<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Le 04/12/2012 09:09, Oved Ourfalli a
écrit :<br>
</div>
<blockquote
cite="mid:319978569.54529613.1354608562467.JavaMail.root@redhat.com"
type="cite">
<pre wrap="">
----- Original Message -----
</pre>
<blockquote type="cite">
<pre wrap="">From: "Itamar Heim" <a class="moz-txt-link-rfc2396E" href="mailto:iheim@redhat.com"><iheim@redhat.com></a>
To: "Oved Ourfalli" <a class="moz-txt-link-rfc2396E" href="mailto:ovedo@redhat.com"><ovedo@redhat.com></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:users@ovirt.org">users@ovirt.org</a>, "Thierry Kauffmann" <a class="moz-txt-link-rfc2396E" href="mailto:thierry.kauffmann@univ-montp2.fr"><thierry.kauffmann@univ-montp2.fr></a>
Sent: Tuesday, December 4, 2012 1:47:52 AM
Subject: Re: [Users] OpenLDAP Simple Authentication in Ovirt Engine
On 12/02/2012 08:10 AM, Oved Ourfalli wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
----- Original Message -----
</pre>
<blockquote type="cite">
<pre wrap="">From: "Thierry Kauffmann" <a class="moz-txt-link-rfc2396E" href="mailto:thierry.kauffmann@univ-montp2.fr"><thierry.kauffmann@univ-montp2.fr></a>
To: "cristi falcas" <a class="moz-txt-link-rfc2396E" href="mailto:cristi.falcas@gmail.com"><cristi.falcas@gmail.com></a>
Cc: <a class="moz-txt-link-abbreviated" href="mailto:users@ovirt.org">users@ovirt.org</a>
Sent: Saturday, December 1, 2012 5:56:14 PM
Subject: [Users] OpenLDAP Simple Authentication in Ovirt Engine
Hi,
I am currently testing Ovirt 3.1 standalone on Fedora 17.
Until now, I could only use the default user admin@internal.
Our Directory at the University is OpenLDAP. We use it for
authentication
WITHOUT Kerberos : Simple authentication.
I wonder how to use this backend to authenticate users and manage
groups
in Ovirt.
Has anyone already set this up ?
How to configure Ovirt to use Simple Authentication (No Kerberos).
Cheers,
--
Thierry Kauffmann
Chef du Service Informatique // Facult? des Sciences // Universit?
de
Montpellier 2
[image: SIF - Service Informatique de la Facult? des Sciences]
<a class="moz-txt-link-rfc2396E" href="http://sif.info-ufr.univ-montp2.fr/"><http://sif.info-ufr.univ-montp2.fr/></a> [image:
UM2 - Universit? de Montpellier 2] <a class="moz-txt-link-rfc2396E" href="http://www.univ-montp2.fr/"><http://www.univ-montp2.fr/></a>
Service
informatique de la Facult? des Sciences (SIF)
Universit? de Montpellier 2
CC437 // Place Eug?ne Bataillon // 34095 Montpellier Cedex 5
T?l : 04 67 14 31 58
email : <a class="moz-txt-link-abbreviated" href="mailto:thierry.kauffmann@univ-montp2.fr">thierry.kauffmann@univ-montp2.fr</a> web :
<a class="moz-txt-link-freetext" href="http://sif.info-ufr.univ-montp2.fr/">http://sif.info-ufr.univ-montp2.fr/</a>
<a class="moz-txt-link-freetext" href="http://www.fdsweb.univ-montp2.fr/">http://www.fdsweb.univ-montp2.fr/</a>
_______________________________________________
Users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Users@ovirt.org">Users@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a> Hi,
This is a response from an older thread from Yair Zaslavsky:
" there is no code allowing to add simple-authentication domains
to
Manage-Domains.
In the past we did have the ability to do that, but there are
several
problematic issues."
Best regards, Hi,
correct-me if I am wrong but this wiki page (
<a class="moz-txt-link-freetext" href="http://www.ovirt.org/DomainInfrastructure">http://www.ovirt.org/DomainInfrastructure</a> ) states clearly :
1. Authenticating Active Directory, IPA and RHDS using either
simple or gssapi authentication
2. Querying the directory using the LDAP protocol
3. Auto deducing the LDAP provider type
4. Easily adding new LDAP provider types
5. Easily adding new query types
So what ?
</pre>
</blockquote>
<pre wrap="">We supported simple authentication in the past, but it is no longer
supported, that's why you can't set that using the manage domains
utility.
It may work well in some providers (in the past we supported that
for active directory, so I guess it would work there).
</pre>
</blockquote>
<pre wrap="">
I don't think we removed SIMPLE from the engine, we just don't
recommend
using it, since it doesn't encrypt user/password on the network (it
is
sometime useful for debugging).
</pre>
</blockquote>
<pre wrap="">We indeed didn't remove the engine code. We just blocked it from the utility.
Once you have a configured oVirt domain, you can set the LDAPSecurityAuthentication configuration parameter (in the vdc_options table), to use simple, by putting a value of:
domain1:SIMPLE,domain2:GSSAPI,domain3:SIMPLE and etc....
but, if you want to add a new domain with it then you would need to add it manually (can give a detailed explanation on how, if relevant).
