Solaris8 LDAP & iPlanet Directory5.0SP1

Would you please help me to set up LDAP naming switch ?
attributeTypes: ( 1.3.6.1.4.1.42.2.27.5.1.15
NAME 'SolarisLDAPServers'
DESC 'LDAP Server address eg. 76.234.3.1:389'
EQUALITY caseIgnoreIA5Match
SYNTAX SolarisLDAPServerSyntax)
When I try to add the above attribute, start-slapd say as follows:
error code 21 (Invalid syntax) -
atribute type SolarisLDAPServers: Unknown attribute syntax OID "SolarisLDAPServerSyntax"
I couldn't add this attribute even if I tried to do so according to http://docs.sun.com. Is this Solaris client naming profile attribute correct or not ?
Could I describe not SolarisLDAPServerSyntax but IA5String ?

Thanks for your help. I've just add the attribute.
But I'd like to ask you more something regarding "ldapclient" utility. I couldn't initialize LDAP client machine by using ldapclient utility in spite of its nisDomainObject for DN dc=sample,dc=com. ldapclient utility shows me some message at the end . If you have any idea, would you please help me ?
Regards,
Satoshi
Just FYI# ldapclient -v -i -a none -b "dc=sample,dc=com" -d sample.com -D "cn=Directory Manager" -w "password" 127.0.0.1:389
findDN: calling_ns_ldap_default_config()
found 2 namingcontexts
findDN: nsldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=sample.com))
rootDN[0] dc=sample,dc=com
NOTFOUND:Could not find the nisDomainObject for DN dc=sample,dc=com
findDN: _ns_ldap_list(NULL, "(&(objectclass=nisDomainObject)(nisdomain=sample.com))
rootDN[1] o=NetscapeRoot
NOTFOUND:Could not find the nisDomainObject for DN o=NetscapeRoot
cannot find search base DN

Similar Messages

Include directive in iplanet 6.0SP1

If I have a include directive
<%@ page contentType="text/xml; charset=UTF-8" %>
in jsp then it loads up fine in iplanet 6.0SP1 and shows Japanese characters.
However when I have the same directive in some declare.jsp and include declare.jsp in another jsp file like:
<%@ include file='/declare.jsp' %>
then the webserver doesn't take the utf-8 encoding and doesn't process japanese characters correctly.
Is this bug fixed in later versions of iplanet? Any help is appreciated.
Thanks
Ravi

This doesn't seem to be an error. This is may be because the maximum characters they allow is 4096 and anything above it might be truncated. Check with Sun Support may be they have a better answer.

OptimizeIt 4.11 and iPlanet 6.0sp1

Hi,
has anyone successfully configured OptIt 4.11 to work with iPlanet 6.0sp1?
The instructions presented in iPlanet's documentation..
http://docs.iplanet.com/docs/manuals/enterprise/50/servlets/xprof.htm#22740
... are a bit vague, and the server simply refuses to start with absolutely
nothing in the error log. If I remove the -Xrunoii option, and replace it
with -Xbootclasspath/a:/usr/local/OptimizeItSuite/lib/oibcp.jar, the server
starts ok, but with the following error..
warning ( 1186): Attempt to start OptimizeIT failed (exception: unknown
exception,no description)
While starting the server, it does print out stuff from OptIt, so there must
be some kind of connection between them:
OptimizeIt Profiler 4.11 build 442 Audit System.
(c) 1997, 1998, 1999, 2000, 2001 VMGEAR.
Port is 1470
Although that port 1470 cannot be accessed as the OptIt didn't start
successfully.
Does this seem familiar to anyone?
cheers,
Juha

wryteralways wrote:
My software update wants to download and install 10.4.11, but I want to make sure my Appleworks 6.2.9 will still work before I install the update because I have no desire want so ever to move to iWorks etc. which are just far inferior to Appleworks for my uses.
The AppleWorks 6.2.9 Update will do absolutely nothing on your already installed AppleWorks 6.2.9.
Its task is to update old AppleWorks 6 versions (6.0 thru 6.2.8).
Yvan KOENIG (from FRANCE dimanche 3 août 2008 12:32:28)

