Novell eDirectory 8.8 SP3 for Linux, Solaris, and AIX

1.1.1 Linux

1.1.2 Solaris

1.1.3 AIX

2.1.1 No Port Conflict Checks for the Same Instance

With ndsconfig, during eDirectory configuration, if same port number is passed for different interfaces of the instance that is being configured, port conflict checking is not performed.

For example,

# ndsconfig new -o 1234 -L 1234 --config-file /home/user1/eDir/etc/nds.conf

In this command 1234 is passed as the port number for HTTP (-o) and LDAP TCP (-L) interfaces. ndsconfig does not check this conflict.

2.1.2 Error While Loading Shared Libraries: libstdc++.so.6

eDirectory installation fails if the libstdc++.so.6 library is not installed on SLES 9.

To resolve this issue, download this library from Recommended update for LSB.

2.1.3 SLP Interoperability Issues on OES Linux

OpenSLP implements SLPv2, but Novell SLP (NDSslp) on UNIX* and Windows* platforms implements SLPv1.

SLPv1 UAs do not receive replies from SLPv2 SAs, and SLPv2 UAs do not receive replies from SLPv1 SAs. That is, the clients with OpenSLP cannot see trees with NDSslp. Similarly, the clients with NDSslp cannot see trees with OpenSLP. For SLPv1 and SLPv2 to interact, you need to configure a DA that is running SLPv2.OES Linux ships with OpenSLP. However, eDirectory installed other UNIX platforms, such as Solaris and Red Hat Linux, might use NDSslp, which is shipped with eDirectory. Because of interoperability issues with the two versions of SLP, a tree advertised via OpenSLP multicast might not be visible to NDSslp and vice versa. To overcome this problem, you need to configure a DA that runs OpenSLP.

2.1.4 ldif2dib Fails to Open the Error Log File When the DIB Directory Exists In the Custom Path

ldif2dib fails to open the default log file, ldif2dib.log when the dib directory is relocated to a custom location.

To work around this issue, explicitly provide the log file location by using the -b switch.

2.1.5 eDirectory 8.8 SP3 Fails to Add SLES10 with a Firewall Enabled

While adding eDirectory 8.8 SP3 server from a SLES 10 host (or to SLES 10) to an existing tree running on different host, the process might fail to add the server if the firewall is enabled.

Enable SLP services and an NCP™ port (the default is 524) in the firewall to allow the secondary server addition.

2.1.6 ndsconfig Does Not Verify an Invalid Configuration File Path

To create the necessary configuration file, ndsconfig requires the full path and the configuration filename. When the same path name is passed for both the configuration file and the instance directory, ndsconfig cannot create the configuration file and aborts the operation.

2.1.7 NDS Server Does Not Start Automatically in the Virtual SLES 10

After adding packages, if you do not configure eDirectory by using YaST, you need to run the following command at the command line.

chkconfig -a ndsd

2.1.8 ndsd Does Not Start After a System Crash

In some situations, eDirectory services (ndsd) doesn't start after a system crash or a power failure. To start the eDirectory again, do the following:

2.1.9 ndsd Dumps the Core while Accessing the NDS Server

ndsd dumps the core in the dib directory of eDirectory because of a failed install while shutting down the server. This can be ignored because it does not corrupt data or disrupt services.

2.1.10 ndsd Might Fail to Start after Upgrading from eDirectory 8.7.3 SP7 to eDirectory 8.8.3 in OES 1.0 SP3

After the eDirectory upgrade, ndsd might fail to start automatically while rebooting the system.

To work around this issue, start ndsd manually.

2.1.11 eDirectory 8.8 SP3 Configuration Fails on RHEL 5.0

When you configure eDirectory on RHEL 5.0, it fails because libstdc++6.0 is automatically installed with Red Hat 5.0. Because the embox, pkiinst, and pkiserver modules are linked to libstdc++5, the incorrect compat library causes the eDirectory configuration to fail.

To work around this issue, manually install the compat-libstdc++-33-3.2.3-61.i386.rpm library.

