From Fedora Project Wiki

Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 16: Line 16:


The following cast of characters will be available testing, workarounds, bug fixes, and general discussion ...
The following cast of characters will be available testing, workarounds, bug fixes, and general discussion ...
* Development - Jan Zeleny ([[User:jzeleny|jzeleny]]), Jan Vcelak ([[User:jvcelak|jvcelak]]), Rich Megginson ([[User:rmeggins|rmeggins]])
* Development - Jan Zeleny (jzeleny), Jan Vcelak (jvcelak), Rich Megginson (rmeggins)
* Quality Assurance - Ondrej Moris ([[User:omoris|omoris]])
* Quality Assurance - Ondrej Moris (omoris)


== Prerequisite for Test Day ==  
== Prerequisite for Test Day ==  


# '''Fedora 14''' (or Rawhide) system
# Fedora 14 system with openldap and openldap-clients packages (openldap-servers for testing the server)
# <code>openldap</code> and <code>openldap-clients</code> packages
 
# optionally for testing server: <code>openldap-servers</code> package
{{admon/important|FIXME|Are specific versions required?  For example, anything newer than {{package|openldap|openldap-2.4.22-7.fc14}} }}
# at least one application from [[#Packages_list|package list]] below
 
# at least one of following applications installed:
 
{{admon/important|FIXME|Provide a list of applications}}


== Packages list ==
== Packages list ==


<div style="float:left;margin-right:20pt">
{{admon/important|Package list is not final|The list is of packages is complete, however assignment of the priorities is not final.}}


===== Priority 1 (the most important) =====
===== Priority 1 (the most important packages) =====


{|
{|
Line 38: Line 41:
|-
|-
| openldap-clients
| openldap-clients
| omoris
|  
| {{result|pass}}
|  
|-
|-
| openldap-servers
| openldap-servers
| omoris
|  
| {{result|pass}}
|  
|-
|-
| am-utils
| am-utils
Line 54: Line 57:
|-
|-
| autofs
| autofs
| jvcelak
|  
| {{result|pass}}
|  
|-
|-
| krb5-workstation
| krb5
|  
|  
|  
|  
|-
|-
| nss_ldap
| nss_ldap
| omoris
|  
| {{result|pass}}
|  
|-
|-
| nss-pam-ldapd
| nss-pam-ldapd
| omoris
|  
| {{result|pass}}
|  
|-
|-
| openssh
| openssh
| mvadkert
|  
| {{result|pass}}
|  
|-
|-
| pam_ldap
| pam_ldap
| omoris
|  
| {{result|pass}}
|  
|-
|-
| python-ldap
| python-ldap
| jvcelak
|  
| {{result|pass}}
|  
|-
|-
| ruby-ldap
| ruby-ldap
| alich
|  
| {{result|pass}}
|  
|-
|-
| sssd
| sssd
| shanks
|  
| {{result|pass}}
|  
|-
|-
| sudo
| sudo
| alich
|  
| {{result|pass}}
|  
|-
|-
| libuser
| libuser
| mvadkert
|  
| {{result|pass}}
|  
|-
|-
| nfs-utils-lib
| nfs-utils-lib
Line 102: Line 105:
|-
|-
| quota
| quota
| mvadkert
|  
| {{result|pass}}
|  
|-
|-
|}
|}
</div>
<div style="float:left;margin-right:20pt">


===== Priority 2 =====
===== Priority 2 =====
Line 134: Line 134:
|-
|-
| curl
| curl
| ksrot
|  
| {{result|pass}}
|  
|-
|-
| dhcp
| dhcp
Line 146: Line 146:
|-
|-
| httpd
| httpd
|
|
|-
| ipa
|  
|  
|  
|  
Line 170: Line 174:
|-
|-
| php
| php
| jgorig
|  
| {{result|pass}}
|  
|-
|-
| postgresql
| postgresql
Line 178: Line 182:
|-
|-
| proftpd
| proftpd
| jgorig
|  
| {{result|pass}}
|  
|-
|-
| pure-ftpd
| pure-ftpd
Line 186: Line 190:
|-
|-
|}
|}
</div>
<div style="float:left;margin-right:20pt">


===== Priority 3 =====
===== Priority 3 =====
Line 257: Line 258:
|  
|  
|-
|-
| &nbsp;
|
|
|-
| &nbsp;
|
|
|}
|}
</div>
<div style="float:left;margin-right:20pt">


===== Priority 4 =====
===== Priority 4 =====
Line 281: Line 272:
|-
|-
| apr-util
| apr-util
|
|
|-
| ipa
|  
|  
|  
|  
Line 336: Line 323:
|  
|  
|-
|-
| &nbsp;
|
|
|-
| &nbsp;
|
|
|}
|}
</div>
<div style="float:left;margin-right:20pt;border:none">


===== Priority 5 =====
===== Priority 5 =====
Line 388: Line 365:
|-
|-
| gnupg2
| gnupg2
|
|
|-
| kdesvn
|  
|  
|  
|  
Line 425: Line 398:
|}
|}


</div>
===== Priority 6 (the least important packages) =====
<div style="float:left;margin-right:20pt">
 
===== Priority 6 (the least important) =====


{|
{|
Line 444: Line 414:
|-
|-
| kdepimlibs
| kdepimlibs
|
|
|-
| kdesvn
|  
|  
|  
|  
Line 472: Line 446:
|-
|-
|}
|}
</div>
<hr style="clear:both;border:none;" />
== Testing environment ==
=== Update your machine ===
If you're running Fedora 14, make sure you have all the current updates for it installed, using the update manager.
=== Kickstart / Live DVD ===
We recommend the testing to be done in virtual machine, using a Fedora 14 network install as installation medium.  Boot and installation images are available ([http://download.fedoraproject.org/pub/fedora/linux/releases/test/14-Beta/Fedora/i386/iso/Fedora-14-Beta-i386-netinst.iso i386], [http://download.fedoraproject.org/pub/fedora/linux/releases/test/14-Beta/Fedora/x86_64/iso/Fedora-14-Beta-x86_64-netinst.iso x86_64])
If you want to download Live medium, we have two LiveCDs available for you [http://kparal.fedorapeople.org/testdays/2010-10-14_OpenLDAP_NSS/ here].
These images contain LiveCDs with shortcuts to IRC and this wiki page. They also have all Priority 1 programs pre-installed in case you want to test one of them.
=== Available testing servers ===
{{admon/note|You can use your server|You don't have to use our testing servers. Feel free to configure yours, we provide [[#OpenLDAP_server_2|nice step by step guide.]]}}
{{admon/warning|Test OpenLDAP with MozNSS primarily|Please, use mainly openldap03. The other servers are only for reference, to reveal possible behavior changes.}}
{{admon/caution|Test Day is over|The servers are no longer available.}}
{|
! server !! service !! package version || base DN
|-
| openldap01.fedoraproject.org || OpenLDAP + OpenSSL || openldap-servers-2.4.21-11.fc13.x86_64 || dc=silver,dc=testday
|-
| openldap02.fedoraproject.org || 389 Directory Server || 389-ds-base-1.2.7.a1 || dc=example,dc=com
|-
| '''openldap03.fedoraproject.org''' || OpenLDAP + MozNSS ||  openldap-servers-2.4.22-7.fc14.x86_64  || dc=gold,dc=testday
|}
Download [http://jvcelak.fedorapeople.org/testday-101014/cacert.pem OpenLDAP Testday CA certificate] (PEM format). Certificates of testing servers are signed by this CA.
==== Accessing our servers ====
* You can use anonymous bind for '''read only''' access.
* For '''read-write''' access use bind name ''cn=Tester,dc=silver,dc=testday'' and password ''openldap''. Subtree ''ou=free,dc=base,dc=testday'' is ready for your experiments. Please create some organization unit with your name under it, not to conflict with other testers. (Don't forgot to replace dc=silver correctly for other servers.)
(read-write access is now set up for openldap02 - use the cn=Tester user)


== How to test? ==
== How to test? ==


Choose one of applications in the list above and mark it on this page by adding your name into "Taken by" column. Perform some testing. Below is a table of features what might be tested. The table lists common OpenLDAP based applications and the TLS options used. The table lists some features which are supported by <code>ldap.conf</code> file. If your application uses OpenLDAP and is able to configure it to use TLS/SSL, you will probably have similar configuration options.
Choose one of applications in the list above and mark it on this page by adding your name into "Taken by" column. Perform some testing. Below is a table of features what might be tested. The table lists common OpenLDAP based applications and the tls options used. The table lists some features which are supported by ldap.conf file. If your application uses OpenLDAP and is able to configure it to use TLS/SSL, you will probably have similar configuration options.
 