LDAP(iPlanet & OID) Net Service

Hi There,
Is it possible to use iPlanet's LDAP for net service names lookup instaed of Oracle Names? Is there a way to extract the schema in OID and import into iPlanet ldap. If this could be done then NET8 should be able to connect to the directory server. Why I say this is: according to Oracle documentation, Net8 supports directory naming: "Service addresses and net service names can be stored in a Lightweight Directory Access Protocol -compliant directory server."
Has anyone done this?.
With the release of Orcale 9i Oracle is due to ship a product called Oracle Names LDAP
Proxy. Is there any information on this product.
All comments and suggestions are very welcome and appreciated
IP: Logged
John Tomlinson
([email protected])
unregistered
posted February 25, 2001 03:06 PM
Hello Pat:
As of release 8.1.7 you can use iPlanet as your name server. In the Net8 Admin guide
for 8.1.7, specifically chapter 6, there are detailed steps on how to accomplish this.
By the way, customers seaking to use OID as a replacement to their Oracle Names
server may do so for free. There is no extra lisencing required to use OID as your Oracle
Names replacement. You can find a copy of the Net8 Admin guide for 8.1.7 on the "Online Generic Documentation" CD for 8.1.7
Thanks,
Jay
IP: Logged
Pat Lehane
([email protected])
unregistered
posted March 06, 2001 08:54 AM
Hi Jay,
Thanks for the reply.
I installed NET 8.1.7 and am trying to connect to iPlanet LDAP through NET8
Configuration Assitant to create an Oracle schema in the in the iPlanet Directory Server
but I get an error as follows: configexception: Could not create Oracle schema:oracle.net.config.ConfigException
You must update the schema from a computer which directly supports your type of
directory There are still only three options in the directory server type in NET8 config assitant. Is there another way of creating the schema in iPlanet or is there some steps to be done in iPlanet first.
Regards
Pat

While any v3 LDAP server should work, and while some 816 users got Oracle and iPlanet to talk, there are compatability bugs between Oracle 817 and iPlanet. According to Oracle on 02/21/01 "Per bug 1377659 It's been decided that we will only certify against OID. iPlanet is no longer a tested configuration."
If they aren't testing it they probably aren't doing much else on it either.

How to change the DN of a user when provisioning to LDAP (iPlanet User)

When I provision a new user to iPlanet User (LDAP) resource, it creates the account with DN = uid=<user login>,ou=people,dc=test,dc=com
How can I change it so that it will create the account with DN = cn=<Fullname>, ou=people,dc=test,dc=com ?
I don't see the DN field defined in the iPlanet User form.

Is this a live environment? I would suggest setting this from the start, and not trying to change later. Most likely its using this prefix for both pre and post name so when you change it in the middle, one of them won't be found.
-Kevin

LDAP(iPlanet & OID) Net Service Names

Hi There,
Is it possible to use iPlanet's LDAP for net service names lookup instaed of Oracle Names?
Is there a way to extract the schema in OID and import into iPlanet ldap. If this could be done then NET8 should be able to connect to the directory server. Why I say this is: according to Oracle documentation, Net8 supports directory naming:
"Service addresses and net service names can be stored in a Lightweight Directory Access Protocol (LDAP)-compliant directory server."
Has anyone done this?.
With the release of Orcale 9i Oracle is due to ship a product called Oracle Names LDAP Proxy. Is there any information on this product.
All comments and suggestions are very welcome and appreciated
Regards
Pat Lehane

Hi Jay,
Thanks for the reply.
I installed NET 8.1.7 and am trying to connect to iPlanet LDAP through NET8 Configuration Assitant to create an Oracle schema in the in the iPlanet Directory Server but I get an error as follows:
configexception: Could not create Oracle schema:oracle.net.config.ConfigException
You must update the schema from a computer which directly supports your type of directory
There are still only three options in the directory server type in NET8 config assitant.
Is there another way of creating the schema in iPlanet or is there some steps to be done in iPlanet first.
Regards
Pat

Problem of buffer overflow in Iplanet 6.0sp1

Hi,
I am getting these following error messages in the logs
[30/Mar/2004:12:55:06] warning (19529): flex log buffer overflow- greater than 4096 characters
Also I am getting a error in logs like filename.ext is temporarly not available
I am not able to figure out why we are getting this error. If its a patch which needs to be put on the web server, then which patch I would be needing to install.
Nikhil

