http://bugzilla.novell.com/show_bug.cgi?id=619549 http://bugzilla.novell.com/show_bug.cgi?id=619549#c1 Ralf Haferkamp changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO InfoProvider| |jsuchome@novell.com --- Comment #1 from Ralf Haferkamp 2010-07-02 16:07:09 CEST --- AFAIK kerberos-server creates the certificates by default. So all that's missing is telling ldap-client the correct location of the CA certificate (I guess). @jsuchome: How can that be achieved? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=619549 http://bugzilla.novell.com/show_bug.cgi?id=619549#c3 --- Comment #3 from Ralf Haferkamp 2010-07-06 11:50:03 CEST --- Hm the correct fix would probably be to write the correct settings to /etc/openldap/ldap.conf from the ldap-server module (The ldap-server module writes /etc/openldap/ldap.conf when using the UI wizward) . However I ran into a bit of a problem with that. 1. If I write /etc/openldap/ldap.conf using the etc.ldap_conf agent, even with flushing the caches Write(.src.ldap_conf, "force"), the kerberos-server module seems to ignore the values. I don't know exactly what it does but it just seems to be using the ldap-client/ldap modules. 2. The ldap-server module writes "host localhost" to the /etc/openldap/ldap.conf, but during the run of kerberos-server this is somehow changed to "host 127.0.0.1" which will break the certificate verification of libldap. Only when "localhost" is used libldap will try to figure out the real hostname for certificate verification. I have no idea where this change from localhost to "127.0.0.1" happens, it might be ldap-client or kerberos-server. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=619549 http://bugzilla.novell.com/show_bug.cgi?id=619549#c Ralf Haferkamp changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |615805 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=619549 http://bugzilla.novell.com/show_bug.cgi?id=619549#c6 Ralf Haferkamp changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|mc@novell.com |rhafer@novell.com --- Comment #6 from Ralf Haferkamp 2010-07-21 18:37:36 CEST --- I think I found the problem. Even after closing every connection the OpenLDAP library seem to only read /etc/openldap/ldap.conf on the first ldap_initialize/ldap_init call. yast2-ldap-server uses the ldap-agent before it wrote /etc/openldap/ldap.conf. And after than when yast2-kerberos-server calls Ldap->WriteNow() the file is not re-read. I think I can re-arrange yast2-ldap-server so that it calls into the ldap-agent after it wrote /etc/openldap/ldap.conf. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=619549 http://bugzilla.novell.com/show_bug.cgi?id=619549#c8 --- Comment #8 from Ralf Haferkamp 2010-07-22 13:50:54 CEST --- Created an attachment (id=377728) --> (http://bugzilla.novell.com/attachment.cgi?id=377728) proposed patch for yast2-kerberos-server -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=619549 http://bugzilla.novell.com/show_bug.cgi?id=619549#c9 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |meissner@novell.com --- Comment #9 from Marcus Meissner 2010-07-23 08:52:19 UTC --- yast2-kerberos-server submissionm still missing -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=619549 https://bugzilla.novell.com/show_bug.cgi?id=619549#c11 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:released:11.3:34687 --- Comment #11 from Swamp Workflow Management 2010-10-18 20:01:57 UTC --- Update released for: yast2-kerberos-server, yast2-ldap-server, yast2-ldap-server-debuginfo, yast2-ldap-server-debugsource Products: openSUSE 11.3 (debug, i586, x86_64) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=619549 https://bugzilla.novell.com/show_bug.cgi?id=619549#c12 --- Comment #12 from Bernhard Wiedemann 2011-04-11 11:55:17 CEST --- This bug (619549) was mentioned in https://build.opensuse.org/request/show/66789 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=619549 https://bugzilla.novell.com/show_bug.cgi?id=619549#c14 --- Comment #14 from Bernhard Wiedemann 2011-04-28 13:49:27 CEST --- This is an autogenerated message for OBS integration: This bug (619549) was mentioned in https://build.opensuse.org/request/show/67269 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=619549 http://bugzilla.novell.com/show_bug.cgi?id=619549#c16 --- Comment #16 from Bernhard Wiedemann --- This is an autogenerated message for OBS integration: This bug (619549) was mentioned in https://build.opensuse.org/request/show/42654 Factory / yast2-ldap-server https://build.opensuse.org/request/show/43734 11.3:Test / yast2-ldap-server https://build.opensuse.org/request/show/43816 11.3:Test / yast2-kerberos-server -- You are receiving this mail because: You are on the CC list for the bug.