You can use our [[#Available_servers|prepared LDAP server]] for your testing.
 
==== Example configurations ====
 
===== OpenLDAP command line tools =====
 
* Application: <code>ldapsearch</code>, <code>ldapmodify</code>, et. al.
* Default config file: <code>/etc/openldap/ldap.conf</code>, <code>~/.ldaprc</code>
* Manual page: ldap.conf
* [[#Libldap|Step by step configuration]]
 
Use the -Z (prefer TLS) or -ZZ (require TLS) command line options to use StartTLS with ldap:// URIs.


* Application: OpenLDAP command line tools - ldapsearch, ldapmodify, et. al.
* Default config file: /etc/openldap/ldap.conf, ~/.ldaprc
* see man ldap.conf for more information
* Use the -Z or -ZZ command line option to use StartTLS with ldap:// URIs
{|
{|
! Config option !! Description !! Example
! Config option !! Description !! Example
Line 565: Line 487:
|}
|}


===== OpenLDAP server =====
* Application: OpenLDAP server
 
* Default config file: /etc/openldap/slapd.d/cn=config.ldif
* Default config file: <code>/etc/openldap/slapd.d/cn=config.ldif</code>
* see man slapd-config for more information
* Manual page: slapd-config
* Use the -Z or -ZZ command line option to use StartTLS with ldap:// URIs
* [[#OpenLDAP_2|Step by step configuration]]
 
Use the -H command line option to have slapd listen for LDAPS requests (e.g. slapd -H ldaps://hostname ....)
 
{|
{|
! Config option !! Description !! Example
! Config option !! Description !! Example
Line 601: Line 519:
|}
|}


For OpenLDAP server, we also need to test server-to-server interactions that use TLS. For example, test replication from a server using Mozilla NSS to another server using OpenSSL using LDAPS or StartTLS. Try a back-ldap or back-meta configuration using TLS/SSL.
For OpenLDAP server, we also need to test server-to-server interactions that use TLS. For example, test replication from a server using Mozilla NSS to another server using OpenSSL using LDAPS or StartTLS. Try a back-ldap or back-meta configuration using TLS/SSL.
 
===== pam_ldap/nss_ldap =====
 
* Default config file: <code>/etc/ldap.conf</code>
* Manual page: nss_ldap


* Application: pam_ldap/nss_ldap
* Default config file: /etc/ldap.conf
* see man nss_ldap for more information
* Use the -Z or -ZZ command line option to use StartTLS with ldap:// URIs
{|
{|
! Config option !! Description !! Example
! Config option !! Description !! Example
Line 644: Line 561:
|}
|}


=== Finishing test ===
You can use our prepared LDAP server for your testing:
 
TODO: server details (probably won't be available until the test day begins)


After you perform testing, it is important to report results. A special section '''Test Results''' is available. Here you should write: what program have you tested, what was tested (i.e. what tests were performed) and what was the result. After you fill this report, please add a mark into "Notes" column in package list:
After you perform testing, it is important to report results. A special section '''Test Results''' is available. Here you should write: what program have you tested, what was tested (i.e. what tests were performed) and what was the result. After you fill this report, please add a mark into "Notes" column in package list:
* {{result|pass}} in case everything was ok
* {{result|warn}} in case there was probably something wrong
* {{result|fail}} in case the test failed
In latter two cases a description what went wrong should be available in '''Test Results''' section.


{| border="0"
=== '''Update your machine''' ===
|-
| {{result|pass}} || in case everything was ok
|-
| {{result|warn}} || in case there was probably something wrong
|-
| {{result|fail}} || in case the test failed
|}
 
In the latter two cases a description of what went wrong should be available in [[#Test Results|Test Results]] section below.


== Step by step configurations ==
If you're running Fedora 14, make sure you have all the current updates for it installed, using the update manager.
 
=== Libldap  ===
 
{{admon/note|Many applications uses libldap setting|This describes how to setup trusted certificate authorities. Server certificates signed by these will be accepted. If you want to do testing with our testday servers, you will have to add at least our CA certificate.}}
 
There are more possibilities of configuring trusted CAs. The easiest way is probably using TLS_CACERTDIR directory (<code>/etc/openldap/cacerts</code> in this example) with certificate files in PEM format.<br />
You can do it your way - may the force (<code>man ldap.conf</code>) be with you. Directory with MozNSS cert database, and one bundle CA file are supported as well.
 