This has been answered before:
http://swforum.sun.com/jive/thread.jspa?forumID=16&threadID=19626
PS: 6.0sp1 is very old, perhaps you should consider upgrading to 6.0sp7 or 6.1sp1.
Thanks
Manish

NSAPI [iPlanet 6.0SP1] for WLS6.1 SP1

Hi,
I am trying to integrate iPlanet WebServer 6.0 SP1 with Weblogic6.1 SP1 but am
not able to get it up and running. I followed the documentation and able to get
the ststic HTML pages but am not able to get the JSP's and Servlets to work. Here
are the steps I followed, can anyone help me out.
Thanks in advance
Ravi
1. Copy “proxy36.dll” located in the “<weblogic_home>/bin”
directory to “<Netscape_Home>/Servers/Plugins/” directory.
2. Modify “Magnus.conf” file.
Add following two lines at the top of the file after the comments.
>Init fn="load-modules" funcs="wl-proxy,wl-init"\ shlib="C:/Netscape/Server4/plugins/proxy36.dll"
Init fn="wl-init"
3.Modify “obj.conf” file. Add the following lines
<Object name="weblogic" ppath="*/weblogic/*">
Service fn="wl-proxy" WebLogicHost=<IPAddress of WLS Server>WebLogicPort="Port#"
PathTrim="/weblogic"
</Object>
4.Apply changes and Stop/Start the iPlanet Server.
6.Create subfolder called “my_apps” under “<NETSCAPE_HOME>/docs/”.
Move the contents of the “<WEBLOGIC_HOME>/public-html/my_apps” folder
to this folder.
7.Modify “myapps.properties” located in “<WEBLOGIC_HOME>/MyDomain/myappsproperties”
and modify the “web_server_url” and “web_server_ip” to
indicate the URL of the webserver
web_server_url=http://<iPlanetHostname>:port/weblogic/
web_server_ip= http://<iPlanetHostname>:port
8. Restart WebLogic Server
9. Restart iPlanet Enterprise Server

Hi,
My previous request might have been misleading, i found that it is not just images that don't work but all the resources deployed in apache with the webconnector to iplanet do not work if there is a query string attached to it.
for eg., http://<host>/home/index.html?user=username does not work either.
Thanks
Prashanth Sukumaran.

Problem of overflow in Iplanet 6.0sp1

Hi,
I am getting these following error messages in the logs
[30/Mar/2004:12:55:06] warning (19529): flex log buffer overflow- greater than 4096 characters
I am not able to figure out why we are getting this error. If its a patch which needs to be put on the web server, then which patch I would be needing to install.
Nikhil

This doesn't seem to be an error. This is may be because the maximum characters they allow is 4096 and anything above it might be truncated. Check with Sun Support may be they have a better answer.

Iplanet LDAP Configuration in Portal

Hi All,
I was trying to configure my UME with LDAP - iplanet. (Sun one Directory Server) in SAP Netweaver CE. I downloaded the xml file using config tool.
1. dataSourceConfiguration_iplanet_readonly_db
2. dataSourceConfiguration_iplanet_not_readonly_db
3. dataSourceConfiguration_iplanet_deep_readonly_db
while one should i use? How do i know whether iplanet uses a deep or Flat Hierarchy? When i try to use the
dataSourceConfiguration_iplanet_not_readonly_db. on click of save changes, it gives me some "Technical error". But Validate connection in LDAP Server Properties is working fine.
"Test Connection successful".
But server not starting after restart. How else do i change the UME Configurationfrom Database to LDAP? What is the xml file to use? Is there some other configurations to be done?
Thanks,
Divya
Edited by: Divya V on Nov 19, 2010 10:23 AM

