Jivespace: Message List - Re-synch with LDAP

Re: Re-synch with LDAP

communities@jivesoftware.com — Fri, 17 Oct 2008 18:59:26 GMT

Hi Martin,

I've spoken with our Core Engineer and he thinks the issue could be with the spaces in your adminDN. Could you attempt escaping the spaces so we can properly bind?

For example:

CN=Sean Moran,OU=Jive Support,DC=jivesoftware,DC=com

Should be changed to:

CN=Sean\20Moran,OU=Jive\20Support,DC=jivesoftware,DC=com

Here, '\20' is used to escape the spaces in the adminDN. You can change this value by modifying the system property from the admin console. Unfortunately, this change will require a restart to take effect. Also if you have a staging/dev environment you can test this on first, I'd highly recommend that route instead of chaging production settings.

If you have any other questions please let me know.

Re: Re-synch with LDAP

communities@jivesoftware.com — Fri, 17 Oct 2008 00:25:06 GMT

Hi Martin,

From the error logs you gave me, and the baseDN information you sent over it looks like there's a portion of the LDAP stack within our app that is unable to handle your baseDN. I find this odd since your baseDN is as simple as it gets, no special characters, no spaces in the name. I'm going to pull in our Core Engineer that worked on all of our LDAP implementation and see what insight he can give me.

Once I've had a chance to talk to our engineer I'll update you with my findings.

Re: Re-synch with LDAP

communities@jivesoftware.com — Mon, 13 Oct 2008 17:35:44 GMT

In the admin console under 'System'->'Management'->'System Properties' the baseDN will be stored in a property called 'ldap.baseDN', and the user search filter will be stored under 'ldap.searchFilter'.

Re: Re-synch with LDAP

mrowbory@premierfarnell.com — Mon, 13 Oct 2008 17:08:50 GMT

Where do I find that...?

Thanks

Re: Re-synch with LDAP

communities@jivesoftware.com — Mon, 13 Oct 2008 16:52:38 GMT

Hi Martin,

From the logs it looks like Spring is having a problem parsing your baseDN. Could you post your baseDN and user filter ( if you're using one ) ?

Re: Re-synch with LDAP

mrowbory@premierfarnell.com — Mon, 13 Oct 2008 15:18:19 GMT

Right ok, I've managed to find where it's logging stuff.

I renamed the origianl clearspace.log file, with the intention of clearing it. I assumed the Clearspace would see the file wasn't there and just start a new log..... Clearly not. Somehow it's actually managing to still write to the original file, which is now called clearspace_log.old2.

Anyway, managed to find the trace for the re-synch - see attached.

Thanks, and sorry about the delay finding this stuff.

Martin

Re: Re-synch with LDAP

communities@jivesoftware.com — Thu, 09 Oct 2008 18:23:28 GMT

Hi Martin,

I've setup a local instance of Clearspace 2.5.1 pointed to our test Active Directory and I'm able to pull in new users and update changed fields without issue. I was also able to modify my baseDN and disable users that were no longer under the new DN. Were you able to change the logging level and re-run the sync? When I did this locally there didn't seem to be that much information, just an info message when a user is added or disabled.

The relevant tomcat log would be catalina.out, this should be catching all output from clearspace.

Re: Re-synch with LDAP

communities@jivesoftware.com — Wed, 08 Oct 2008 22:43:05 GMT

Hey Martin,

Another thing I thought might be helpful is to set the logging level to 'TRACE' and re-running sync yet again. This should produce quite a large amount of output data for me to look at. After you've run the sync I'd suggest setting the logging level back to error, as a logging level that fine can potentially cause performance issues. If setting the logging level to trace produces some output, could you attach that info here?

Re: Re-synch with LDAP

communities@jivesoftware.com — Wed, 08 Oct 2008 22:40:48 GMT

Hi Martin,

The sync should be searching under your defined baseDN and within the user and group search filters you've provided to locate new users or groups. This will also update any changed attributes for existing users.

I'll set this up locally to make sure everything is working as it should out of the box. There are a couple of things I could think of off the top of my head that might cause issues. Could you confirm that your users in ldap have a username, email address, and password? These three fields are required for an LDAP entry to be used in clearspace.

The other thing to check is to make sure the new users fall within the specified baseDN and user search filter.

I'll test this locally and get back to you tomorrow.

Re: Re-synch with LDAP

mrowbory@premierfarnell.com — Wed, 08 Oct 2008 11:03:03 GMT

I replaced the log with an empty file, although it still doesn't write anything to the log.

Which tomcat log is the relevant one? I looked at catalina.out it had a mark in it which i'd added from the log page on clearspace admin. I then ran the re-synch.

Still nothing happened and there was nothing in any of the logs.

What should I expect from the re-synch? I'm expecting it to bring in new users, and to update the mapped fields like job description.

Martin