# install OpenLDAP client tools to have some simple tool for your configuration testing: <code>yum install openldap-clients</code>
# you need hash for each certificate, you can use <code>c_hash</code> tool:
#* run: <code>/etc/pki/tls/misc/c_hash /path/to/cert.pem</code>
#* you should get something like: ''537ced62.0 => /path/to/cert.pem''
# create symlink in CA certs directory:
#* <code>ln -s /path/to/cert.pem /etc/openldap/cacerts/537ced62.0</code>
# repeat previous steps for each CA you trust
# make sure, all certificates are readable for all users trough created symlinks
# update <code>/etc/openldap/ldap.conf</code>
#* add: TLS_CACERTDIR /etc/openldap/cacerts
#* optionally, you can set up default server (URI) and search base (BASE)
 
If you have a lot of certificates, you can use <code>c_rehash</code> tool from openssl-perl package.
 
=== OpenLDAP server ===
 
{{admon/warning|Usual mistakes|Do not leave any empty lines in OpenLDAP server configuration files (everything in <code>/etc/openldap/slapd.d</code>).<br />
No olcTLS* option must be the last line in your database configuration or your server will not start (bug #641946), possible workaround is adding one extra line with comment (starting <code>#</code>).}}
 
Quick help: <code>man slapd-config</code>
 
# install OpenLDAP server: <code>yum install openldap-servers</code>
# choose and set your server base DN, e.g. ''dc=copper,dc=testday''
# generate admin (manager) user password hash:<br/><code>slappasswd</code>
# update /etc/openldap/slapd.d/cn=config/olcDatabase={1}bdb.ldif
#* olcSuffix: dc=copper,dc=testday
#* olcRootDN: cn=Manager,dc=copper,dc=testday
#* olcRootPW: <admin-user-password-hash>
# update /etc/openldap/slapd.d/cn=config/olcDatabase={2}monitor.ldif
#* olcAccess: {0}to *  by dn.base="cn=manager,dc=copper,dc=testday" read  by * none
# start your server: <code>service slapd start</code>
# try your serve functionality
#* <code>ldapsearch -H ldap://localhost -x -b "" -s base "(objectclass=*)" namingContexts</code>
#* you should get: <code>namingContexts: dc=copper,dc=testday</code>
# create base nodes
#* download example [http://jvcelak.fedorapeople.org/testday-101014/root_copper.ldif root DN nodes] (LDIF)
#* update DNs in that file
#* import that file into the database: <br/><code>ldapadd -H ldap://localhost -x -D "cn=Manager,dc=copper,dc=testday" -W -f root.ldif</code>
# install BDB configuration file
#* <code>cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG</code>
# restart your server: <code>service slapd restart</code>
# '''your server is now configured and running without TLS'''
# generate certificates for your server (if you don't have any), we offer you [[#Generating_certificates|step by step guide]]
# update <code>/etc/openldap/slapd.d/cn=config.ldif</code>, add following options (customised):
#* olcTLSCACertificateFile: /etc/openldap/certs/cacert.pem
#* olcTLSCertificateFile: /etc/openldap/certs/server.pem
#* olcTLSCertificateKeyFile: /etc/openldap/certs/server.pem
# make your certificates readable for <code>ldap</code> user
# enable at least ldaps:// interface in <code>/etc/sysconfig/ldap</code>:
#* SLAPD_LDAP=yes (default)
#* SLAPD_LDAPS=yes
#* SLAPD_LDAPI=yes (optional)
# restart your server: <code>service slapd restart</code>
# '''your server is running with TLS support'''
# test that your configuration is working
#* without TLS: ldapsearch -x -H ldap://localhost -b "dc=copper,dc=testday"
#* with TLS: ldapsearch -x -H ldaps://localhost -b "dc=copper,dc=testday"
 
=== Generating certificates ===
 
===== Use your own CA =====
 
There are more possibilities. The easiest way is installing '''TinyCA''' GUI, which will handle everything you need. You need not perform this task on your testing system.
 
