<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> Good to know, thank you so much for your help. Everything is up and running now!<o:p></o:p> <o:p> </o:p> <div> Thanks,<o:p></o:p> Sara Kline<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Rich Megginson [mailto:rmeggins@redhat.com] Sent: Friday, May 18, 2012 9:04 AM To: Kline, Sara Cc: freeipa-users@redhat.com Subject: Re: [Freeipa-users] Problems with Passsync<o:p></o:p> </div> </div> <o:p> </o:p> On 05/18/2012 09:56 AM, Kline, Sara wrote: <o:p></o:p> Ldapsearch revealed the issue. The documentation in the Integrating AD section says that passsync is in the systemaccounts cn. Ldapsearch revealed it is actually sysaccounts cn. It is successfully binding now. I created a test user, then I logged in as him and changed his password, it took a while but the password was replicated over to FreeIPA and I was able to login using his credentials. Out of curiosity, does PassSync have a set polling period or is it supposed to sync anytime a change is made?<o:p></o:p> It is supposed to sync immediately. <o:p></o:p> <o:p></o:p> <div> Thanks,<o:p></o:p> Sara Kline<o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Rich Megginson [<a href="mailto:rmeggins@redhat.com">mailto:rmeggins@redhat.com</a>] Sent: Friday, May 18, 2012 8:16 AM To: Kline, Sara Cc: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] Problems with Passsync<o:p></o:p> </div> </div> <o:p></o:p> On 05/18/2012 09:11 AM, Kline, Sara wrote: <o:p></o:p> Yes, after installing PassSync I rebooted, and I have not changed any passwords in AD.<o:p></o:p> If you have not changed any passwords in AD, then the log is correctly reporting "No entries yet" <o:p></o:p> The bind dn I am using is the one that the documentation says to use which was:<o:p></o:p> uid=passsync,cn=systemaccounts,cn=etc,dc=prod,dc=example,dc=com. If I do an ipa user-find on this, it comes back empty but I am thinking its because this is not in with the regular user accounts. Is there a way to verify that the account is there?<o:p></o:p> ldapsearch -xLLL -D "cn=directory manager" -W -b dc=example,dc=com uid=passsync <o:p></o:p> <o:p></o:p> <div> Thanks,<o:p></o:p> Sara Kline<o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Rich Megginson [<a href="mailto:rmeggins@redhat.com">mailto:rmeggins@redhat.com</a>] Sent: Friday, May 18, 2012 7:34 AM To: Kline, Sara Cc: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] Problems with Passsync<o:p></o:p> </div> </div> <o:p></o:p> On 05/17/2012 04:10 PM, Kline, Sara wrote: <o:p></o:p> I was able to fix the import issue, and found some special SSL things for Server 2008 when you are wanting to run LDAP/SSL. So Pass Sync is no longer stating SSL is may not be setup correctly.<o:p></o:p> I am running into an issue however. These are the entries in the Pass Sync log file:<o:p></o:p> PassSync service is running<o:p></o:p> No entries yet<o:p></o:p> Did you reboot the AD box after installing PassSync? Have you changed any passwords in AD? <o:p></o:p> Ldap bind error in Connect 32: No such object<o:p></o:p> What is the bind DN you used when you configured PassSync on AD? Does that DN correspond to a real user DN in IPA? <o:p></o:p> Can not connect to ldap server in SyncPasswords<o:p></o:p> <o:p></o:p> <div> Thanks,<o:p></o:p> Sara Kline<o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: <a href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [<a href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Kline, Sara Sent: Thursday, May 17, 2012 11:06 AM To: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: [Freeipa-users] Problems with Passsync<o:p></o:p> </div> </div> <o:p></o:p> Replication is working great. When I create/delete an account on the AD server it shows up in FreeIPA, hoever I can’t get Passsync to work. I believe it is working because the last step in the documentation isn’t working. When I try to import the certificate, I get this message:<o:p></o:p> Certutil.exe: “unable to open “C:\Users\Administrator\Documents\ca.crt” for reading (-5950, 2). Any ideas?<o:p></o:p> <o:p></o:p> Sara Kline<o:p></o:p> System Administrator<o:p></o:p> Transaction Network Services, Inc<o:p></o:p> 4501 Intelco Loop, Lacey WA 98503<o:p></o:p> Wk: (360) 493-6736<o:p></o:p> Cell: (360) 280-2495<o:p></o:p> <o:p></o:p> <o:p></o:p> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.<o:p></o:p> <o:p></o:p> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. <o:p></o:p> <pre>_______________________________________________<o:p></o:p></pre> <pre>Freeipa-users mailing list<o:p></o:p></pre> <pre><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><o:p></o:p></pre> <pre><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p></pre> <o:p></o:p> <o:p></o:p> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.<o:p></o:p> <o:p></o:p> <o:p> </o:p> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.<o:p></o:p> <o:p> </o:p> </div> <hr> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. </body> </html>