Fedora directory users - Nov 2006 - AD + FDS sync stops working?

I have two seperate installations of FDS 1.0.1 that were successfully 
configured to sync with two seperate AD controllers.  They both worked fine 
for about six months, and both have stopped synchronizing information that 
should pass from the AD to FDS.  Basically, if a user changes his or her 
password through AD, nothing changes on FDS.  If the password is changed 
through FDS, it does get pushed up to the AD controller.

Has anyone else seen this happen?  There have been no changes made to either 
the FDS or AD configurations since the initial installation was completed. 
The AD servers are Windows 2000 and Windows 2003 on seperate domains.

I''ve tried to uninstall and reinstall the PassSync software.  Every
time
that service is restarted, I see a connect via SSL in the logs in FDS, but 
nothing after that.

--Dan

Dan Oglesby wrote:
> I have two seperate installations of FDS 1.0.1 that were successfully 
> configured to sync with two seperate AD controllers.  They both worked 
> fine for about six months, and both have stopped synchronizing 
> information that should pass from the AD to FDS.  Basically, if a user 
> changes his or her password through AD, nothing changes on FDS.  If 
> the password is changed through FDS, it does get pushed up to the AD 
> controller.
>
> Has anyone else seen this happen?  There have been no changes made to 
> either the FDS or AD configurations since the initial installation was 
> completed. The AD servers are Windows 2000 and Windows 2003 on 
> seperate domains.
>
> I''ve tried to uninstall and reinstall the PassSync software. 
Every
> time that service is restarted, I see a connect via SSL in the logs in 
> FDS, but nothing after that.
Was the connect via SSL successful?

Regards,
--
toto
> --Dan
> -- 
> Fedora-directory-users mailing list
> Fedora-directory-users@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-directory-users

To Ngan wrote:
> Dan Oglesby wrote:
>> I have two seperate installations of FDS 1.0.1 that were successfully 
>> configured to sync with two seperate AD controllers.  They both 
>> worked fine for about six months, and both have stopped synchronizing 
>> information that should pass from the AD to FDS.  Basically, if a 
>> user changes his or her password through AD, nothing changes on FDS.  
>> If the password is changed through FDS, it does get pushed up to the 
>> AD controller.
>>
>> Has anyone else seen this happen?  There have been no changes made to 
>> either the FDS or AD configurations since the initial installation 
>> was completed. The AD servers are Windows 2000 and Windows 2003 on 
>> seperate domains.
>>
>> I''ve tried to uninstall and reinstall the PassSync software. 
Every
>> time that service is restarted, I see a connect via SSL in the logs 
>> in FDS, but nothing after that.
> Was the connect via SSL successful?
>
It appears to be:

[29/Nov/2006:09:42:29 -0600] conn=146041 fd=203 slot=203 SSL connection 
from 192.168.2.200 to 192.168.100.122
[29/Nov/2006:09:42:29 -0600] conn=146041 SSL 128-bit RC4
[29/Nov/2006:09:42:29 -0600] conn=146041 op=0 BIND dn="cn=directory 
manager" method=128 version=2
[29/Nov/2006:09:42:29 -0600] conn=146041 op=0 RESULT err=0 tag=97 
nentries=0 etime=0 dn="cn=directory manager"
[29/Nov/2006:09:42:29 -0600] conn=146041 op=1 UNBIND
[29/Nov/2006:09:42:29 -0600] conn=146041 op=1 fd=203 closed - U1

That''s all I ever see in the access log for the slapd server from my AD
machine.

--Dan

Dan Oglesby wrote:
> To Ngan wrote:
>> Dan Oglesby wrote:
>>> I have two seperate installations of FDS 1.0.1 that were 
>>> successfully configured to sync with two seperate AD controllers.  
>>> They both worked fine for about six months, and both have stopped 
>>> synchronizing information that should pass from the AD to FDS.  
>>> Basically, if a user changes his or her password through AD,
nothing
>>> changes on FDS.  If the password is changed through FDS, it does
get
>>> pushed up to the AD controller.
>>>
>>> Has anyone else seen this happen?  There have been no changes made 
>>> to either the FDS or AD configurations since the initial 
>>> installation was completed. The AD servers are Windows 2000 and 
>>> Windows 2003 on seperate domains.
>>>
>>> I''ve tried to uninstall and reinstall the PassSync
software.  Every
>>> time that service is restarted, I see a connect via SSL in the logs
>>> in FDS, but nothing after that.
>> Was the connect via SSL successful?
>>
>
> It appears to be:
>
> [29/Nov/2006:09:42:29 -0600] conn=146041 fd=203 slot=203 SSL 
> connection from 192.168.2.200 to 192.168.100.122
> [29/Nov/2006:09:42:29 -0600] conn=146041 SSL 128-bit RC4
> [29/Nov/2006:09:42:29 -0600] conn=146041 op=0 BIND dn="cn=directory 
> manager" method=128 version=2
> [29/Nov/2006:09:42:29 -0600] conn=146041 op=0 RESULT err=0 tag=97 
> nentries=0 etime=0 dn="cn=directory manager"
> [29/Nov/2006:09:42:29 -0600] conn=146041 op=1 UNBIND
> [29/Nov/2006:09:42:29 -0600] conn=146041 op=1 fd=203 closed - U1
>
> That''s all I ever see in the access log for the slapd server from
my
> AD machine.
Nothing in DS error log either?  How about the passsync log on your 
Windows box? (either under windows/system32 or your passsync install 
directory)
--
toto

-----Original Message-----
From: fedora-directory-users-bounces@redhat.com
[mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of To Ngan
Sent: Wednesday, November 29, 2006 11:15 AM
To: General discussion list for the Fedora Directory server project.
Subject: Re: [Fedora-directory-users] AD + FDS sync stops working?