# install TinyCA: <code>yum install tinyca2</code>
# create new certification authority
# create new certificate request
#* select 'Requests' tab
#* right-click into the emtpy list of requests and select 'New Request'
#* use pre-filled values, set 'Common Name' to match your server hostname
#* set some pass-phrase (which will be removed anyway)
#* click 'OK'
# sign the certificate request
#* right-click on the certificate request and select 'Sign Request', 'Sign Request (Server)'
#* you will be prompted for CA password
#* signed certificate will appear under 'Certificates' tab
# export your key + certificate for server
#* open 'Keys' tab
#* right click on appropriate key and select 'Export'
#* select export location (file)
#* Export Format: PEM
#* Without Passphrase: Yes
#* Include Certificate (PEM): Yes
#* click 'Save', provide your certificate pass-phrase password
# export your CA certificate
#* open 'CA' tab
#* click on 'Export CA' icon in toolbar
#* set filename, select PEM format and click on 'Save'
# configure your server to use your key and certificate
# configure your server and any clients to use/accept your CA
 
===== Use our public sub CA with TinyCA =====
 
# download [http://jvcelak.fedorapeople.org/testday-101014/testday-public-ca.tar.gz public testday sub CA]
# move the file into <code>~/.TinyCA</code>
# extract the file: <code>tar xf testday-public-ca.tar.gz</code>
# CA is ready, use it in TinyCA<br />CA password is: ''openldap''
# you have to add this CA certificate onto server
## append it to your olcTLSCACertificateFile (really file, not option in config)
## or use olcTLSCACertificatePath instead of olcTLSCACertificateFile


===== Other ways =====
=== '''Kickstart / Live DVD''' ===


* [http://www.openldap.org/pub/ksoper/OpenLDAP_TLS.html OpenLDAP TLS guide] (can be used as well)
TODO: prepare a kickstart which might be used to install minimal Fedora 14
TODO: post here a link to download section in case testers want to install F14 from DVD


== Test Results ==
== Test Results ==
Line 788: Line 595:




'''[omoris] Tested program: openldap-servers-2.4.22-7.fc14.i686 openldap-clients-2.4.22-7.fc14.i686'''
[[Category:Test Days]]
* executed upstream self-test included in source rpm
[[Category:QA Templates]]
* all passed
 
'''[ksrot] Tested program: curl-7.21.0-5.fc14.x86_64'''
* tried the query LDAP database using following commands:
curl 'ldap://openldap03.fedoraproject.org/dc=gold,dc=testday??sub'
curl --cacert /etc/testday/cacert.pem 'ldaps://openldap03.fedoraproject.org/dc=gold,dc=testday??sub'
curl 'ldap://openldap01.fedoraproject.org/dc=silver,dc=testday??sub'
curl --cacert /etc/testday/cacert.pem 'ldaps://openldap01.fedoraproject.org/dc=silver,dc=testday??sub'
* output looked fine
 
'''[jvcelak] Tested program: openldap-2.4.23-1.fc15.x86_64 openldap-2.4.21-10.fc13.x86_64'''
* reported bug #641946 (slapd init script gets stuck in an infinite loop)
* OK: CA signed certificates (now used on silver and bronze)
* OK: sub-CA signed certificates (now used on gold)
* OK: referral chasing with TLS (tested including loops)
* OK: Ldap backend with TLS, works as a proxy (tested including loops)
* OK: self-signed certificates
* OK: delta-syncrepl with TLS
** verification with OpenSSL fails when connecting to localhost (host name doesn't match)
** verification with MozNSS works well when connecting to localhost or hostname
** verification with MozNSS fails when using certificate and hostname doesn't match
* MozNSS error messages often miss explanation (like -8172 Unknown error)
 
'''[mvadkert] Tested program: openssh-5.5p1-21.fc14.2.x86_64'''
* omoris and jvcelak added openssh.scheme and a test user
* tested with ssh-ldap-helper
root@freedom openldap]# /usr/libexec/openssh/ssh-ldap-helper -vvv -f /etc/openldap/ldap.conf -s user2
debug1: Reading configuration data /etc/openldap/ldap.conf
debug3: === Configuration ===
debug3: URI ldaps://openldap03.fedoraproject.org
debug3: Host openldap03.fedoraproject.org
debug3: Port 636
debug3: SSL Yes
debug3: Ldap_Version 3
debug3: Base ou=omoris,ou=free,dc=gold,dc=testday
debug3: BindDN cn=Tester,dc=gold,dc=testday
debug3: BindPW openldap
debug3: Scope Sub
[snip]
debug1: LDAP do connect
debug3: Set TLS CA cert dir /etc/openldap/cacerts
debug3: Set TLS check peer to 1
debug3: LDAP initialize ldaps://openldap03.fedoraproject.org
[snip]
debug3: LDAP search scope = 2 (&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=user2))
ssh-rsa 
AAAAB3NzaC1yc2EAAAABIwAAAQEAsDA+I14oBeVd7ceujknbvc3i2Qfnx2Q1vPatRcwPfWLF2H4fPUuUypkJjswvJXxZun+7h1tNpZPMvKCxMLNph4follk35MXT01LZYtW3rs3bdYL+9vBO7ns1+MDrrusotM3f+j90VhPVn5MhgPABVAaSVoTGn058d/N/R1pMMvnRrKhBYlLG0Yb4WesvJQCL9GkbPqjn7tWZQNbDqnIA/TgYe87ES7rsC8ZFObSYYhWXJqnYb8ysQRVLTRUxE/EzYWM0YUIuYIN9eRzUJW9rFmlVDalUjzwIK6dkhkl4xN3vX5lSL3OCJlwIxUoQLK2P9fEvbPlxd9IRSQNWFJO2HQ==mvadkert@dhcp-lab-118.englab.brq.redhat.com
debug2: LDAP process user finished
debug1: LDAP do close
debug2: LDAP do close OK
 
