Linux and Solaris Clients with password policy using LDAP

Anybody managed to get Linux (RHEL) and Solaris 9 Client authenticate against Sun Directory Server 5.2p4 using the same password policy?
For me it looks like Linux needs attribute shadowlastchanged set to display proper Warnings, that the password will expire/needs to be changed now. On the other hand Solaris (using pam_ldap) never writes this attribute, because it's using the password policy attribute pwdchangedtime.
Hints very wellcome!
Can anybody confirm Solaris9 pam_unix still sets this shadow* attributes correct on any password change executed by a user?

Hi Jeremy,
here the answers to your questions:
>My question is which system takes precedence over the password policy?
Unfortunately there is no policy verification between the portal and your Sun One LDAP. So if you reset the password from the portal then only the portal password policies can be checked.
>  If I wanted to do password resets from the Portal, does the portal then store only the password in its database?
No, the password will be stored in the LDAP, but only if it also corresponds with the LDAP policies. If not, then you will get an error, but you will not see the real LDAP exception.
> Also what would then happen if you tried to reset the password from the LDAP?
The password in the LDAP does not have to fit to the Portal password policies. When you log in, the portal will only check if the password you tipped in is the new one in LDAP and will not check any policies.
Hope this brings some light in,
Robert

Similar Messages

  • Missing data in server monitor under linux and solaris

    Some metrics are not displayed in our environments, specifically under the statistics tab, request statistics, active coldfusion thread, we always have a zero line.  Also under memory usage, "cf threads by memory usage" is always empty.  I have all three buttons at the top checked so they are monitoring.  Is there something else I'm doing wrong?
    Environment 1 : dell2850->centos5->vmware->centos5->32bitJDK5->tomcat6->coldfusion8
    Environment 2 : sun5120->solaris10->64bitJDK5->tomcat6->coldfusion8
    I'm specifically wanting thread info to check if I should increase the defaults in CFIDE configuration.  Most everything on the server is being delivered faster now that we are using a 64bit JVM and have moved to solaris in production (from windows).  But there are some sections of our cfm logic that are taking much longer now (2000% longer)
    Thanks
    Ahnjoan

    Hi all,
    does anyone can write some info why java Threads are
    recorded in the list of process (ps -ef) when you run
    on a Linux box, but not the same when you run on
    Solaris ? Which Thread support is more
    performant/stable that on Linux or that on Solaris?
    Thanks
    FrancescoLinux treats kernell threads as light weight processes and displays them as if they are actual processes - they of course are not, so the results of 'ps' can be misleading. Solaris fully differentiates between its three concepts of threads, lightweight processes and processes and 'ps' only shows actual processes.
    Both implementations in Linux and Solaris perform well.
    By the way, Solaris 8 has an optional, slightly different thread model than earlier versions of Solaris (in fact it is more like NT's) and that can be more efficient for JVM's or other multithreaded systems running on SMP systems. It can also be worse - your mileage may vary.

  • I would like to buy a iPhone 4 unlocked from USA and take it with me to use it in Norway where I live is it gone work there? Thanks Melody

    I would like to buy a iPhone 4 unlocked from USA and take it with me to use it in Norway where I live is it gone work there? Thanks Melody

    Unlocked means unlocked, so yes.
    But, support and namely warranty coverage may not be available for you in Norway or anywhere but in the US with any iPhone purchased in the US, even an unlocked iPhone purchased in the US.

  • Function-Based Indexes (FBI) on Linux and Solaris

    I have a question about FBI on different systems (Linux and Solaris).
    ---- Oracle on Linux -----
    SQL> CREATE TABLE T_DUMMY(NAME VARCHAR(20));
    Table created.
    SQL> CREATE INDEX T_DUMMY_IDX ON T_DUMMY(UPPER(NAME));
    Index created.
    However, when I do the same on the Oracle running on Solaris, I get the following error:
    ---- Oracle on Solaris -----
    SQL> CREATE TABLE T_DUMMY(NAME VARCHAR(20));
    Table created.
    SQL> CREATE INDEX T_DUMMY_IDX ON T_DUMMY(UPPER(NAME));
    CREATE INDEX T_DUMMY_IDX ON T_DUMMY(UPPER(NAME))
    ERROR at line 1:
    ORA-01031: insufficient privileges
    I know that I have to add "QUERY REWRITE" in order to create a FBI. However, why Oracle on Linux behave differently. Would it be any difference/problem if I do NOT add "QUERY REWRITE" for Oracle on Linux (For example, would the EXPLAIN PLAN different)?

