White, Daniel E. (GSFC-770.0)[NICS] wrote: > We set roleContextDN to cn=nnmi-access > > > > And it still barfs, but I found stuff in the access log file: (redacted > a bit) > > > > [06/Dec/2019:12:49:18.055641820 +0000] conn=2805 fd=110 slot=110 > connection from NNMi-Server to IdM-Server > [06/Dec/2019:12:49:18.055983514 +0000] conn=2805 op=0 BIND dn="" > method=128 version=3 > [06/Dec/2019:12:49:18.056068589 +0000] conn=2805 op=0 RESULT err=0 > tag=97 nentries=0 etime=0.0000264910 dn="" > [06/Dec/2019:12:49:18.060407586 +0000] conn=2805 op=1 SRCH > base="cn=users,cn=compat,dc=lab,dc=PROJECT,dc=EXAMPLE,dc=ORG" scope=2 > filter="(uid=USER)" attrs="distinguishedName" > [06/Dec/2019:12:49:18.060803785 +0000] conn=2805 op=1 RESULT err=0 > tag=101 nentries=1 etime=0.0000453635
Right so the user is found, that's good. You should change the user search base from cn=compat to cn=accounts. Looks like it is doing an anonymous bind which is going to provide limited information. I'm pretty sure there is a way to configure a bind user for this but the how baffles me. > [06/Dec/2019:12:49:18.067812476 +0000] conn=2807 fd=128 slot=128 > connection from NNMi-Server to IdM-Server > [06/Dec/2019:12:49:18.068098286 +0000] conn=2807 op=0 BIND dn="" > method=128 version=3 > [06/Dec/2019:12:49:18.068165707 +0000] conn=2807 op=0 RESULT err=0 > tag=97 nentries=0 etime=0.0000161713 dn="" > [06/Dec/2019:12:49:18.071528890 +0000] conn=2807 op=1 SRCH > base="cn=nnmi_access" scope=2 > filter="(member=uid=USER,cn=users,cn=compat,dc=lab,dc=PROJECT,dc=EXAMPLE,dc=ORG)" > attrs="1.1" > [06/Dec/2019:12:49:18.071562192 +0000] conn=2807 op=1 RESULT err=32 > tag=101 nentries=0 etime=0.0000074662 The search base is cn=nnmi_access which doesn't exist but this shows us that whereever you configured this value should be cn=groups,cn=accounts,... so that's something. It will need to bind as a real user to get memberof though so that will need to be addressed too. > > This is what popped up in the access log this command was run on the > NNMi server: > > nnmldap.ovpl -diagnose USER So yeah it's nice that you have a tool to easily verify things. By poking at the config and using this tool and watching the logs you may be able to bang on it enough to get things to work. So basically you've gotten the user configuration mostly right you just need to get the group base configuration done and figure out how to specify a user to bind as. rob _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected]