'''[jvcelak] Tested program: python-ldap-2.3.12-1.fc15.x86_64'''
 
* not tested very deeply, basic operations work:
#!/usr/bin/python
import ldap
import ldap.modlist as modlist
l = ldap.initialize("ldaps://openldap03.fedoraproject.org", trace_level = 1)
l.simple_bind_s("cn=Tester,dc=gold,dc=testday", "openldap")
ldif = modlist.addModlist({
"objectClass" : [ "organizationalUnit", "top" ],
"ou" : [ "jvcelak" ],
})
l.add_s("ou=jvcelak,ou=free,dc=gold,dc=testday", ldif)
print l.search_s("dc=gold,dc=testday", ldap.SCOPE_SUBTREE, "(cn=Manager)")
l.delete_s("ou=jvcelak,ou=free,dc=gold,dc=testday")
l.unbind_s()
 
'''[mvadkert] Tested program: libuser-0.56.18-2.fc14'''
* tested all libuser commands - found bug in lpasswd #643022
* generally works well after good setup in /etc/libuser.conf
 
'''[omoris] Tested program: pam_ldap-185-5.fc14'''
* tested password change, ssh connection, password change via ssh connection
* no problems, works fine
* testes via beakerlib using already prepared testcases
 
'''[omoris] Tested program: nss_ldap-265-6.fc14 & nss-pam-ldapd.i686 0:0.7.7-1.fc14 '''
* tested getent, id of ldap users
* no problems, works fine
* testes via beakerlib using already prepared testcases
 
'''[mvadkert] Tested program: quota-3.17-13.fc14.x86_64'''
* mail stored in surname in LDAP user, quota works as expected with ldaps :)
 
'''[amarecek] Tested program: sudo-1.7.4p4-3.fc14.x86_64'''
* rights escalation with ldap users only
* rights escalation with local users and ldap groups
* rights escalation with ldap users containing white spaces (also "su" tested)
* rights escalation with ldap groups containing white spaces
 
'''[jgorig] Tested program: php-ldap-5.3.3-1.fc14.x86_64'''
* basic operations works
<?php
$conn = ldap_connect("openldap03.fedoraproject.org");
if(!$conn) exit(ldap_error($conn));
$ret = ldap_start_tls($conn);
if(!$ret) exit(ldap_error($conn));
$r = ldap_bind($conn, "cn=Tester,dc=gold,dc=testday", "openldap");
if(!$r) exit(ldap_error($conn));
$data["objectClass"][0] = "organizationalUnit";
$data["objectClass"][1] = "top";
$data["ou"] = "Testovac";
ldap_add($conn, "ou=Testovac,ou=free,dc=gold,dc=testday", $data);
$sr = ldap_search($conn, "dc=gold,dc=testday", "ou=Testovac");
print_r(ldap_get_entries($conn, $sr));
ldap_delete($conn, "ou=Testovac,ou=free,dc=gold,dc=testday");
ldap_close($conn);
 
