<div dir="ltr">Thank you very much, <div><br></div><div>using the following <a href="http://ldap.example.org">ldap.example.org</a> file:</div><div><br></div><div>---------------------</div><div><br></div><div><div>include = <openldap_example.properties></div><div>include = <rfc2307.properties></div><div><br></div><div>vars.server = <a href="http://ldap1.example.org">ldap1.example.org</a></div><div>#vars.user = cn=authenticate,ou=System,dc=example,dc=org</div><div>#vars.password = XXXXXXXXX</div><div><br></div><div>pool.default.serverset.single.server = ${global:vars.server}</div><div>pool.default.auth.simple.bindDN = cn=authenticate,ou=System,dc=example,dc=org</div><div>pool.default.auth.simple.password = XXXXXXXXX</div><div><br></div><div>pool.default.ssl.startTLS = true</div><div>pool.default.ssl.truststore.file = /etc/ovirt-engine/extensions.d/ldap.example.org_keystore.jks</div><div>pool.default.ssl.truststore.password = XXXXXXXXX</div></div><div><br></div><div>---------------------<br></div><div><br></div><div>Then I get the following in the engine log:</div><div><br></div><div><br></div><div><div>2015-01-15 10:04:15,250 ERROR [org.ovirt.engine.core.bll.aaa.LoginAdminUserCommand] (ajp--127.0.0.1-8702-3) Error during CanDoActionFailure.: Class: class org.ovirt.engine.core.extensions.mgr.ExtensionInvokeCommandFailedException</div><div>Input:</div><div>{Extkey[name=AAA_AUTHN_CREDENTIALS;type=class java.lang.String;uuid=AAA_AUTHN_CREDENTIALS[03b96485-4bb5-4592-8167-810a5c909706];]=***, Extkey[name=EXTENSION_INVOKE_CONTEXT;type=class org.ovirt.engine.api.extensions.ExtMap;uuid=EXTENSION_INVOKE_CONTEXT[886d2ebb-312a-49ae-9cc3-e1f849834b7d];]={Extkey[name=EXTENSION_INTERFACE_VERSION_MAX;type=class java.lang.Integer;uuid=EXTENSION_INTERFACE_VERSION_MAX[f4cff49f-2717-4901-8ee9-df362446e3e7];]=0, Extkey[name=EXTENSION_LICENSE;type=class java.lang.String;uuid=EXTENSION_LICENSE[8a61ad65-054c-4e31-9c6d-1ca4d60a4c18];]=ASL 2.0, Extkey[name=EXTENSION_NOTES;type=class java.lang.String;uuid=EXTENSION_NOTES[2da5ad7e-185a-4584-aaff-97f66978e4ea];]=Display name: ovirt-engine-extension-aaa-ldap-1.0.0-1.el6, Extkey[name=EXTENSION_HOME_URL;type=class java.lang.String;uuid=EXTENSION_HOME_URL[4ad7a2f4-f969-42d4-b399-72d192e18304];]=<a href="http://www.ovirt.org">http://www.ovirt.org</a>,Extkey[name=EXTENSION_LOCALE;type=class java.lang.String;uuid=EXTENSION_LOCALE[0780b112-0ce0-404a-b85e-8765d778bb29];]=en_US, Extkey[name=EXTENSION_NAME;type=class java.lang.String;uuid=EXTENSION_NAME[651381d3-f54f-4547-bf28-b0b01a103184];]=ovirt-engine-extension-aaa-ldap.authn, Extkey[name=EXTENSION_INTERFACE_VERSION_MIN;type=class java.lang.Integer;uuid=EXTENSION_INTERFACE_VERSION_MIN[2b84fc91-305b-497b-a1d7-d961b9d2ce0b];]=0, Extkey[name=EXTENSION_CONFIGURATION;type=class java.util.Properties;uuid=EXTENSION_CONFIGURATION[2d48ab72-f0a1-4312-b4ae-5068a226b0fc];]=***, Extkey[name=EXTENSION_AUTHOR;type=class java.lang.String;uuid=EXTENSION_AUTHOR[ef242f7a-2dad-4bc5-9aad-e07018b7fbcc];]=The oVirt Project, Extkey[name=EXTENSION_INSTANCE_NAME;type=class java.lang.String;uuid=EXTENSION_INSTANCE_NAME[65c67ff6-aeca-4bd5-a245-8674327f011b];]=<a href="http://authn-ldap.example.org">authn-ldap.example.org</a>, Extkey[name=EXTENSION_BUILD_INTERFACE_VERSION;type=class java.lang.Integer;uuid=EXTENSION_BUILD_INTERFACE_VERSION[cb479e5a-4b23-46f8-aed3-56a4747a8ab7];]=0, Extkey[name=EXTENSION_CONFIGURATION_SENSITIVE_KEYS;type=interface java.util.Collection;uuid=EXTENSION_CONFIGURATION_SENSITIVE_KEYS[a456efa1-73ff-4204-9f9b-ebff01e35263];]=[], Extkey[name=AAA_AUTHN_CAPABILITIES;type=class java.lang.Long;uuid=AAA_AUTHN_CAPABILITIES[9d16bee3-10fd-46f2-83f9-3d3c54cf258d];]=12, Extkey[name=EXTENSION_GLOBAL_CONTEXT;type=class org.ovirt.engine.api.extensions.ExtMap;uuid=EXTENSION_GLOBAL_CONTEXT[9799e72f-7af6-4cf1-bf08-297bc8903676];]=*skip*, Extkey[name=EXTENSION_VERSION;type=class java.lang.String;uuid=EXTENSION_VERSION[fe35f6a8-8239-4bdb-ab1a-af9f779ce68c];]=1.0.0, Extkey[name=EXTENSION_MANAGER_TRACE_LOG;type=interface org.slf4j.Logger;uuid=EXTENSION_MANAGER_TRACE_LOG[863db666-3ea7-4751-9695-918a3197ad83];]=org.slf4j.impl.Slf4jLogger(<a href="http://org.ovirt.engine.core.extensions.mgr.ExtensionsManager.trace.ovirt-engine-extension-aaa-ldap.authn.authn-ldap.example.org">org.ovirt.engine.core.extensions.mgr.ExtensionsManager.trace.ovirt-engine-extension-aaa-ldap.authn.authn-ldap.example.org</a>), Extkey[name=EXTENSION_PROVIDES;type=interface