Fedora directory users - Jun 2006 - FDS over SSL with PassSync -- How I did it

Thanks to everyone who helped me.

Since it was a struggle for me, I thought that I would post how I did it 
in case others have the same problems that I had. Maybe it will help 
someone else.

My Setup:

Fedora Core 4
Fedora Directory Server 1.0.2
Windows 2000 Server

Install FDS ( or reinstall: rpm -qa | grep fedora-ds | xargs rpm -e; rm 
-rf /opt/fedora-ds ; rpm -i fedora-ds-1.0.2 )
create certificates, etc..
I used this simple script that I wrote: (cd to /opt/fedora-ds/alias)
-----------------------------------------------------------------------

echo -n "Creating password and noise file..."

echo "8904859034905834-580943502385430958430958049385" > 
/opt/fedora-ds/alias/pwdfile.txt

echo "8374893jkhsdfjkhdjksfah89dskjfkdghkjdfhguiert9348khkfhgkjfd79"
>
/opt/fedora-ds/alias/noise.txt

echo -n "Creating Databases..."

$serverroot/shared/bin/certutil -N -d . -f pwdfile.txt

 echo -n "Generating encryption key..."

$serverroot/shared/bin/certutil -G -d . -z noise.txt -f pwdfile.txt

 echo -n "Generating self-signed certificate..."

$serverroot/shared/bin/certutil -S -n "CA certificate" -s
"cn=CAcert" -x
-t "CT,," -m 1000 -v 120  -d . -z noise.txt -f pwdfile.txt

 echo -n "Generating server certificate.."

$serverroot/shared/bin/certutil -S -n "Server-Cert" -s 
"cn=msas.msd.lbl.gov" -c "CA certificate" -t
"u,u,u" -m 1001 -v 120  -d
. -z noise.txt -f pwdfile.txt

 mv key3.db slapd-msas-key3.db

mv cert8.db slapd-msas-cert8.db

ln -s slapd-msas-key3.db key3.db

ln -s slapd-msas-cert8.db cert8.db

 echo -n "Setting permissions.."

chown nobody.nobody /opt/fedora-ds/alias/slapd-msas*

 echo -n "Exporting certificate.."

$serverroot/shared/bin/certutil -L -d . -n "CA certificate" -r >
cacert.der

 echo "Converting certificate.."

openssl x509 -inform DER -in cacert.der -outform PEM -out cacert.pem

 echo "Copying cacert.pem to /etc/openldap/cacerts.."

 cp cacert.pem /etc/openldap/cacerts/

 echo -n "Enabling SSL in FDS"

echo ""

echo -n "Please enter Manager password..(twice)"

ldapmodify -x -D cn=Manager -W -f /tmp/ssl_enable.ldif

ldapmodify -x -D cn=Manager -W -a -f /tmp/addRSA.ldif

---------------------------------------------------------

restart FDS

Test SSL connections and ldapsearch
netstat -an | grep 636

Install Active Directory on Windows Server

Install Certificate Services --> Enterprise root CA
reboot
Enable SSL on AD

   1. Install Certificate Services on Windows 2000 Server and an
      Enterprise Certificate Authority in the Active Directory Domain. 
      Make sure you install an Enterprise Certificate Authority.
   2. Create a Security (Group) Policy to direct Domain Controllers to
      get an SSL certificate from the Certificate Authority (CA).
         1. Open the Active Directory Users and Computers Administrative
            tool.
         2. Under the domain, right-click on Domain Controllers.
         3. Select Properties.
         4. In the Group Policy tab, click to edit the Default Domain
            Controllers Policy.
         5. Go to Computer Configuration->Windows Settings->Security
            Settings->Public Key Policies.
         6. Right click Automatic Certificate Request Settings.
         7. Select New.
         8. Select Automatic Certificate Request.
         9. Run the wizard. Select the Certificate Template for a Domain
            Controller.
        10. Select your Enterprise Certificate Authority as the CA.
            Selecting a third-party CA works as well.
        11. Complete the wizard.
        12. All Domain Controllers now automatically request a
            certificate from the CA, and support LDAP using SSL on port 636.
   3. Retrieve the Certificate Authority Certificate
         1. Open a Web browser on the AD machine
         2. Go to http://localhost/certsrv/
         3. Select the task Retrieve the CA certificate or certificate
            revocation list.
         4. Click Next.
         5. The next page automatically highlights the CA certificate.
            Click Download CA certificate.
         6. A new download window opens. Save the file to the hard drive.
      Save in DER mode

Copy file to FDS server, convert to PEM format

openssl x509 -inform DER -in ad-cert.der -outform PEM -out ad-cert.pem

Import AD CA cert into FDS

certutil -A -d . -P slapd-instance- -t "CT,CT,CT" -a -i ad-cert.pem

check certs ( from /opt/fedora-ds/alias)
 certutil -L -d . -P slapd-instance

Check ldapsearch from FDS to AD

ldapsearch -Z -P <RHDS-cert8.db> -h <AD/NT Hostname> -p <AD SSL
port>
 -D "<sync manager user> -w < sync manager password> -s
<scope>
 -b "<AD base>" "<filter>"

Install PassSync on Windows machine.
Follow directions from Howto:WindowsSync (certificate creation)
restart AD server

Enable Replication in Directory Server Console:

Go to configuration tab --> Replication --> enable changelog -->
default
Expand Replication, click UserRoot
Check "Enable Replica" Single-master

Right Click UserRoot --> Create new windows sync agreement

Up log level in FDS:

dn: cn=config
changetype: modify
replace: nsslapd-errorlog-level
nsslapd-errorlog-level: 8192

ldapmodify -x -D "cn=directory manager" -a -f repl_log.ldif

restart FDS

right click win sync agreement --> Initiate Full Sync

check error logs (/opt/fedora/slapd-instance/logs/errors)

In order for users to be created on the Windows side, users must have 
certain attributes.

e.g.
dn: uid=TBird,ou=People, dc=server,dc=com
givenName: Tweetie
ntUserCreateNewAccount: true
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetorgperson
objectClass: ntuser
objectClass: posixAccount
facsimileTelephoneNumber: 510-555-5555
uid: TBird
mail: tbird@server.com
uidNumber: 71209
cn: Tweetie Bird
ntUserComment: Tweetie Bird User Account
telephoneNumber: 510-555-5555
loginShell: /bin/bash
ntUserDomainId: tbird
gidNumber: 5000
ntUserDeleteAccount: true
gecos: Tweetie Bird
homeDirectory: /home/tbird
sn: Bird
userPassword::

I hope that I have this right.