configure it on the directory server replica.
In simpler words, I want to know if someone has installed Messaging Server in a Directory Server Replication scenario, where there are two machines involve. Because all works well when we install everything on one machine (one box) but I am having hard time configuring the messaging server in this split setup scenario.
So, if someone has idea about how to run the Messaging Server 6 ( ./configure ) file successfully on a Directory Server 5.2 Replica, please suggest me in detail.
Thanking you,
Farhan Ahmed.
Vision Valley, Dubai.

Messaging Server uses LDAP in two ways. The obvious one is that user/group/domain information is stored there.
The non-obvious way is that some configuration information is stored in LDAP, in the "o=NetscapeRoot" tree. This tree is NOT ususally replicated, so if you perform the installation against one LDAP server, and then attempt to move the configuration to point to another one, and don't make a separate replication agreement for the configuration, your server won't work correctly.
To configure Messaging against a replica, you also need to understand how the replication and "referral" works. Without studying your scenario, I cannot tell what has failed, but indeed, there are users that have configured Messaging 6.0 against a replica LDAP system.
You may want to open a tech support ticket, and get personal help for your issue.

Similar Messages

Single directory Server for Messaging and Portal

We are trying to unify our directory services.
At present, there two directory servers, one for iPlanet messaging 5.2 and another for Portal server 6.0.
Messaging's Directory server is v5.1 and Portal's Directory server is v5.2. Their BaseDN is same.
Now, What we are planning to do is as below.
1. LDIF everything from Msgr Directory and import into Portal's Directory.
2. Point Msg Server to the Portal's directory.
But, we are not sure what to export or how to tell messaging server to look at the Portal's Directory. Any help will be greatly appreciated!!!
Thanks
Srini

What you are trying to do is non-trivial.
Setting the ldap server for user and groups on the mail server is easy enough -- look at the output of configutil and you will find the values of local.ugldap*
define the values you need to change.
e.g.:
local.ugldapbasedn
local.ugldapbindcred
local.ugldapbinddn
local.ugldaphost
local.ugldapport
etc.
These are all listed in the messaging reference manual.
You need to ensure that the schemas of the two apps. match. For example, if you are using schema 1 for mail and schema 2 for the portal (quite likely), there will be a lot more work to do on the directory than simply moving the user entries accross and merging them.
Unless you have done this sort of thing before, or feel very comfortable and knowlegable about how the messaging server in partuicular works with LDAP, I would suggest that you seriously consider getting help from Sun Professonal Services.

Binding to directory server vs. OD replica

Can someone explain the practical differences between binding a server to an OD master vs. being a replica of that OD master?
Why would I bind a server instead of making a replica? Seems like the replica would always be easier to admin and would provide the same function...?

I'm wondering why someone would do this. Why bind one server to another vs. making that second server a replica?
The real issue is whether this server is going to provide authentication services to other clients.
In addition to not wanting all your data on a single machine, if you have many client systems it may overwhelm a single directory server. For these reasons you may create a replica (or number of replicas) that keep in sync with the master server and have a complete copy of the entire Open Directory database (all users, machines, groups, etc.)
These replicas can then be used to provide authentication services to client systems, as well as provide failover for the client in case this machine goes away for any reason.
In contrast there's no need for every client system to have the entire directory. If you have many machines, the number of update messages that get passed around and need to be replicated to every machine on the network would be cumbersome, at best.
Then there's also an element of security - the directory should have some level of protection since it includes data about every user, including their password and other personal details. If you replicate this to every machine then any user on your network could poke around the data at their leisure. Contrast that with a typical client machine that only has the account credentials for the current user.
So for any network you should create one master and at least one replica. Client systems should point to a replica and should not be Open Directory replicas themselves.

Directory server 4.12 and 4.15 problem with Solaris 8

Hi there,
I have been having an ongoing problem with my read/write master
directory server. It
occasionally stops responding to bind attempts and queries. The current
setup as is running
on a Sunfire 280R with Solaris 8. Up until a few days ago I was running
4.12, I upgraded this
to 4.15 to see of the problem would go away. I am running several 4.13
replicas on other
Solaris 8 machines with no problems.
The biggest problem is that this master directory server is needed for
our Iplanet messaging
server 5.1 implementation. Every time the directory fails you cannot log
in to the messaging
server. (there doesn't appear to be anyway of sending authentication to
a read only server).
Anyway I was just wanting to see if anyone else had the same problem or
had fixed it and could
provide some insight into how to fix it. Also any pointers on what to
look for in the directory
server error logs would be useful.
I had an idea that it might have been running out of available
connections so I set it to close idle
connections after 300 seconds. Is there any docs on tuning the resources
for the server or for
identifying if you have a resource problem?
Any help or ideas would be appreciated. Please contact me directly as
well as to the newsgroup
if possible.
Thanks,
Scott.
Scott Lawson
Systems Manager
Department Of Information Services
St. George's Hospital Medical School
Tooting
London SW17 0RE
UK
P: 44 (0)208 725 2896
F: 44 (0)208 725 3583
mailto:[email protected]
http://www.sghms.ac.uk
Your mouse has moved.
Windows must be restarted for the change to take effect.
Reboot now? [OK]
__________________________________________________________________

Scott Lawson <[email protected]> wrote in news:3BCAA419.E322F958
@sghms.ac.uk:
>
I had an idea that it might have been running out of available
connections so I set it to close idle
connections after 300 seconds. Is there any docs on tuning the resources
for the server or for
identifying if you have a resource problem?4.15 hotfix solves a problem with FDs running out (apparently .... we are
still testing0.
/* Christopher Burke - Spam Mail to [email protected]
|*
\* Real mail to cburke(at)craznar(dot)com

How do I bind to directory server with SSL and authentication?

I'm running Lion Server 10.7.3, Open Directory master. In Open Directory/Settings/LDAP, I've checked the box to Enable SSL and selected a (self-signed) certificate. In Policies/Binding, I've checked the box to Enable Authenticated Directory Binding.
Testing with a client computer on which Snow Leopard has been freshly installed and fully updated, I went to System Prefs/Accounts to bind to the new directory server. The good news is, the binding was successful, and when the client initiates an AFP connection with the server, it uses Kerberos, creating a ticket as expected. (Which doesn't work with Lion clients, alas, but that's a seperate matter.)
Here are the problems:
1) It looks like the binding did not use SSL. By which I mean that when I opened Directory Utility and examined the LDAPv3 entry, the SSL checkbox was not checked. (If I then check the box, everything looks fine until I restart the client, after which I have a red dot. So I'm guessing that checking the box does nothing until after restart, and that it breaks the binding.)
2) I was never prompted to authenticate for the directory binding.
So I get that literally I'm *enabling* SSL and Authenticated Directory Binding, but it seems like the defaults are to bind without SSL or authentication, and there's no obvious-to-me way to force the binding to use those things. How do I do that?
What I'd really like to do is *require* SSL and Authenticated Directory Binding. I want this because my belief (correct me if I'm wrong) is that if authentication is required to bind to the server, no one will be able to bind to my server without my permission, and that SSL offers a more secure connection to my server than not-SSL. How do I require these things, or do I not really want to?
Thank you.

You cannot connect to databases via Muse at the moment. Please refer: http://forums.adobe.com/message/5090145#5090145
Cheers,
Vikas

Setting up Access Manager and Directory Server for Failover.

I'm setting up 2 Access Managers AM1,AM2 and 2 Directory Servers DS1 and DS2 for failover. I've connected AM1 and AM2 to DS1. Suffixes of DS1 is replicated to DS2. Any change made to AM1 is replicated to AM2 as expected. I just patched AM1 with Access Manager patch 1 and the version information for AM1 shows 7.1 126359-01. I followed the same procedure to patch AM2 but AM2 still shows ver 7.1.
How do I make sure both Access Managers are patched to the same version?
I'm able to authenticate to one IIS6 site and authentication is passed on to Outlook Web Access on AM1 but when I shut down AM1 to test failover to AM2 OWA prompts me again for password. How do I resolve this?
On AM1 http://host.domain/amserver/UI/Login?realm=sso successfully logs in but the same on AM2 gives Warning that "You have already logged in. Do you want to log out and then login to a different organization?"
Please help !!!

I'll answer what bits I can:
Q: AM showing the same version?
A: No idea on this one. I would have expected the operation you described to have produced the right answer. Check that neither your application server nor your web browser are caching old pages (ctrl-F5 in my browser)
Q: How do I resolve re-authentication on failover?
A: The AM documentation includes a deployment example that covers pretty closely what it is you are trying to achieve:
http://docs.sun.com/app/docs/doc/820-2278
Specifically, the problem you are describing is related to session failover. The sessions are stored in a local DB so when you failover the backup server does not store the same information and hence requires a reauthentication. The section of the above doc that deals with this is here:
http://docs.sun.com/app/docs/doc/820-2278/gdsre?l=en&a=view
Q: "You have already logged in" warning
A: No idea. Sorry.
R

Configuring a Directory Server for Digital IDs and Certificates

My company is moving toward using electronic signatures for internal documents. All of the users are on XP machines and have Acrobat Professional 8.0 installed. So far, I've been manually adding trusted IDs for each person who will be receiving signed documents that need to be validated. I'd like to make this a little easier by storing everyone's certificates on a server (Windows 2003) so that people can just go out there and add them all as one .fdf file. What I'm wondering is, what is the difference between doing it this way versus going through Acrobat and configuring a directory server? Will it work either way?
Thanks!
Anita

Hi,
Sorry for the late reply, regarding the error message: The DHCP services could not Contact Active Directory,
please check the below KB article to see if it could help here:
You are unable to authorize DHCP Server in Active Directory
http://support.microsoft.com/kb/303317/en-us
Reference for error ID 1059, and
error ID 10020.
For The specified server are already present in the directory services,
please take a look into the below Blog:
Active Directory DHCP authorisation issues
The method mentioned in the blog above is trying to move the old information that stored in AD, and then take an action of re-authorisation of the DHCP server.
Hope this may help
Best regards
Michael
If you have any feedback on our support, please click
here.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

An error occurred while configuring server as a directory server. Please check your network configuration and try again.

Hi there,
My Mac OS X Server 8.2 got buggered after I did the following steps:
Wiped Profile manager using "/Applications/Server.app/Contents/ServerRoot/usr/share/devicemgr/backend/wipeD B.sh"
Clicking the Off button in the Profile Manager section of the Server.app
Clicking the On button of the same
Clicking on asks if I want to create a new directory master, but I know that one already exists. Trying to continue confirms this. So, I go and destroy it to start again, but afterward, I get the following error when trying to create the directory master:
I've done this enough times while watching the system log to see the actual error thrown, which is:
Nov 12 22:01:24 srv.domain.com Server[279]: An error occurred while configuring srv as a directory server:
    Error Domain=XSActionErrorDomain Code=-1 "A child action failed" UserInfo=0x7fee9516c0f0 {XSActionErrorActionsKey=(
        "Creating Open Directory master"
    ), NSLocalizedDescription=A child action failed}
I have Googled the above and have discovered only a few entries here in these Apple communities, but have found no joy.
Here's a similar threads:
https://discussions.apple.com/message/19237429#19237429
Interestingly/confusingly, this server has been working just fine as a domain master using different domain names (on separate occasions/setups). It was only after having clicked the OFF button in Profile Manager (after a wipe) that things stopped working.
I could rebuild this server, as I have a backup image of it that I can restore, but I'd rather find out what's broken and fix it so as to hopefully be able to fix it if/when this ever happens to me again, learning something in the process.
That said, I perform the following steps prior to running the Open Directory setup on a the server to try and clean it up as best possible.
Clean up steps:
Delete the DNS zone (and all entries).
Turn off all server services
Delete all file server sharepoints
Change the host name at Hardware => SRV => Network tab. This runs the Change Host Name program.
Close Server.app
Throw Server.app in the trash / Empty trash (I've also just trashed and put back with same result)
Delete the /Library/Server directory
Clear and recreate System keychain using "systemkeychain -vfcC" to clear out all the certs related to old host name.
Delete all the entries in the Login keychain
Reboot (probably don't have to)
Re-download and install Server.app
Run Server.app, which actually retains some settings from the last setup, though I don't know where to clean those.
After Server setup, confirm that the host name from step 4 is what I want.
Running "changeip -checkhostname" shows "Success". I'm using an Internet domain name so pinging the "internal" zone (srv.domain.com) resolves with the correct internal IP, and pinging the "external" zone resolves to the correct external address on the Internet.
It would seem like I'm all good to go, but when I try to turn on Open Directory and go through the setup prompts, I get the same "Confirm Settings" error as above.
The *only* way that I've come close to "fixing" this is to cancel out of the Profile Manager. Then, go destroy the open directory that already exists. Then create the domain via the Profile Manager enabling process. At present, this only seems work to for a "private" domain. Neither of the two Internet domain names that I've used successfully in the past work with this (or any) method.
Any advice or clues you can throw my way would be most appreciated.
Thanks,
Kim

Had the same problem found the answer here:
https://discussions.apple.com/thread/3264944?start=0&tstart=0

Help!! How to install and use Sun ONE Directory Server Resource Kit 5.2

Hi ! Friend:
I have some problem on install and use Sun ONE Directory Server Resource Kit 5.2, when I execute "java DSRK", afterwards something like this : com.iplanet.install.until.wbResource::gerstring:resource bundle"locale.resources.S1DSRKResource" not found appeared in the window ,that's why?
Meanwhile ,can you give some data about it on how to use it ?
Thank you !

You should be aware of the following characteristics of your directory when using this tool:
Size and number of entries.
Directory structure and access permissions.
Virtual attributes, class of service, and indexing.
Usage, types of access, and access patterns.
Post your error messages completely.
Thanks
--Britto

Directory Server 6.3.1 and Directory Server 7.0 agent module

Hello Folks-
I am having a strange issue with my directory servers. I had three directory server replicas and they were all on 6.3.1 installed with the zip distribution. One of the directory server was a vmware virtual machine running on Solaris Update 8 and after a power failure I could not start or recover the Virtual Machine itself. Long story short, I ended up installing a new DS with 7.0 version (with zip distribution). The installation went very smoothly, had no problems starting the server and creating an initial instance, top level baseDN, etc.
I somehow unregistered the older non-working Directory Server from first server's DSCC and wanted to include this new one. So in my Directory Servers tab in DSCC, I have all three listed like this: notice the third one
Server
ldap1:389
ldap2:389
ldap3:389 (server not registered)
So having the same host name and same instance, when I try to register an "existing server", I get the following error:
" The DSCC agent module is not registered on host ldap3. Verify that the agent module is installed using the command dsccsetup status on host ldap3. If the agent module is installed register it using the command dsccsetup cacao-reg"
So I went to the third host and did the following:
# dsccsetup status
DSCC Agent is registered in Cacao
Cacao uses a custom port number 21162
DSCC Registry has been created
Path of DSCC registry is /jes/ds/dsee7/var/dscc/ads
Port of DSCC registry is 3998
# dsccsetup cacao-reg
DSCC Agent is already registered.
So what is the problem? Why cant I register my new server and create replication agreements with the others?
Please let me know if you have more information
Thanks.
Deniz.

