Chapter 7. Red Hat Directory Server 12.2 Learn about new system requirements, important updates and new features, known issues, and deprecated functionality implemented in Directory Server 12.2. 7.1. Important updates and new features Learn about new features and important updates in Red Hat Directory Server 12.2. Directory Server 12.2 rebased to upstream version 2.2.7 Directory Server 12.2 is based on upstream version 2.2.7 which provides a number of bug fixes and enhancements over the version. For a complete list of notable changes, read the upstream release notes before updating: https://directory.fedoraproject.org/docs/389ds/releases/release-2-2-1.html https://directory.fedoraproject.org/docs/389ds/releases/release-2-2-2.html https://directory.fedoraproject.org/docs/389ds/releases/release-2-2-3.html https://directory.fedoraproject.org/docs/389ds/releases/release-2-2-4.html https://directory.fedoraproject.org/docs/389ds/releases/release-2-2-5.html https://directory.fedoraproject.org/docs/389ds/releases/release-2-2-6.html https://directory.fedoraproject.org/docs/389ds/releases/release-2-2-7.html The dsconf utility can now set timeout for tasks Previously, if a task took longer than four minutes, dsconf returned the following message: With this enhancement, you can set the required timeout for the task by using the --timeout option. The timeout does not stop the task, however it stops the dsconf utility from waiting for the task result. (BZ#1993124) You can now import and export certificates using the web console Previously, you could only import a certificate from a file on the server filesystem using the web console. With this release, you can also import a file by copy-pasting a base64 -encoded certificate. Additionally, you can export certificate authority and server certificates. (BZ#1751264) Important updates and new features in the 389-ds-base package Directory Server 12.2 features that are included in the 389-ds-base package are documented in Red Hat Enterprise Linux 9.2 Release Notes: Directory server now supports ECDSA private keys for TLS Directory Server now supports extended logging of search operations The NUNC_STANS error logging level was replaced by the new 1048576 logging level Directory Server introduces the security log Directory Server now can compress archived log files Default behavior change: Directory Server now returns a DN in exactly the same spelling as it was added to the database New nsslapd-auditlog-display-attrs configuration parameter for the Directory Server audit log New pamModuleIsThreadSafe configuration option is now available Directory Server can now import a certificate bundle 7.2. Bug fixes Learn about bugs fixed in Red Hat Directory Server 12.2 that have a significant impact on users. Directory Server 12.2 bug fixes that are included in the 389-ds-base package are documented in Red Hat Enterprise Linux 9.2 Release Notes: A password change for the Directory Server replication manager account now works correctly The dscreate utility works now correctly when uses a custom path with the db_dir parameter 7.3. Known issues Learn about known problems and, if applicable, workarounds in Directory Server 12.2. Directory Server can import LDIF files only from /var/lib/dirsrv/slapd- instance_name /ldif/ Since RHEL 8.3, Red Hat Directory Server (RHDS) uses its own private directories and the PrivateTmp systemd directive is enabled by default for the LDAP services. As a result, RHDS can only import LDIF files from the /var/lib/dirsrv/slapd- instance_name /ldif/ directory. If the LDIF file is stored in a different directory, such as /var/tmp , /tmp , or /root , the import fails with an error similar to the following: To work around this problem, complete the following steps: Move the LDIF file to the /var/lib/dirsrv/slapd- instance_name /ldif/ directory: Set permissions that allow the dirsrv user to read the file: Restore the SELinux context: For more information, see the solution article LDAP Service cannot access files under the host's /tmp and /var/tmp directories . (BZ#2075525) Access log displays an error message during Directory Server installation in FIPS mode When you install Directory Server in the FIPS mode, the access log file displays the following error message: Such behavior happens because at first, Directory Server finds that TLS is not initialized and logs the error message. However, later when the dscreate utility completes TLS initialization and enables security, the error message is no longer present. (BZ#2153668) Known issues in the 389-ds-base package Red Hat Directory Server 12.2 known issues that affect 389-ds-base package are documented in Red Hat Enterprise Linux 9.2 Release Notes: The dsconf utility has no option to create fix-up tasks for the entryUUID plug-in Configuring a referral for a suffix fails in Directory Server Directory Server terminates unexpectedly when started in referral mode 7.4. Deprecated functionality Learn about functionality that has been deprecated in Red Hat Directory Server 12.2. Deprecated functionality in the 389-ds-base package Directory Server 12.2 functionality that has been deprecated in the 389-ds-base package is documented in the Red Hat Enterprise Linux 9.2 Release Notes: The nsslapd-idlistscanlimit parameter is deprecated and its default value has been changed

Commands:
DEBUG: The backup create task has failed with the error code: (None)
Could not open LDIF file "/tmp/example.ldif", errno 2 (No such file or directory)
mv /tmp/ example.ldif /var/lib/dirsrv/slapd- instance_name__/ldif/
chown dirsrv /var/lib/dirsrv/slapd- instance_name /ldif/ example.ldif
restorecon -Rv /var/lib/dirsrv/slapd- instance_name /ldif/
[time_stamp] - WARN - slapd_do_all_nss_ssl_init - ERROR: TLS is not enabled, and the machine is in FIPS mode. Some functionality won't work correctly (for example, users with PBKDF2_SHA256 password scheme won't be able to log in). It's highly advisable to enable TLS on this instance.