Hi Divya,
Try to contact the systems team who is responsible for maintaining the LDAP in your company. Then call tell you if you use deep or flat hierarchy.
The you need to decide if you want to connect to LDAP only for read only purposes or if you want to update any thing on the LDAP from the portal and have write access.
1. dataSourceConfiguration_iplanet_readonly_db - FOR READ ONLY ACCESS TO LDAP WITH FLAT HIERARCHY
2. dataSourceConfiguration_iplanet_not_readonly_db - FOR WRITEABLE ACCESS TO LDAP
3. dataSourceConfiguration_iplanet_deep_readonly_db - FOR READ ONLY ACCESS TO LDAP WITH DEEP HIERARCHY
You are getting the error when using dataSourceConfiguration_iplanet_not_readonly_db.xmL most likely because the system user that is used to connect to your LDAP might not have write access on the LDAP.
Also, please note that some LDAPs will require an SSL connection between portal and LDAP for writing any thing to the LDAP.
In that case, you will have to setup SSL between EP and LDAP.
Read the documentation for further help:
http://help.sap.com/saphelp_nw70ehp1/helpdata/en/48/d1d13f7fb44c21e10000000a1550b0/frameset.htm
Hope that helps !!
Thanks,
Shanti Mupkala

Oracle Portal for LDAP Authentication(Iplanet)

Oracle portal installed on Solaries machine and LDAP (iplanet) installed on windows NT machine.I am able to take ldif file from portal30 user and add to ldap.( under o=oracle tree)
Completed all step mentioned in document conf_ldap.pdf as follows
1. created library pointing to ssoxldap.so in portal30_sso schema
2. made change to listner.ora and tnsnames.ora file and able tnsping also.
- tnsping extproc_connection_data
3. ssoldap.sql also ran in portal30_sso schema with all LDAP information.
(like ----
Host: challasv
Port: 389
Search Base: cn=Login Server (portal30_sso),o=oracle
Unique Attribute: cn
Bind DN: cn=Portal Login
Bind Password: portal30
If I am try to login through browser in say Unexpected errors (WWC-41400). Is I am doing any thing wrong.
Also i am albe run ldapsearch from another machines working fine.user following command
- ldapsearch -b "cn=Login Server (portal30_sso),o=oracle" -h challasv -p 389 -D "cn=Poral Login" -w portal30 cn=portal30
my questions is Iplanet(LDAP) can integrate with Portal or any steps missed.
Please help in this regard,
Challa

You may want to use ssoxoid.pkb package that comes with Portal/Login Server 3.0.9 which simplifies the configuration.
Also, you will not have to run the external procdure listener. Please refer to the Login Server Admin. guide for more details.
NOTE:
the 3.0.9.8.0 version of ssoxoid.pkb is not good. You need to download 3.0.9.8.2 patch and get the ssoxoid.pkb file from there.
Also, you may want to turn on debug for SSO Server to see debug msg.
DEBUG
========
You need to loginto the Login Server schema and run following commands to see debug msg.
sqlplus portal30_sso/password
TO TURN ON DEBUG
1. Create debug proceure
CREATE OR replace PROCEDURE debug_print (str VARCHAR2) AS
PRAGMA autonomous_transaction;
BEGIN
INSERT INTO wwsso_log$ VALUES
(wwsso_log_pk_seq.nextval,
substr(str, 1, 1000),
sysdate,
dbms_session.unique_session_id
commit;
END debug_print;
show errors;
TO SEE THE DEBUG LOG
2. Try to login using portal login link
and see the error msg from the log table
select msg from wwsso_log$ order by id;
TO STOP THE DEBUG LOG
3. Delete the log
delete from wwsso_log$ ;
commit;
4. Turn off debugging
CREATE OR replace PROCEDURE debug_print (str VARCHAR2)
AS
BEGIN
null;
END debug_print;
show errors;

Ldap authentication not working for Solaris 8 host - Help!