2.1.12 eDirectory 8.8 SP3 64-bit SNMP Sub Agent Fails to Start on Red Hat 5.0

The eDirectory SNMP subagent fails to start while attempting to load libnetsnmpagent.so master agent module because it cannot resolve boot_DynaLoader symbol.

2.1.13 Do not Execute ndstrace With All Tags Enabled on UNIX Systems

With all tags enabled, ensure you do not run ndstrace on the following:

2.1.14 LDAP is Not RFC Compliant For Anonymous Search Requests

If a client performs an unauthenticated search operation when anonymous binds are disabled, the LDAP server responds with the bind result of inappropiate authentication instead of the search result, operationsError.

2.1.15 nds-install Script Fails if eDirectory Installation is Aborted on AIX

If eDirectory installation is stopped midway, the fileset might be installed, but in an uncommitted state. This fileset must be removed completely to reinstall eDirectory.

Use the following command to clean the fileset:

installp -ug <fileset>

Example: installp -ug NDS.NDSserv

2.1.16 Cannot install eDirectory 88 SP3 64-bit on Red Hat 5.X

Installation fails because eDirectory 8.8 SP3 64-bit nds-install script looks for libstdc++.so.6 and libstdc++.so.6.0.8 libraries in 32-bit path instead of 64-bit path.

To install eDirectory 8.8 SP3 successfully:

2.1.17 Incorrect libccs2.so Path Might Cause eDirectory Configuration Error on Red Hat 5.0

You might get the following error while configuring eDirectory.

ndsconfig: error while loading shared libraries: libccs2.so

To resolve this issue, run the following command to point the libccs2.so link to the correct path at /opt/novell/usr/lib64/libccs2.so.

ln -s /opt/novell/usr/lib64/libccs2.so /usr/lib64/libccs2.so

2.3.1 Uninstallation Fails if Installation Was Not Successfully Completed

If eDirectory installation fails, nds-uninstall can't remove eDirectory.

To resolve this, install eDirectory again in the same location and then uninstall it.

2.3.2 nds-uninstall -s option Fails to Retain Configuration and DIB Files

You must not use -s option to retain the nds.conf and the DIB. Ensure you backup them before performing nds-uninstall operation.

2.4.1 Duplicate Files Created after Upgrading from eDirectory 8.8.2 to eDirectory 8.8.3

After upgrading eDirectory, the new configuration files get .new extension. If there are any changes to these files, they can be absorbed in your files.

2.4.2 Upgrading OES1 / SLES9 Servers from eDirectory 8.7.3.x to eDirectory 8.8.x Fails When IDM 3.x is Installed

When you run ndsconfig upgrade, the following error message displays:

n4u_send_command failed.

To work around this issue: Ensure you reinstall IDM before executing ndsconfig upgrade.

For more information on upgrading to eDirectory 8.8.3, refer to the Upgrading to eDirectory 8.8.3.

2.4.3 Upgrading Simple Password Bind from an Older Version to 64-bit 8.8.3 Version

After upgrading eDirectory from 32-bit to 64-bit, ensure you update NMAS Simple Password method, for simple password binds to work.

If you are installing simple password method for the first time, do the following:

2.4.4 ndsstat Shows Wrong eDirectory versions

When eDirectory is upgraded to 8.8.3 version by stopping ndsd on Linux and Solaris, ndsstat shows incorrect product version.

To work around this issue, restart ndsd. It shows proper eDirectory versions in ndsstat.

You can restart or stop the server and then run ndsconfig upgrade command to get the correct eDirectory version.

2.5.1 Default Instance Path

While configuring the second instance of eDirectory on your host, you are prompted for the default path. Select a different path and proceed.

2.5.2 Troubleshooting Ports with Custom eDirectory 8.8 Instances

In eDirectory 8.8, if you configure a new instance in a custom location when the default instance server is down, it takes the default instance ports. The default instance does not come up, because the ports of the default instance are alloted to the custom location instance.

Follow the procedure in Troubleshooting Ports with Custom eDirectory 8.8 Instances before rebooting the host.

2.5.3 Rebooting the Host

Only the default instance created through using the default instance binaries is started after reboot.

