<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Le 12/12/2012 17:53, Alon Bar-Lev a
écrit :<br>
</div>
<blockquote
cite="mid:1490596332.4736653.1355331210001.JavaMail.root@redhat.com"
type="cite">
<pre wrap="">Hello Thierry,
If I understand correctly you wish to help in modifying the engine to support non GSSAPI authentication methods.
</pre>
</blockquote>
Hi Alon,<br>
<br>
you're right.<br>
My main (selfish) goal is to adapt oVirt authentication schemes to
our requirements : that is "LDAP SIMPLE auth over startTLS."<br>
<br>
<blockquote
cite="mid:1490596332.4736653.1355331210001.JavaMail.root@redhat.com"
type="cite">
<pre wrap="">
Following is a quick design goals for this implementation.
I will be glad to improve this.
Alon
</pre>
</blockquote>
Thanks a lot for this description.<br>
<br>
Tell me how I could help : I am more a system administrator than a
developer. I kwon a bit of java (at least I can read and understand
oVirt's code that I downloaded recently).<br>
<br>
Thierry<br>
<br>
<blockquote
cite="mid:1490596332.4736653.1355331210001.JavaMail.root@redhat.com"
type="cite">
<pre wrap="">
---
Implementation should support the following transports:
1. LDAP (plain).
2. LDAP over TLS.
3. LDAP with StartTLS.
Implementation should support the following authentication methods:
1. Simple.
2. Digest-MD5 (plain and strong).
I believe the GSSAPI can be dropped, I see no advantage of using it.
A sample of low level implementation for transport and authentication is attached.
When adding a domain the following facts should be provided:
1. Search user name.
2. Search user password.
3. Transport type (ldap, ldaps, ldap+startTLS)
4. Authentication (simple, Digest-MD5)
5. Sever selection policy (failover, round-robin, random).
6. Server address type (explicit, DNS record)
7. Server address set.
8. Optional base DN.
9. Optional root certificate.
10. Optional certificate chain.
11. Search page size.
10. Query timeout.
etc...
Within product there are two separate components that perform LDAP authentication:
1. User password validation.
2. User permission fetch.
These two components needs to work in share-nothing mode, meaning that each should communicate with directory independently with the other.
USER PASSWORD VALIDATION
Input: user
Input: domain
Input: password
Output: DN of user
Output: success/failure
Credentials used: user/password provided.
Notes: LDAP session should not be cached.
Logic: Perform LDAP bind.
USER PERMISSION FETCH
Input: DN of user (passed by user password validation)
Input: domain (passed by user password validation)
Output: A set of permissions
Credentials used: search user and password configured within system.
Notes: LDAP context can be cached.
Logic: Perform LDAP searches, this is most of current logic.
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
<meta content="text/html; charset=UTF-8" http-equiv="content-type">
<title>signature-TK</title>
<small><span style="color: rgb(15, 67, 106); font-weight: bold;">Thierry
Kauffmann</span><br>
<span style="color: rgb(15, 67, 106);">Chef du Service
Informatique // </span><span style="color: rgb(15, 67, 106);">Faculté
des Sciences // </span><span style="color: rgb(15, 67, 106);">Université
de Montpellier 2</span></small><br>
<br>
<table style="text-align: left; height: 111px; width: 924px;"
border="0" cellpadding="10" cellspacing="0">
<tbody>
<tr>
<td style="vertical-align: middle; text-align: center;"><a
href="http://sif.info-ufr.univ-montp2.fr/"><img
style="border: 0px solid ; width: 100px; height:
106px;" alt="SIF - Service Informatique de la Faculté
des Sciences"
src="cid:part1.09060908.01080200@univ-montp2.fr"></a></td>
<td style="border-right: 2px solid rgb(15, 67, 106);
vertical-align: middle; color: rgb(180, 202, 0);
text-align: center; width: 211px;"><a
href="http://www.univ-montp2.fr/"><img style="border:
0px solid ; width: 194px; height: 106px;" alt="UM2 -
Université de Montpellier 2"
src="cid:part3.03050605.01020105@univ-montp2.fr"></a></td>
<td style="vertical-align: top; color: rgb(180, 202, 0);
width: 547px; line-height: 13px;"><small><span
style="color: rgb(15, 67, 106); font-weight: bold;"></span><span
style="color: rgb(15, 67, 106);"></span>Service
informatique de la Faculté des Sciences (SIF)<br>
Université de Montpellier 2<br>
<span style="color: rgb(71, 189, 205);">
CC437 // </span><span style="color: rgb(71, 189,
205);">Place Eugène Bataillon // </span><span
style="color: rgb(71, 189, 205);">34095 Montpellier
Cedex 5</span><br>
<span style="color: rgb(71, 189, 205);"><br>
Tél : 04 67 14 31 58</span><br>
<span style="color: rgb(71, 189, 205);">email : </span><a
style="color: rgb(15, 67, 106);"
href="mailto:thierry.kauffmann@univ-montp2.fr">thierry.kauffmann@univ-montp2.fr</a><br>
<span style="color: rgb(71, 189, 205);">web : </span><a
style="color: rgb(15, 67, 106);"
href="http://sif.info-ufr.univ-montp2.fr/">http://sif.info-ufr.univ-montp2.fr/</a>
<a style="color: rgb(15, 67, 106);"
href="http://www.fdsweb.univ-montp2.fr/">http://www.fdsweb.univ-montp2.fr/</a></small>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</body>
</html>