Anybody??? I really need help with this....

Changing IP Address and ports in Directory Server 5.1 SP 4 and 5.2 SP4

I have installed multiple instance of Sun Directory Server 5.1 and 5.2 on ports 389 and 390,now I want to change the IP Address and ports, I am able to change the directory server port from 389 by editing the dse.ldif file, now I want to change the port 390 and the IP address same as directory server, can someone expert from the forum guide me.
Thanks in Advance.
Mukesh Kumar

1) I don't know what you've typed in when installing... but I've never seen that message. Are you using any language specific characters ?
Do you get the error after this screen ?
<b>
The suffix is the root of your directory tree. You may have more than
one suffix.
Suffix [dc=sun,dc=com]:
</b>
If yes, then this means that the value you typed in is not a valid DN... and you must enter a valid one.
2)The Directory Server is installed under /usr/iplanet but the database is under /var/iplanet/ds5 and configuration is under /etc/iplanet/ds5 ...
You can use symbolic links if you want to move things around.
3) You mean you downloaded the tar.gx file of iDS 5.1 and install it on Solaris 9... No problem, I do this every day. As long as you have right to create directories and files, you should be able to install as anyone. If not, you should install as root and then let the server run as a special user.
4) Solaris 9 comes with iDS5.1 packages already installed. But the server is not configured at all.
Running directoryserver setup allows you to configure it and create the database, accounts...
Running directoryserver uninstall remove the instance of the installed database... It doesn't remove the packages. You can start again a setup...
By the way, I think that iDS 5.1 on Solaris 9 comes with the full documentation... May be you should start by reading it.
Regards,
Ludovic.

Messaging Server authenticate against directory server

Just wonder how to make messaging server authenticate against directory server? Basically I created users on the directroy server, and would like to let these users to access messaging server?
Thanks for advice!

I'm sorry, your question doesn't really make any sense.
Messaging Server always authenticates to users in a Directory.
How did you "create users"? That may be the problem. If you don't create the users with the provisioning tools provided with Messaging, then the users don't have the correct object classes and attributes to function as Messaging users.

Unable to use SSL between Access Manager and Directory Server

I am trying to set up Access Manager to use SSL when communicating with Directory Server. Access Manager 7 is running under Sun Web Server 6.1. I have configured Directory Server to use SSL using a Self-Signed CA and have imported the CA certificate into the certificate database for Web Server. When I change the Access Manager configuration as specified in the Admin Guide to use SSL and restart the Web Server, Access Manager fails with the message
(among many others)
netscape.ldap.LDAPException: SSL connection to
eauth1.arc.nasa.gov:636, SSL_ForceHandshake failed: (-8157) Certificate extension not found. (91); Cannot
connect to the LDAP server
I am able to connect to the Directory Server instanc with JXplorer using SSL (with a complaint about an unknown CA). Can someone explain the error message so that I can fix the problem or work around it?
Thanks

in the initial part of AMConfig.properties, you'll find an entry similar to trustSSLCerts . This, by default, is set to false. Trying setting it to true (AM web server instance will need a restart). This lets AM continue with SSL handshaking inspite of errors. Am not sure if this affects AM to DS connectivity as well. It sure affects AM to AM communication (in a multiple server configuration).
Naturally, it is not recommended that you use this feature when you are ready for production, but atleast it'll let you be sure that apart from the cert issue, everything else is okay.
Hope this helps.

Identity and Messaging Server 6

I've installed JES 2004Q2, Identity and Messaging Server 6 in Schema 2.
I may understand that identity provides managing user from Messaging. Where can i find a procedure to add and configure Identity to do that ?
Does Sun really not support this way to manage Messaging Users ?
Thanks.