    general user settings are the same (privilege, role) Well, the specific settings must be different. I would check to see whether one of the roles has been granted the QUERY REWRITE system privilege on your Linux instance but not on Solaris.
    Cheers, APC

  • Linux and solaris version

    Hi all,
    What version of linux and solaris support oracle 11g(weblogic) , what is the difference between older versions and higher versions?
    Regards
    Srinivas kola

    Hi Francis,
    You can find the certification information here:
    http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html
    http://www.oracle.com/technetwork/middleware/downloads/fmw-11gr1certmatrix.xls
    Regards Peter

  • What do I need to install when I install oralce in linux and oracle client

    What do I need to install when I install oralce in linux and oracle client in windows?
    I want to connect oracle from windows to Linux, what do I need to install or setup? thanks.

    Are you trying to install the DB on Linux from your Windows Box? if so, you need to have an XWindows client on your client. You have to SSH or Telnet into the box, set your DISPLAY variable. In fact, it is all in your documentation for the DB install. We still don't understand what you are exactly asking.
    Do you have direct access to your Linux machine? If so, and it has a graphical GUI, then you can find install guides for most flavors of Linux at dizwell.com. His are most excellent and show examples, but do not go over the XWindows problem. You would have to resolve that first.
    A free XWindows environment for Windows is Cygwin.
    Once the DB is running on Linux then all you do is create a TNS entry on it on your client and it connects. It is the same as setting up a connection to connect to Oracle on a Windows box.

  • Radio button icons differ on Linux and Solaris

    I have a GUI made in Java swing with using version 1.4.2
    When I compile and run my GUI on linux the appearance is
    okay in linux but not on solaris and vice versa.
    I have a JPanel for which I have "null" layout I put some
    radio buttons with icons. And I use setbounds function to
    carry out absolute positioning.After I compile on linux and
    see the GUI the radio buttons appear fine but on solaris
    it is overlapped and the icons seem to be cut from below.
    I am not able to figure out whats the problem. I have tried
    taking smaller fonts, having more spacing between radio buttons.
    Note that only Radio buttons have this problem rest all the
    components are working fine with null layout and absolute
    positioning...
    I have also tried setHorizontalTextPosition etc...
    Please suggest something....
    Thanks in advance...
    Vips

    I have a GUI made in Java swing with using version 1.4.2
    When I compile and run my GUI on linux the appearance is
    okay in linux but not on solaris and vice versa.
    I have a JPanel for which I have "null" layout I put some
    radio buttons with icons. And I use setbounds function to
    carry out absolute positioning.After I compile on linux and
    see the GUI the radio buttons appear fine but on solaris
    it is overlapped and the icons seem to be cut from below.
    I am not able to figure out whats the problem. I have tried
    taking smaller fonts, having more spacing between radio buttons.
    Note that only Radio buttons have this problem rest all the
    components are working fine with null layout and absolute
    positioning...
    I have also tried setHorizontalTextPosition etc...
    Please suggest something....
    Thanks in advance...
    Vips

  • ASM 11.1.0.7.0 and RDBMS client with version (10.2.0.4)

    Hi all,
    we are trying to expand the space in our ASM. Using a RAC system with two instances.
    - ASM Version is 11.1.0.7.0
    - RDBMS client with version (10.2.0.4)
    Ad the time the ASM is rebalancing the database instances are going down.
    - The alert logs from ASM
    SQL> ALTER DISKGROUP ORADATA ADD DISK '/dev/mapper/1HITACHI_D60062610068-part1' SIZE 51199 M REBALANCE POWER 2
    WARNING: Deprecated privilege SYSDBA for command 'ALTER DISKGROUP ADD/DROP/REBALANCE'
    NOTE: Assigning number (2,2) to disk (/dev/mapper/1HITACHI_D60062610068-part1)
    NOTE: requesting all-instance membership refresh for group=2
    NOTE: initializing header on grp 2 disk ORADATA_0002
    NOTE: cache opening disk 2 of grp 2: ORADATA_0002 path:/dev/mapper/1HITACHI_D60062610068-part1
    NOTE: requesting all-instance disk validation for group=2
    Tue Oct 13 15:12:42 2009
    NOTE: disk validation pending for group 2/0x44480376 (ORADATA)
    Tue Oct 13 15:12:45 2009
    Tue Oct 13 15:12:45 2009
    WARNING: RDBMS client (SID1:SID,ÿ) with version (10.2.0.4.0) is not compatible with a pending operation
    NOTE: ASM client SID1:SID died unexpectedly.
    Alert Logs from DB Instance
    ORA-15064: error in comunication with ASM-Instance..
    Shutting down instance
    My question: Does anyone know if we face a bug ore some configuration issues ?
    THX ! Woo