</pre>
</blockquote>
Yes, I would like to know how to add directly a domain which is not
GSSAPI controlled.<br>
<br>
<br>
<blockquote
cite="mid:319978569.54529613.1354608562467.JavaMail.root@redhat.com"
type="cite">
<pre wrap="">
By default we work GSSAPI (I think the config option is empty by default which is equivalent to working GSSAPI).
If/When we would need to support that again it shouldn't be a major effort to add the code... the testing with the different providers will be the hard part.
Oved
</pre>
</blockquote>
<br>
<br>
<blockquote
cite="mid:319978569.54529613.1354608562467.JavaMail.root@redhat.com"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
We also don't auto deduce the LDAP provider type anymore, as
changes in the providers caused some issues with it.
I'll edit the wiki accordingly (btw, I remember removing it from
the wiki... so it is weird that it is still there...).
Oved
</pre>
<blockquote type="cite">
<pre wrap="">
--
signature-TK Thierry Kauffmann
Chef du Service Informatique // Faculté des Sciences // Université
de
Montpellier 2
SIF - Service Informatique de la Faculté
des Sciences UM2 -
Université de Montpellier 2 Service
informatique de
la Faculté des Sciences (SIF)
Université de Montpellier 2
CC437 // Place Eugène Bataillon // 34095 Montpellier Cedex 5
Tél : 04 67 14 31 58
email : <a class="moz-txt-link-abbreviated" href="mailto:thierry.kauffmann@univ-montp2.fr">thierry.kauffmann@univ-montp2.fr</a>
web : <a class="moz-txt-link-freetext" href="http://sif.info-ufr.univ-montp2.fr/">http://sif.info-ufr.univ-montp2.fr/</a>
<a class="moz-txt-link-freetext" href="http://www.fdsweb.univ-montp2.fr/">http://www.fdsweb.univ-montp2.fr/</a>
_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@ovirt.org">Users@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a>
</pre>
</blockquote>
<pre wrap="">_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@ovirt.org">Users@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a>
</pre>
</blockquote>
<pre wrap="">
_______________________________________________
Users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Users@ovirt.org">Users@ovirt.org</a>
<a class="moz-txt-link-freetext" href="http://lists.ovirt.org/mailman/listinfo/users">http://lists.ovirt.org/mailman/listinfo/users</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<br>
<br>
<div class="moz-signature">-- <br>
<meta content="text/html; charset=UTF-8" http-equiv="content-type">
<title>signature-TK</title>
<small><span style="color: rgb(15, 67, 106); font-weight: bold;">Thierry
Kauffmann</span><br>
<span style="color: rgb(15, 67, 106);">Chef du Service
Informatique // </span><span style="color: rgb(15, 67, 106);">Faculté
des Sciences // </span><span style="color: rgb(15, 67, 106);">Université
de Montpellier 2</span></small><br>
<br>
<table style="text-align: left; height: 111px; width: 924px;"
border="0" cellpadding="10" cellspacing="0">
<tbody>
<tr>
<td style="vertical-align: middle; text-align: center;"><a
href="http://sif.info-ufr.univ-montp2.fr/"><img
style="border: 0px solid ; width: 100px; height:
106px;" alt="SIF - Service Informatique de la Faculté
des Sciences"
src="cid:part1.00080506.08040300@univ-montp2.fr"></a></td>
<td style="border-right: 2px solid rgb(15, 67, 106);
vertical-align: middle; color: rgb(180, 202, 0);
text-align: center; width: 211px;"><a
href="http://www.univ-montp2.fr/"><img style="border:
0px solid ; width: 194px; height: 106px;" alt="UM2 -
Université de Montpellier 2"
src="cid:part3.03010208.00080209@univ-montp2.fr"></a></td>
<td style="vertical-align: top; color: rgb(180, 202, 0);
width: 547px; line-height: 13px;"><small><span
style="color: rgb(15, 67, 106); font-weight: bold;"></span><span
style="color: rgb(15, 67, 106);"></span>Service
informatique de la Faculté des Sciences (SIF)<br>
Université de Montpellier 2<br>
<span style="color: rgb(71, 189, 205);">
CC437 // </span><span style="color: rgb(71, 189,
205);">Place Eugène Bataillon // </span><span
style="color: rgb(71, 189, 205);">34095 Montpellier
Cedex 5</span><br>
<span style="color: rgb(71, 189, 205);"><br>
Tél : 04 67 14 31 58</span><br>
<span style="color: rgb(71, 189, 205);">email : </span><a
style="color: rgb(15, 67, 106);"
href="mailto:thierry.kauffmann@univ-montp2.fr">thierry.kauffmann@univ-montp2.fr</a><br>
<span style="color: rgb(71, 189, 205);">web : </span><a
style="color: rgb(15, 67, 106);"
href="http://sif.info-ufr.univ-montp2.fr/">http://sif.info-ufr.univ-montp2.fr/</a>
<a style="color: rgb(15, 67, 106);"
href="http://www.fdsweb.univ-montp2.fr/">http://www.fdsweb.univ-montp2.fr/</a></small>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</body>
</html>