Greetings folks,
I just recently migrated a host to use LDAP authentication. The only difference between this host and the rest of the hosts in the environment that I've converted to use LDAP is that this one is running Solaris 8.
Here's the steps I took to migrate it (though, I used the same steps for another Sol8 host in another environment and it works fine):
ldapclient -P stg -d mydomain.com -D cn=proxyagent,ou=profile,dc=mydomain,dc=com -w secret 192.168.1.69
My /etc/nsswitch.conf looks like this:
passwd: files ldap
group: files ldap
My /etc/pam.conf looks like this:
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth sufficient pam_unix_auth.so.1
login auth required pam_ldap.so.1
sshd auth requisite pam_authtok_get.so.1
sshd auth sufficient pam_unix_auth.so.1
sshd auth required pam_ldap.so.1
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth sufficient pam_unix_auth.so.1
other auth required pam_ldap.so.1
passwd auth sufficient pam_passwd_auth.so.1
passwd auth required pam_ldap.so.1
I've also cleared out the local user accounts for my human users, so there aren't any more passwd or shadow entries (yes, I ran pwconv). I also cleaned out the /etc/group entries for the same users. The machine appears to be configured properly, because I can run various DS commands that indicate this:
hostname# getent passwd user1
user1::1001:1001:User 1:/opt/home/user1:/bin/bash
hostname# ldaplist -l passwd user1
dn: uid=user1,ou=people,dc=mydomain,dc=com
shadowFlag: 0
userPassword: {crypt}(removed)
uid: user1
objectClass: posixAccount
objectClass: shadowAccount
objectClass: account
objectClass: top
cn: user1
uidNumber: 1001
gidNumber: 1001
gecos: User 1
homeDirectory: /opt/home/user1
loginShell: /bin/bash
However, in the end, actual logins to this host fail via ssh. Snooping the traffic reveals that all the right info is being handed back to the client, including the crypt'ed password hash, uid, etc. just like I see with other hosts that work.
Any ideas?
Thanks!
Patrick

I assume you have applied lastest kernel patch and 108993 to this Solaris8 machine, and its nss_ldap.so.1 and pam_ldap.so.1 are the same as the other Solaris8 LDAP clients that are working for ssh via LDAP auth.
1) Please replace "objectClass: account" with "objectClass: person", I know SUN ONE DS5.2 likes "person".
2) Did you test and verify telnet/ftp/su working? but SSH not working?
3) If telnet/ftp/su all worked, and SSH (SUN-SSH or OpenSSH), make sure you have "UsePAM yes" in sshd_config and restart sshd.
4) It is not a must I think but normally I will add "shadow: files ldap" to /etc/nsswitch.conf, restart nscd after that.
5) Whenever ldapclient command is run and ldap_cachemgr is restarted, I usually also restart nscd and sshd after that, if not testing result may not be accurate as nscd is still remembering OLD stuffs cached which could be very misleading.
6) You may use "ssh -v userid@localhost" to watch the SSH communications, on top of your usual "snoop"ing of network packets.
7) Use the sample pam.conf that is meant for pam_ldap from Solaris 10 system admin guide with all the pam_unix_cred.so.1 lines commented out. This works for me, there is no sshd defintions as it will follow "other".
http://docs.sun.com/app/docs/doc/816-4556/6maort2te?a=view
Gary

Using LDAP as security realm

Hi,
Our goal is to use LDAP(Iplanet Directory Server 5.0) as a security Realm
for Weblogic Personalization and Commerce 3.5.
Using the WLCS console, I've modified the config.xml file and following
elements are added:
<LDAPRealm AuthProtocol='simple' Credential='admin'
GroupDN='ou=groups,dc=netnumina,dc=com' GroupIsContext='false'
GroupUsernameAttribute='uniquemember'
LDAPURL='ldap://sanand.netnumina.com:389' Name='wlcsLDAPRealm'
Principal='uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot'
UserAuthentication='local' UserDN='ou=people,dc=netnumina,dc=com'
UserNameAttribute='uid'/>
<CachingRealm BasicRealm='wlcsLDAPRealm' CacheCaseSensitive='true'
Name='wlcsCachingRealm'/>
But when we try to restart the WLCS, it throws java exceptions that context
is not initialized and I get the following error
<Jun 15, 2001 3:41:28 PM EDT> <Emergency> <Server> <Unable to initialize the
ser
ver: 'Fatal initialization exception
Throwable: weblogic.security.ldaprealm.LDAPException: could not get
context - wi
th nested exception:
[java.lang.reflect.InvocationTargetException - with target exception:
[javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid
Credential
s]]]
weblogic.security.ldaprealm.LDAPException: could not get context - with
nested e
xception:
I tried using Windows NT as a security realm but that gave me errors too.
Does anyone has any experience using anything other than the default Realm?
Any help would be appreciated. Thanks!
Asim Raja
[email protected]