You can set the paths and use ndsmanage to start the other instances.

2.5.4 ndsd Not Listening at the Loopback Address on a Given NCP Port

When you have more than one eDirectory instance, the second instance and subsequent instances try to listen at the default 524 port instead of the NCP™ port on the loopback address.

To work around this issue, set the n4u.server.tcp-port parameter of the second instance to the port that it is supposed to listen on. The n4u.server.tcp-port parameter is located in the nds.conf file.

2.6.1 Schema

The LDIF file should mention all the object classes that an entry belongs to. You should also include the classes that an entry belongs to because of inheritance of classes. For example, an entry of type inetOrgPerson has following syntax in the LDIF file:

2.6.2 ACL Templates

Objects that are bulkloaded with the ldif2dib utility are not added with ACLs that are specified in the ACL templates for the object class of the object.

2.6.3 Signal Handler

You can temporarily suspend the offline bulkload operation by pressing the s or S key. You can use Escape key (Esc) to stop the bulkload operation.

2.6.4 Options

On Linux, if the -b option is used, the statistics display menu disappears after the bulkload is complete.

2.6.5 Ldif2dib Might Fail to Upload Objects Beyond Several Millions on RHEL 5.0

When you attempt uploading millions of objects to eDirectory using ldif2dib, and the checkpoint interval is explicitly specified, the operation might halt with an error stating that the directory is full.

To work around this issue, skip the checkpoint interval (Use -i option with ldif2dib command).

2.16.1 Browsing for Objects Containing Double-Byte Characters in iMonitor

When using iMonitor to browse an eDirectory tree for objects, an object with double-byte characters in the name might not correctly hyperlink to the object properties.

2.16.2 Agent Health Check on a Single-Server Tree

The Agent Health check feature in iMonitor shows a Warning icon in the Results column when run on a single server tree because of the Perishable Data status. This does not mean that the tree is not healthy or that the Agent Health check is not working as designed. Perishable Data indicates the amount of data that has not yet been synchronized to at least one replica. A single server tree, by its nature, means that the data is always at risk for catastrophic failure because there is no other place that the data is replicated. If you lose the hard disk, you lose the data.

If you don't want to view health check warnings about Perishable Data or Readable Replica Counts on your single server tree, you can turn off these health checks by editing the ndsimonhealth.ini file to change the following entries:

perishable_data-active: OFF

and

ring_readable-Min_Marginal: 1 or ring_readable-active: OFF

This turns off the warnings for Readable Replica Count and Perishable Data.

2.16.3 iMonitor Report Does Not Save the Records for Each Hour

The custom reports feature in iMonitor is designed to place the URL specified by the user into the saved report (the saved HTML file) when the custom report is created. That means that when you open a saved custom report that has been run, you see the live (current) data instead of the data captured by the URL at the time the custom report is run. This issue will be resolved in a future release of iMonitor.

2.16.4 Creation and Modification Time Stamps

Because UNIX platforms do not maintain the creation time of a file, iMonitor shows both the creation and modification times to be the same.

2.16.5 iMonitor Issues in Older versions of Mozilla

Using Mozilla versions earlier than 1.5 for iMonitor might have problems during DSTrace Flag selection. Mozilla might not support all the operations.

2.16.6 Run Report Screen Layout Not Aligned on iMonitor

The navigation and assistant frames appear twice on Linux and Solaris.

To work around this problem, refresh the page.

2.17.1 Errors While Starting the NDS Subagent

The subagent can fail with the following message:

Unable to load library: libnetsnmp.so

To resolve this, export the environment variable SNMP_MAJOR_VERSION with the net-snmp library’s (libnetsnmp.so) major version number. For example,

export SNMP_MAJOR_VERSION=10

2.17.2 Restarting ndssnmpsa

When the master agent is restarted on Solaris and Linux, ndssnmpsa needs to be restarted.

To restart ndssnmpsa, stop ndssnmpsa and then start it again.

To stop ndssnmpsa, enter the following:

To start ndssnmpsa, enter the following:

2.17.3 Errors While Starting ndssnmpsa

When you start ndssnmpsa on UNIX, you might get the following errors:

Error: eDirectory SNMP Initialization component. Error code: -168

Error: eDirectory SNMP Initialization component. Error code: 9

To resolve this:

2.17.4 Errors While Stopping ndssnmpsa

When ndssnmpsa is stopped on SLES 9, an error message similar to "*** glibc detected *** double free or corruption (!prev): 0x0819cdd0 *** " is displayed on the screen.

You can ignore these messages.

2.18.1 Configuring Encrypted Replication through iManager

You cannot configure encrypted replication through iManager if any server in the replica ring is down.

2.18.2 Viewing or Modifying Encrypted Attributes through iManager

If an attribute of an object is encrypted, you cannot view or modify the object by using iManager 2.5.

To work around this issue, you can view or modify the encrypted attribute over a secure channel, using any of the following methods:

Alternatively, you can turn off the secure channel required option for viewing or modifying the encrypted attributes by disabling the requireSecure attribute in the EA policy. This makes the object and the encrypted attributes accessible by any client over clear text channel. After this, iManager will be able to access the object.

2.18.3 Merging Trees With Encrypted Replication Enabled Fails

When encrypted replication is enabled, merging trees fails. Disable secure replication on each tree before doing a merge.

2.18.4 Limber Displays -603 Error

Limber displays the -603 error if the server has only sub-ref replica of the encrypted attribute policy partition.

To work around this issue, do any one of the following:

2.19.1 LDAP Operations Fail After Creating a New LDAP Group Using Quick Create

Quick Create only creates an LDAP group object with dummy attributes that you can later modify. It creates the LDAP Group object with version one instead of nine. Therefore, all the LDAP operations fail as it is not possible to associate any LDAP server due to version incompatibility.

To work around this issue, after creating the LDAP group using Quick Create, change the LDAP Group object version number to nine.

2.19.2 Issues While Backing Up on Red Hat EUC in the Japanese Locale

You might have problems while backing up by using iManager on Red Hat EUC in the Japanese locale. The fix for this issue will be available with iManager 2.6.

2.20.1 Running ndsrepair on an NFS Mounted DIB on Linux

You might get -732 or -6009 errors while trying to run the ndsrepair operations on an NFS mounted DIB on Linux systems.

2.20.2 Running ndsrepair with -R Option Hangs

After you enable encrypted attributes on indexed attributes, if you run ndsrepair with the -R option, it hangs.

2.21.1 GSSAPI With Multiple User Objects

If multiple user objects are associated with the same Kerberos principal name, the user or client must specify the bind DN.

2.21.2 Authorization ID

RFC2222 specifies support for an authorization ID sent by the user and client. This is not supported by the SASL GSSAPI method.

2.23.1 Clone DIB Fails With -601 and -603 Errors

When encrypted attributes and encrypted replication is enabled at the tree level, clone DIB fails with the following errors:

To work around these issues, disable encrypted attributes and encrypted replication.

2.23.2 Clone DIB Can Fail Immediately After Offline Bulkload

If you try taking the clone of a server immediately after an offline bulkload, it might result in a failure, if the bulkload has been done with the disable indices option.

However, this is not an issue if the dibclone is initiated a few hours after the bulkload completion.

2.23.3 Issue in Cloning with Enabled Encrypted Replication Feature

While cloning with the Encrypted Replication feature enabled on the source server, modify the ER policy to temporarily exclude the cloned server. This can be changed after the configuration of the cloned server is complete.

2.24.1 dsbk Configuration File Location

The dsbk.conf file is located in /etc instead of the location relative to the specific instance of eDirectory.

2.24.2 dsbk Usability Issue

When you use dsbk from the command line, if the temporary file location is not mentioned in the /etc/dsbk.conf file, it gives script errors.

3.3.1 iManager

3.3.2 NMAS 3.3.0

For NMAS information, refer to the NMAS online documentation.

3.3.3 Certificate Server 3.3.1

For Certificate Server information, refer to the Certificate Server online documentation.

3.3.4 NICI 2.7.4

For NICI information, refer to the NICI online documentation.