    Hy Moo,
    My question: Does anyone know if we face a bug ore some configuration issues ?It seems to be some kind of problem in the disk group configuration. You can verify it querying compatibility and database_compatibility fields from v$asm_diskgroup view.
    As You should know, there are ASM new features that requires COMPATIBLE.ASM and COMPATIBLE.RDBMS attributes of the ASM diskgroup be set to at least Oracle 11.1. ( Fast Disk Resync is one example of it), maybe You are facing a configuration issue, not hitting a bug.
    Hope it helps,
    Cerreia

  • Cflogin and cfldap issue with passwords

    Hi everyone,
    I am using CFlogin and cfldap to authenticate users and I am
    having a problem.
    my cfldap query runs agains the server and uses the users
    username and password,
    well some users use special characters and certain special
    characters cause this error:
    An error has occured while trying to execute query :[LDAP:
    error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order
    to perform this operation a successful bind must be completed on
    the connection., data 0, vece�].
    Any ideas?
    Thanks
    Luma

    =======================================================
    SOLUTION / FIX / WORK-AROUND to
    ColdFusion <CFLDAP> exception DSID-0C090627
    ColdFusion version: "MX7"
    Assumption_01: ColdFusion server running on Windows-based
    operating system,
    (for me particularly, I am currently on a
    Windows-XP-Professional machine)
    Assumption_02: You are running your ColdFusion server as a
    DEVELOPER. Meaning you have logged onto your machine; you are doing
    research / development / experimentation ColdFusion as well as
    dealing with emails, etc.
    This means: LDAP will be dealing with Microsoft's "Active
    Directory"
    <cfldap
    name="ldap_Qry"
    action="QUERY"
    attributes="cn,department,memberof"
    start="dc=uconn,dc=edu"
    server="LDAP.MACHINE.ON.YOUR_NETWORK"
    username="[email protected]_NETWORK"
    password="#var_OperUserPassword#"
    filter="(&(objectclass=user)(sAMAccountName=#UCASE(var_target_UserId)#))"
    >
    note: the filter is whatever you are interested in.
    In my scenario, we were trying to figure out whether we could
    do away having to keep a USERS_TABLE in our database to do
    webApplication authentication and simply let Active_Directory do
    the authentication. Why have a seperate userId/Password pair for
    each and every webApplication on your intranet in addition to
    network security ?
    so #var_target_UserId#, for me was the input from a
    databasetable:[users.username]
    My educated guess on what the error means:
    * you have successfully reach the LDAP server
    * however before you will be allowed to perform your query,
    you need to provide authentication.
    * basically, LDAP server wants your username/password.
    So, if your MACHINE / NETWORK UserId is [johndoe],
    set #var_OperUser# to [johndoe]
    set #var_OperUserPassword# to MACHINE / NETWORK PASSWORD
    Speculation about PRODUCTION machines using LDAP query:
    Probably the PRODUCTION's machine UserId & Password would
    be used. This would allow the PRODUCTION machine to log onto the
    network, access databases and send out emails.

  • How to create PDF from Excel with Password Protection Using Visual Studio & Visual Basic

    Could someone provide some VB code sample(s) to create a PDF file with password protection (Security Method - Password Security - Restrict Editing & Printing)?
    I create a bunch of reports every week using an Excel 2010 addin that subsequently must be printed to PDF.  I then have to manually edit the properties of each document in order to apply the printing restriction.
    I'm using Acrobat X.
    I've downloaded the SDK but have no idea which dll's to use or where to begin.
    Thanks!
    Ross

    That's surprising & disappointing.  I would have thought that this capability would have long since been requested.
    Thanks for the heads up.

  • Clients with managed preferences using parallels

    If I use Mac OS X server to restrict which applications a user can access it causes a problem if they run parallels.
    Because although they can launch parallels application, they get a warning for each application running inside the virtual machine "The application xxxx is not allowed" and although the message can be dismissed and you can continue to use the application it is very annoying for the user.
    I am restricting allowed applications by folder in WGM and have tried adding /users/shared/parallels to the list of allowed folders but that didn't work.
    Does any one know if its possible to get this to work or do i have to turn off application restrictions?