Dan Oglesby wrote:
> To Ngan wrote:
>> Dan Oglesby wrote:
>>> I have two seperate installations of FDS 1.0.1 that were 
>>> successfully configured to sync with two seperate AD controllers.  
>>> They both worked fine for about six months, and both have stopped 
>>> synchronizing information that should pass from the AD to FDS.  
>>> Basically, if a user changes his or her password through AD,
nothing
>>> changes on FDS.  If the password is changed through FDS, it does
get
>>> pushed up to the AD controller.
>>>
>>> Has anyone else seen this happen?  There have been no changes made 
>>> to either the FDS or AD configurations since the initial 
>>> installation was completed. The AD servers are Windows 2000 and 
>>> Windows 2003 on seperate domains.
>>>
>>> I''ve tried to uninstall and reinstall the PassSync
software.  Every
>>> time that service is restarted, I see a connect via SSL in the logs
>>> in FDS, but nothing after that.
>> Was the connect via SSL successful?
>>
>
> It appears to be:
>
> [29/Nov/2006:09:42:29 -0600] conn=146041 fd=203 slot=203 SSL 
> connection from 192.168.2.200 to 192.168.100.122
> [29/Nov/2006:09:42:29 -0600] conn=146041 SSL 128-bit RC4
> [29/Nov/2006:09:42:29 -0600] conn=146041 op=0 BIND dn="cn=directory 
> manager" method=128 version=2
> [29/Nov/2006:09:42:29 -0600] conn=146041 op=0 RESULT err=0 tag=97 
> nentries=0 etime=0 dn="cn=directory manager"
> [29/Nov/2006:09:42:29 -0600] conn=146041 op=1 UNBIND
> [29/Nov/2006:09:42:29 -0600] conn=146041 op=1 fd=203 closed - U1
>
> That''s all I ever see in the access log for the slapd server from
my
> AD machine.
Nothing in DS error log either?  How about the passsync log on your 
Windows box? (either under windows/system32 or your passsync install 
directory)

I don''t see any type of log for the passsync service in the program
files
area or the system/system32 directories.

Error log on the FDS system has nothing other than start and stop
information for the FDS server.

--Dan

Dan Oglesby wrote:
> -----Original Message-----
> From: fedora-directory-users-bounces@redhat.com
> [mailto:fedora-directory-users-bounces@redhat.com] On Behalf Of To Ngan
> Sent: Wednesday, November 29, 2006 11:15 AM
> To: General discussion list for the Fedora Directory server project.
> Subject: Re: [Fedora-directory-users] AD + FDS sync stops working?
>
> Dan Oglesby wrote:
>   
>> To Ngan wrote:
>>     
>>> Dan Oglesby wrote:
>>>       
>>>> I have two seperate installations of FDS 1.0.1 that were 
>>>> successfully configured to sync with two seperate AD
controllers.
>>>> They both worked fine for about six months, and both have
stopped
>>>> synchronizing information that should pass from the AD to FDS.
>>>> Basically, if a user changes his or her password through AD,
nothing
>>>> changes on FDS.  If the password is changed through FDS, it
does get
>>>> pushed up to the AD controller.
>>>>
>>>> Has anyone else seen this happen?  There have been no changes
made
>>>> to either the FDS or AD configurations since the initial 
>>>> installation was completed. The AD servers are Windows 2000 and
>>>> Windows 2003 on seperate domains.
>>>>
>>>> I''ve tried to uninstall and reinstall the PassSync
software.  Every
>>>> time that service is restarted, I see a connect via SSL in the
logs
>>>> in FDS, but nothing after that.
>>>>         
>>> Was the connect via SSL successful?
>>>
>>>       
>> It appears to be:
>>
>> [29/Nov/2006:09:42:29 -0600] conn=146041 fd=203 slot=203 SSL 
>> connection from 192.168.2.200 to 192.168.100.122
>> [29/Nov/2006:09:42:29 -0600] conn=146041 SSL 128-bit RC4
>> [29/Nov/2006:09:42:29 -0600] conn=146041 op=0 BIND
dn="cn=directory
>> manager" method=128 version=2
>> [29/Nov/2006:09:42:29 -0600] conn=146041 op=0 RESULT err=0 tag=97 
>> nentries=0 etime=0 dn="cn=directory manager"
>> [29/Nov/2006:09:42:29 -0600] conn=146041 op=1 UNBIND
>> [29/Nov/2006:09:42:29 -0600] conn=146041 op=1 fd=203 closed - U1
>>
>> That''s all I ever see in the access log for the slapd server
from my
>> AD machine.
>>     
>
> Nothing in DS error log either?  How about the passsync log on your 
> Windows box? (either under windows/system32 or your passsync install 
> directory)
>
> I don''t see any type of log for the passsync service in the
program files
> area or the system/system32 directories.
>   
In windows registry->HKLM->Software->PasswordSync, try add string value
"Log Level" and set it to "1".  Restart the passsync
service.  This
should log all transactions and errors.  Turn this back to "0" and 
restart passsync after troubleshooting.
> Error log on the FDS system has nothing other than start and stop
> information for the FDS server.
> Can you check your registry 
>