Here are the main steps...
1.
Install JES from the installer with identity, mailserver, and commadmin (and the extra msg queue, LDAP etc that is required).
2.
configure mailserver and commadmin separately (config script in the software main directory). Probably best (if not required) to start with mail before commadmin...
3.
Administration is done with cmd util "commadmin" against identity server. There is also a sample service modules for mail that can be used in the web gui for user admin. This module is however NOT supported as Jay Plesset earlier said.
btw
the docs are much better now and describes this well.
/Per-Olov

Messaging server vs Directory Server

Hi everybody,
My system have 2 server, 1 is Iplanet messaging server 5.2 P2 and the other is Directory Server 5.2. Recent days, i could not check email and when checked for error i got this :
On directory server, run command netstat -an
10.12.0.6.10389 210.245.31.25.45571 49640 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.52754 49640 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.39489 48475 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.40364 49640 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.35518 49640 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.62958 49640 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.39052 48475 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.39936 49640 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.39947 48475 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.48198 49640 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.40819 48475 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.42586 48475 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.42592 49640 0 49640 0 ESTABLISHED
10.12.0.6.10389 210.245.31.25.44336 48475 0 49640 0 ESTABLISHED
Over 4000 sessions still in state ESTABLISHED (about 100 people use this mail server but not usually). So, i check the logs file (LDAP log file), i saw :
[01/Sep/2008:07:46:08 +0700] - DEBUG - conn=-1 op=-1 msgId=-1 - Listening for new connections again
[01/Sep/2008:07:46:08 +0700] - ERROR<12293> - Connection - conn=-1 op=-1 msgId=-1 - fd limit exceeded Too many open file descriptor
s - not listening on new connection
[01/Sep/2008:07:46:08 +0700] - DEBUG - conn=-1 op=-1 msgId=-1 - Listening for new connections again
[01/Sep/2008:07:46:08 +0700] - ERROR<12293> - Connection - conn=-1 op=-1 msgId=-1 - fd limit exceeded Too many open file descriptor
s - not listening on new connection
Did i reach to limitation of max-connection which this server allows ? Any ideas ?
Thanks

all4ims wrote:
My system have 2 server, 1 is Iplanet messaging server 5.2 P2 and the other is Directory Server 5.2. Recent days, i could not check email and when checked for error i got this :
On directory server, run command netstat -an
10.12.0.6.10389 210.245.31.25.45571 49640 0 49640 0 ESTABLISHEDWhat application is running on 210.245.31.25 that would require so many established connections to the directory server?
Over 4000 sessions still in state ESTABLISHED (about 100 people use this mail server but not usually). So, i check the logs file (LDAP log file), i saw :
[01/Sep/2008:07:46:08 +0700] - DEBUG - conn=-1 op=-1 msgId=-1 - Listening for new connections again
[01/Sep/2008:07:46:08 +0700] - ERROR<12293> - Connection - conn=-1 op=-1 msgId=-1 - fd limit exceeded Too many open file descriptor
s - not listening on new connection
[01/Sep/2008:07:46:08 +0700] - DEBUG - conn=-1 op=-1 msgId=-1 - Listening for new connections again
[01/Sep/2008:07:46:08 +0700] - ERROR<12293> - Connection - conn=-1 op=-1 msgId=-1 - fd limit exceeded Too many open file descriptor
s - not listening on new connection
Did i reach to limitation of max-connection which this server allows ? Any ideas ?You hit the maximum file-descriptor limit as the error points out. Remember that each TCP network connection consumes a file-descriptor.
At this point you have a few options:
1) Try to determine why there are so many active connections from the system 210.245.31.25 to the LDAP server and reduce them (e.g. restart the application holding open the connections, fix the application).
2) Increase the maximum number of file-descriptors for the system to allow for additional connections -- although this may just delay the problem from re-occurring if you don't address (1).
3) Restart the Directory Server to close the established connections. This is a short-term fix only.
Regards,
Shane.

Directory Server Replica and Messaging Server 6

Similar Messages

Maybe you are looking for