    This isn't completely related to the issue, but has resolved it to some extent.
    I ran FS Eventer whilst attempting to open an application in the VM, and found that the file /private/var/root/Library/Preferences/com.parallels.desktop.plist was being written to. After looking at this file, I noticed that this was where the settings for the VM were stored. For example, Isolating the VM from OSX.
    I found that many values were duplicated 4-5 times, and had different values. Possibly causing some conflicts. So i manually changed these to all the same values to totally isolate the VM. After testing this did not seem to change the result.
    I then proceeded to see if the Shared Application folder was still being used (even though it shouldn't be due to the isolation) after deleting it I re-ran the VM and found that it was recreated when I tried to open an application, but only the applications I had tried opening were contained there, instead of the full list.
    I then proceeded to add access to this folder "~user/Applications/Windows 7 Applications" to the WGM allow list. Running the VM again after logging out and back in, I found that I could now use the Windows Apps fine. Although Internet Explorer still seemed to crash upon loading.
    One side note about IE, if I was to launch it from the OSX folder mentioned above, it launched within the VM and ran fine, allowing me to use it.
    This is really odd, as the setting to isolate the VM from the Host, should in theory, stop this applications folder from A) appearing, and B) running the contained apps connected to the VM.
    I have logged a bug report with Parallels to see if a resolution can be found to get this functionality working correctly. As I have used versions 4&5 without any issues, with identical VM setups (not including the Isolation as its not required)
    I would be interested to see if Kevin is able to try the above steps to see if he can get the same results. If you do, it may be worth filing a report with Parallels also, to bring this bug to their attention some more to get it fixed.
    Cheers, Chris

  • Help systems for Win, Linux, and Solaris

    Is there a flavor of RoboHelp that can generate
    cross-platform help? I would like to create a single Help system
    for Windows, Linux Redhat 4 ES, and Solaris 10.

    See http://forums.adobe.com/thread/1417974
    See www.grainge.org for RoboHelp and Authoring tips
    @petergrainge

  • Solaris 2.6 or 7 using LDAP Auth

    I know Solaris 8 support LDAP for Auth. However, there is some 3rd party applications which support in running on Solaris 2.6 only. The existing name service is NIS. Is there any solution for Solaris 2.6 using LDAP (Netscape Directory Server 4.1x) Auth??

    Jolene,
    The drivers are available free of charge at Openlink Software's
    web site - http://www.openlinksw.com. You should download the
    Multi-Tier components where JDK1.2 is your client platform and
    Oracle 7 is your database engine. This will involve an install
    on the client machine as well as the server, but will provide
    for maximum flexibility and performance down the road. You will
    simply need to point CLASSPATH on your client to the newly
    downloaded "opljdbc2.jar" file - the Openlink driver class
    archive.
    Best regards,
    Stephen
    Jolene (guest) wrote:
    : Hi,
    : Can anybody please tell me which driver I can use to connect to
    : an Oracle database(7.1) from a Java application running on
    : Solaris 2.6 using the 1.2 version of the JDK? Where can I get
    it
    : from and do I have to put it in a specific place?
    : Thanks in advance,
    : Jolene
    null

  • Can Kerberos Server 5 be run on Arch Linux and Windows Clients use it?

    Hi There,
    I was wondering (before I invested a great deal of time into it) if I could run a kerberos 5 server on my Arch box and get a Windows machine on my network to use it to log into Windows? (eg. like a domain)
    I've tried doing the same with Samba 4 (which I bet will be massive when it's eventually released!), but it doesn't really work too great at the moment and wondered if I could achieve what I wanted with Kerberos 5?
    I have DNS & DHCP already running and Samba 3 for network shares; but I really want the whole SSO package for all my machines. I know it's possible for my Mac Laptop to use Kerberos, but just not sure about Windows (XP/2003/7)
    Thanks,
    Tom

    I will post something when I get the last issues ironed out. There is very little information about this anywhere let-alone on Arch wiki! It has been a real struggle, shame Samba 4 isn't more stable/working.
    Stuff like M$ just decided to disable DES encryption by default in Windows 7. You know; the usual c**p-ness!

