Chapter 7. Red Hat Directory Server 12.5

Directory Server now delivers the 389-ds-base component from the RHEL AppStream

Previously, the 389-ds-base component was delivered as part of RHEL and RHDS modules. With this update, because of demodularization efforts, RHDS no longer delivers its own copy of 389-ds-base and uses 389-ds-base from the RHEL AppStream instead.

Important updates and new features in the 389-ds-base package

Important updates in Red Hat Directory Server 12.5 that are included in the 389-ds-base package are documented in Red Hat Enterprise Linux 9.5 Release Notes:

dsidm now prompts to create an ou entry

Previously, when you used the dsidm utility to create a user or a group but the Organizational Unit (ou) entry that the user or the group must belong to did not exist, you saw the following error:

dsctl now displays the -v option in the usage section

Previously, the verbose option (-v) for the dsctl test db2bak -h command was not displayed in the action section of the help description (--help, -h). With this update, the help description now also displays the -v option.

Creating a replication agreement with dsconf now completes without a delay

Previously, when you created a replication agreement by using the dsconf utility, the command hanged for a minute and only then proceeded further. With this update, a replication agreement is now created without any delays.

The Directory Server web console no longer fails to enable the audit failure logging

Previously, if you attempted to enable the audit failure logging by using the Directory Server web console, the process failed. With this update, the issue has been fixed, and you can enable the audit failure logging as expected.

When starting an instance with a sub-suffix, an incorrect error is no longer logged

Previously, when starting an instance with a sub-suffix, you could see the following incorrect message in the error log:

Directory Server now updates the password history for pre-hashed passwords as expected

Previously, when you updated your password with a hashed value, the updated password hash was not listed in your password history. With this update, the issue has been fixed, and both hashed and non-hashed password updates are now listed in the password history.

Log file timestamps now have the correct time zone

Previously, the log file timestamps had the wrong timezone offset if the timezone offset was not a multiple of an hour, like America/St_johns timezone which is UTC-3:30. With this update, the timezone offset is calculated correctly.

The web console now enables replication for a sub-suffix as expected

Previously, enabling replication for a sub-suffix by using the Directory Server web console failed with an error. With this update, the issue has been fixed, and you can now enable replication, and the proper replication tab is displayed in the web console.

Directory Server SNMP agent now starts as expected if an SELinux policy is enforced

Previously, SELinux reported an Access Vector Cache (AVC) error when using the Directory Server SNMP agent and the agent failed to start if an SELinux policy was enforced. This was due to the SNMP agent having the incorrect permissions. With this update, the SNMP agent permissions have been changed and the SELinux policy configuration has been fixed.

Directory Server web console does not automatically update settings that are changed outside the web console

Because of the design of the Directory Server module in the Red Hat Enterprise Linux 8 web console, the web console does not automatically display the latest settings if you change the configuration outside of the console window. For example, if you change the configuration using the command line while the web console is open, the new settings are not automatically updated in the web console. This applies also if you change the configuration by using the web console on a different computer.

Directory Server can import LDIF files only from /var/lib/dirsrv/slapd-instance_name/ldif/

Since RHEL 8.3, Red Hat Directory Server (RHDS) uses its own private directories, and the PrivateTmp systemd directive is enabled by default for the LDAP services. As a result, RHDS can only import LDIF files from the /var/lib/dirsrv/slapd-instance_name/ldif/ directory. If the LDIF file is stored in a different directory, such as /var/tmp, /tmp, or /root, the import fails with an error similar to the following:

Known issues in the 389-ds-base package

Red Hat Directory Server 12.5 known issues that affect 389-ds-base package are documented in Red Hat Enterprise Linux 9.5 Release Notes: