<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Sprechblasentext Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;
mso-fareast-language:EN-US;}
span.E-MailFormatvorlage17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.E-MailFormatvorlage18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.E-MailFormatvorlage19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.SprechblasentextZchn
{mso-style-name:"Sprechblasentext Zchn";
mso-style-priority:99;
mso-style-link:Sprechblasentext;
font-family:"Tahoma","sans-serif";
color:black;
mso-fareast-language:EN-US;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Something more:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>On FreeIPA side there are built these errors too:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>[15/Mar/2012:10:02:02 +0100] encrypt_encode_key - [file ipapwd_encoding.c, line 451]: krb5_c_string_to_key failed [Invalid argument]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>[15/Mar/2012:10:02:02 +0100] ipapwd_gen_hashes - [file ipapwd_encoding.c, line 776]: key encryption/encoding failed<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D;mso-fareast-language:DE'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:DE'>Von:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:DE'> Bennet Lingner [mailto:b.lingner@zik.hs-anhalt.de] <br><b>Gesendet:</b> Donnerstag, 15. März 2012 10:34<br><b>An:</b> 'freeipa-users@redhat.com'<br><b>Betreff:</b> AW: Windows Password Synchronization Error<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>Hi,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Thank you for your reply.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Version of freeipa and 389 packages: <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Freeipa server, python, admintools, client, server-selinux all in 2.1.4-5.fc16.i686<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>389-ds-base-1.2.10.3-1.fc16.i686 + libs<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Platform is Fedora 16 3.2.9-2.fc16.i686.PAE on AMD Opteron CPU<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Ldapmodify and ipa passwd are working perfectly, I’ve changed password in this ways and passwords were synchronized.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>So I conclude the problem is specific to AD Passsync?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>If it is so, do I have the possibility on AD side too to set or try something?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Best regards.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Bennet Lingner<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:DE'>Von:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext;mso-fareast-language:DE'> Rich Megginson [mailto:rmeggins@redhat.com] <br><b>Gesendet:</b> Mittwoch, 14. März 2012 16:31<br><b>An:</b> Bennet Lingner<br><b>Betreff:</b> Re: Windows Password Synchronization Error<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On 03/14/2012 06:29 AM, Bennet Lingner wrote: <o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Dear Mr. Megginson,</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>I’ve seen in www, that you are very involved in 389 directory server, that’s why I decided to send this mail to you.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>I hope you can help me.</span><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>I’m running a WIN2K8 R2 64 bit and a fedora Linux 32 bit with freeipa.</span><o:p></o:p></p></blockquote><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:DE'>In the future, please use the <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> email list. Please also include the versions of your freeipa and 389 packages:<br>rpm -qa|grep freeipa<br>rpm -qa|grep 389<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>There is a win sync agreement, which works very well, even the passwords are synchronized.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>The only problem is that:</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>If I set a new password on windows side with more than 2 special characters, e.g. ‘!Mäusel 10’ or ‘!Rüdiger 20’</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Then I get the passsync error:</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>03/14/12 12:26:13: Ldap error in ModifyPassword</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> 1: Operations error</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>03/14/12 12:26:13: Modify Password failed for remote entry: uid=…</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>03/14/12 12:26:13: Deferring password change for …</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Do you have any idea, if that could be or something else, what can I do? </span><o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:DE'>What is your 389-ds-base version and platform?<br>Can you use ldapmodify to change the user password to one of the above values? Can you use ipa-passwd? That is, is the problem specific to AD PassSync, or is it a problem with these types of passwords in general? <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal>Best <span lang=EN-US>regards</span>.<o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'> </span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Mit freundlichen Grüßen</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'> </span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Bennet Lingner</span><o:p></o:p></p><p class=MsoNormal><b><span style='mso-fareast-language:DE'>Hochschule Anhalt </span></b><span style='mso-fareast-language:DE'>- ZIK</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'> </span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'><a href="mailto:b.lingner@zik.hs-anhalt.de">b.lingner@zik.hs-anhalt.de</a></span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Tel. +49 (0) 3496 67-5420</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Fax +49 (0) 3496 67-95420</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'>Bernburger Straße 55</span><o:p></o:p></p><p class=MsoNormal><span style='mso-fareast-language:DE'>06366 Köthen (Anhalt)</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-size:8.0pt;mso-fareast-language:DE'>Hochschule Anhalt (FH) * Bernburger Straße 55 * D 06366 Köthen<br>Präsident Prof. Dr. Dr. h.c. Dieter Orzessek * Tel.: +49 (0) 3496 67 1000 * Fax +49 (0) 3496 67 1099<br>Betriebsnummer 030 77 111 * Umsatzsteuernummer DE 8140 92 585<br>Zuständige Aufsichtsbehörde Kultusministerium des Landes Sachsen-Anhalt, PF 3765, 39012 Magdeburg</span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif";mso-fareast-language:DE'><o:p> </o:p></span></p></div></body></html>