'''[amarecek] Tested program: ruby-1.8.7.302-1.fc14.x86_64, ruby-ldap-0.9.7-10.fc12.x86_64'''
* simple connection works
#!/bin/env ruby
require 'ldap'
_host = 'openldap03.fedoraproject.org'
_port = 389
_binddn = 'cn=Tester,dc=gold,dc=testday'
_bindpw = 'openldap'
_base = 'ou=alich,ou=free,dc=gold,dc=testday'
connection = LDAP::Conn.new(_host, _port)
connection.bind(_binddn, _bindpw)
connection.perror("bind")
scope = LDAP::LDAP_SCOPE_SUBTREE
attrs = ['dn', 'cn']
items = ['posixAccount', 'posixGroup']
items.each { |item|
        filter = "(objectClass=#{item})"
        begin
                connection.search(_base, scope, filter) { |record|
                        print "DN: #{record.dn}\n"
                        print "ATTRS: #{record.attrs}\n"
                        print "\tCN: #{record.vals('cn')}\n"
                        print "#{record.to_hash}\n"
                }
        rescue LDAP::ResultError
                connection.perror("search")
                exit 1
        end
        connection.perror("search")
}
connection.unbind
* all data were found successfully
 
'''[jvcelak] Tested program: autofs-5.0.5-31.fc15.x86_64'''
* reported bug #643045 (outdated autofs.schema in openldap-servers)
* automounter connects to LDAP server with TLS (ldap:// + requiretls, ldaps://)
* automountMap successfully found
* referring to another server using ldap:server:dn works
* volumes mounted as expected
 
'''[shanks] Tested program: sssd-1.3.0-35.fc14.x86_64
* Not tested deeply, basic operation of LDAP ID and auth works:
[sssd[be[LDAP]]] [get_server_status] (7): Status of server 'fed14sssdldap.gsr.pnq.redhat.com' is 'working'
[sssd[be[LDAP]]] [be_resolve_server_done] (4): Found address for server fed14sssdldap.gsr.pnq.redhat.com: [10.65.201.183]
[sssd[be[LDAP]]] [sdap_connect_send] (4): Executing START TLS
[sssd[be[LDAP]]] [sdap_ldap_connect_callback_add] (9): New LDAP connection to [ldap://fed14sssdldap.gsr.pnq.redhat.com:389] with fd [26].
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xe9d210], connected[1], ops[0xe7e280], ldap[0xea1220]
[sssd[be[LDAP]]] [sdap_connect_done] (3): START TLS result: Success(0), Start TLS request accepted.Server willing to negotiate SSL.
[sssd[be[LDAP]]] [fo_set_port_status] (4): Marking port 389 of server 'fed14sssdldap.gsr.pnq.redhat.com' as 'working'
[sssd[be[LDAP]]] [set_server_common_status] (4): Marking server 'fed14sssdldap.gsr.pnq.redhat.com' as 'working'
[sssd[be[LDAP]]] [ldb] (9): tevent: Added timed event "ltdb_callback": 0xec7d50
[sssd[be[LDAP]]] [ldb] (9): tevent: Added timed event "ltdb_timeout": 0xec78c0
[sssd[be[LDAP]]] [ldb] (9): tevent: Destroying timer event 0xec78c0 "ltdb_timeout"
[sssd[be[LDAP]]] [ldb] (9): tevent: Ending timer event 0xec7d50 "ltdb_callback"
[sssd[be[LDAP]]] [find_password_expiration_attributes] (9): No password policy requested.
[sssd[be[LDAP]]] [simple_bind_send] (4): Executing simple bind as: uid=puser1,ou=People,dc=example,dc=com
[sssd[be[LDAP]]] [simple_bind_send] (8): ldap simple bind sent, msgid = 2
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xe9d210], connected[1], ops[0xec79e0], ldap[0xea1220]
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: ldap_result found nothing!
[sssd[be[LDAP]]] [sdap_process_result] (8): Trace: sh[0xe9d210], connected[1], ops[0xec79e0], ldap[0xea1220]
[sssd[be[LDAP]]] [simple_bind_done] (5): Server returned no controls.
[sssd[be[LDAP]]] [simple_bind_done] (3): Bind result: Success(0), (null)
 
 
'''[jgorig] Tested program: proftpd-1.3.3b-1.fc14.x86_64'''
* user authentication works
* [http://www.mustuniversityaccreditation.com Mustuniversity]
* [http://www.aboutmustuniversity.com Must University]
 
[[Category:Fedora 14 Test Days]]
Please note that all contributions to Fedora Project Wiki are considered to be released under the Attribution-Share Alike 4.0 International (see Fedora Project Wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To edit this page, please solve the following task below and enter the answer in the box (more info):

Cancel Editing help (opens in new window)