I'm not sure, but I suspect you can't
since this would create a circular dependency -
your realm would rely on the upper level security
checking calls but those calls would rely on your
realm.
My suggestion is to give it a try and see what
happens.
-Tom
Ozcan ADIYAMAN <[email protected]> wrote:
Hi ,
I am implementing a simple custom security realm using LDAP as the
security store and I can see the users, groups and acls from the admin
console.
My question is (a custom realm newbie question) ;
Is it possible to use weblogic.security.acl.Security with my custom
realm to check permissions, get the current user,etc.,
OR
is this class ONLY used with default realms (when ACL is stored in a
file) ?
Thanks
Ozcan

Configuration of LDAP through the Console

I am trying to create a customized object class to meet our specific needs on <b>LDAP - iplanet.</b> Everytime I try to add the customized object class to the users in an OU I get a message of Object class violation. I am not a programmer therefore I work out of the console.
I need help as I need to configure LDAP to receive HR data that is then going to be sychronized with our CUA master client for user creation.
Thanks in anticipation.
Pawan

Were you able to get the specific HR data sychronized with LDAP? We are working on this now and would like to know how you managed this task. THANKS

Via Heade not Work!! (6.0sp1)

Hi.
i used the http header that "Via".
but web server response "400" error into GET method.
i have that logs.
it's OK - sjs web 6.1sp6 on Windows. return code 200.
started....started....
WWWConnect::Connect("192.168.0.141","80")\n
IP = "192.168.0.141:80"\n
source port: 64654\r\n
REQUEST: **************\n
GET / HTTP/1.0\r\n
Via: test\r\n
Host: 192.168.0.141\r\n
Accept: */*\r\n
\r\n
RESPONSE: **************\n
HTTP/1.1 200 OK\r\n
Server: Sun-ONE-Web-Server/6.1\r\n
Date: Thu, 03 Jun 2010 08:23:01 GMT\r\n
Content-length: 461\r\n
Content-type: text/html\r\n
Last-modified: Sun, 31 May 2009 13:36:07 GMT\r\n
Accept-ranges: bytes\r\n
Connection: close\r\n
\r\n
<!DOCTYPE doctype PUBLIC "-//w3c//dtd html 4.0 transitional//en">\r\n
<HTML>\r\n
<HEAD>\r\n
<meta http-equiv="Content-Type"\r\n
\tcontent="text/html; charset=iso-8859-1">\r\n
\t<TITLE>Sun[tm] ONE Web Server, Enterprise Edition 6.1</TITLE>\r\n
</HEAD>\r\n
\r\n
<FRAMESET BORDER=0 ROWS="80, *">\r\n
<FRAME NAME="banner" SRC="banner.html" SCROLLING="no">\r\n
\t<FRAME NAME="content" SRC="launch.html" SCROLLING="auto">\r\n
</FRAMESET><noframes></noframes>\r\n
</HTML>\r\n
\r\n
WWWConnect::Close("192.168.0.141","80")\n
closed source port: 64654\r\n
finished.
it's not work . iplanet 6.0sp1 on solaris. return code 400.
started....
WWWConnect::Connect("192.168.0.71","80")\n
IP = "192.168.0.71:80"\n
source port: 64717\r\n
REQUEST: **************\n
GET / HTTP/1.0\r\n
Via: test\r\n
Host: 192.168.0.71\r\n
Accept: */*\r\n
\r\n
RESPONSE: **************\n
HTTP/1.1 400 Bad request\r\n
Server: Netscape-Enterprise/6.0\r\n
Date: Thu, 03 Jun 2010 08:23:18 GMT\r\n
Content-type: text/html\r\n
Content-Length: 147\r\n
Connection: close\r\n
Via: 1.1 AN-0003011042661574\r\n
\r\n
<HTML><HEAD><TITLE>Bad request</TITLE></HEAD>\n
<BODY><H1>Bad request</H1>\n
Your browser sent a query this server could not understand.\n
</BODY></HTML>
WWWConnect::Close("192.168.0.71","80")\n
closed source port: 64717\r\n
finished
why? 6.0 is not support via header?
any idea?
thk...

6.0 is out of support life. pl upgrade to 7.0 update 8 or above

Solaris8 LDAP & iPlanet Directory5.0SP1

Similar Messages

Maybe you are looking for