  • SCCM 2012 and Workgroup clients with PKI

    Hi
    When i trying to install cmm agent on a workgroup client, does anyone how to solve this porblem.
    I got this error
    Successfully started the ccmsetup service ccmsetup 2012-09-09 18:49:12 1720 (0x06B8)
    Deleted file C:\Windows\ccmsetup\ccmsetup.exe.download ccmsetup 2012-09-09 18:49:12 1720 (0x06B8)
    CcmSetup is exiting with return code 0 ccmsetup 2012-09-09 18:49:12 1720 (0x06B8)
    Running as user "SYSTEM" ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Detected 16269 MB free disk space on system drive. ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Wmi repository check passed. ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Ccmsetup is being restarted due to an administrative action. Installation files will be reset and downloaded again. ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Only one MP https://sc12-cm01.sc12labb.local is specified. Use it. ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Searching for DP locations from MP(s)... ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Unable to retrieve AD site membership LocationServices 2012-09-09 18:49:12 2020 (0x07E4)
    Local machine is not a member of an AD domain LocationServices 2012-09-09 18:49:12 2020 (0x07E4)
    DhcpGetOriginalSubnetMask entry point is supported. LocationServices 2012-09-09 18:49:12 2020 (0x07E4)
    Begin checking Alternate Network Configuration LocationServices 2012-09-09 18:49:12 2020 (0x07E4)
    Finished checking Alternate Network Configuration LocationServices 2012-09-09 18:49:12 2020 (0x07E4)
    Adapter {B30A0ADC-E759-4503-86BD-65C67731818F} is DHCP enabled. Checking quarantine status. LocationServices 2012-09-09 18:49:12 2020 (0x07E4)
    Sending message body '<ContentLocationRequest SchemaVersion="1.00">
      <AssignedSite SiteCode="PS1"/>
      <ClientPackage/>
      <ClientLocationInfo LocationType="SMSPACKAGE" DistributeOnDemand="0" UseProtected="0" AllowCaching="0" BranchDPFlags="0" AllowHTTP="1" AllowSMB="0" AllowMulticast="0" UseInternetDP="1">
        <ADSite Name=""/>
        <Forest Name=""/>
        <Domain Name=""/>
        <IPAddresses>
    <IPAddress SubnetAddress="192.168.10.0" Address="192.168.10.54"/>
        </IPAddresses>
      </ClientLocationInfo>
    </ContentLocationRequest>
    ' ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Sending message header '<Msg SchemaVersion="1.1"><ID>{64AC4B5B-D0A3-4DE2-8B81-E66638ABCE52}</ID><SourceHost>TEMPLATE-PC</SourceHost><TargetAddress>mp:[http]MP_LocationManager</TargetAddress><ReplyTo>direct:TEMPLATE-PC:LS_ReplyLocations</ReplyTo><Priority>3</Priority><Timeout>600</Timeout><ReqVersion>5931</ReqVersion><TargetHost>https://sc12-cm01.sc12labb.local</TargetHost><TargetEndpoint>MP_LocationManager</TargetEndpoint><ReplyMode>Sync</ReplyMode><Protocol>http</Protocol><SentTime>2012-09-09T16:49:12Z</SentTime><Body
    Type="ByteRange" Offset="0" Length="1036"/><Hooks><Hook3 Name="zlib-compress"/></Hooks><Payload Type="inline"/></Msg>' ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    CCM_POST 'https://sc12-cm01.sc12labb.local/ccm_system/request' ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Content boundary is '--aAbBcCdDv1234567890VxXyYzZ' ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Received header 'NoReply' ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Received reply body 'NoReply' ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    MP did not find any locations matching with the site version. ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    GetDPLocations failed with error 0x80004005 ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Failed to get DP locations as the expected version from MP 'https://sc12-cm01.sc12labb.local'. Error 0x80004005 ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Next retry in 10 minute(s)... ccmsetup 2012-09-09 18:49:12 2020 (0x07E4)
    Best regards Andreas

    Hi Jason
    I got the client in my sccm console right now at least.
    The Client certificate is PKI and Connection type is Always Internet, so far so good.
    But under Actions tab I only have Machine Policy Retrieval & Evalutation Cycle and User Policy Retrieval & Evalutation. I was to fast, everthing is there now.
    Thanks alot for your support Jason, I have used your startup script several times.
    Best regards
    Andreas 
    Best regards Andreas

Maybe you are looking for