java.util.Collection;uuid=EXTENSION_PROVIDES[8cf373a6-65b5-4594-b828-0e275087de91];]=[org.ovirt.engine.api.extensions.aaa.Authn]}, Extkey[name=AAA_AUTHN_USER;type=class java.lang.String;uuid=AAA_AUTHN_USER[1ceaba26-1bdc-4663-a3c6-5d926f9dd8f0];]=bruno, Extkey[name=EXTENSION_INVOKE_COMMAND;type=class org.ovirt.engine.api.extensions.ExtUUID;uuid=EXTENSION_INVOKE_COMMAND[485778ab-bede-4f1a-b823-77b262a2f28d];]=AAA_AUTHN_AUTHENTICATE_CREDENTIALS[d9605c75-6b43-4b00-b32c-06bdfa80244c]}</div><div> Output:</div><div> {Extkey[name=EXTENSION_INVOKE_RESULT;type=class java.lang.Integer;uuid=EXTENSION_INVOKE_RESULT[0909d91d-8bde-40fb-b6c0-099c772ddd4e];]=2, Extkey[name=EXTENSION_INVOKE_MESSAGE;type=class java.lang.String;uuid=EXTENSION_INVOKE_MESSAGE[b7b053de-dc73-4bf7-9d26-b8bdb72f5893];]=anonymous bind disallowed}</div></div><div><br></div><div>-----------------------------------</div><div><br></div><div>And this is the ldap connection log:</div><div><br></div><div><div>/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 fd=114 ACCEPT from IP=192.168.XX.XX:41469 (IP=<a href="http://0.0.0.0:389">0.0.0.0:389</a>)</div><div>/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=0 EXT oid=1.3.6.1.4.1.1466.20037</div><div>/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=0 STARTTLS</div><div>/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=0 RESULT oid= err=0 text=</div><div>/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 fd=114 TLS established tls_ssf=128 ssf=128</div><div>/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=1 BIND dn="cn=authenticate,ou=System,dc=example,dc=org" method=128</div><div>/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=1 BIND dn="cn=authenticate,ou=System,dc=example,dc=org" mech=SIMPLE ssf=0</div><div>/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=1 RESULT tag=97 err=0 text=</div></div><div><br></div><div>-----------------------------------<br></div><div><br></div><div>It looks like it got the dn correctly but it's unable to bind anyway ...</div><div><br></div><div>Thank you,</div><div><br></div><div>Bruno</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 14, 2015 at 5:50 PM, Ondra Machacek <span dir="ltr"><<a href="mailto:omachace@redhat.com" target="_blank">omachace@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<span class=""><br>
<br>
On 01/14/2015 04:53 PM, Bruno Rodriguez wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
Good afternoon,<br>
<br>
We cannot access to Ovirt using LDAP authentication against our openldap<br>
server. We created the following files in /etc/ovirt-engine/extensions.d<br></span>
(the organization name is not <a href="http://example.org" target="_blank">example.org</a> <<a href="http://example.org" target="_blank">http://example.org</a>> and the<span class=""><br>
passwords are not XXXXXXXX, obviously) :<br>
<br>
----------- /etc/ovirt-engine/extensions.<u></u>d/<a href="http://ldap.example.org" target="_blank">ldap.example.org</a><br></span>
<<a href="http://ldap.example.org" target="_blank">http://ldap.example.org</a>> -----------<br>
<br>
include = <openldap_example.properties><br>
<br>
vars.server = <a href="http://ldap1.example.org" target="_blank">ldap1.example.org</a> <<a href="http://ldap1.example.org" target="_blank">http://ldap1.example.org</a>><span class=""><br>
vars.user = cn=authenticate,ou=System,dc=<u></u>example,dc=org<br>
vars.password = "XXXXXXXX"<br>
<br>
pool.default.serverset.single.<u></u>server = ${global:vars.server}<br>
pool.default.auth.simple.<u></u>bindDN = ${global:vars.user}<br>
pool.default.auth.simple.<u></u>password = ${global:vars.password}<br>
<br>
pool.default.ssl.startTLS = true<br>
pool.default.ssl.truststore.<u></u>file =<br>
/etc/ovirt-engine/extensions.<u></u>d/ldap.example.org_keystore.<u></u>jks<br>
pool.default.ssl.truststore.<u></u>password = XXXXXXXX<br>
<br>
-----------<br>
/etc/ovirt-engine/extensions.<u></u>d/<a href="http://authn-ldap.example.org" target="_blank">authn-ldap.example.org</a>.<u></u>properties -----------<br>
<br>
</span><a href="http://ovirt.engine.extension.name" target="_blank">ovirt.engine.extension.name</a> <<a href="http://ovirt.engine.extension.name" target="_blank">http://ovirt.engine.<u></u>extension.name</a>> =<br>
<a href="http://authn-ldap.example.org" target="_blank">authn-ldap.example.org</a> <<a href="http://authn-ldap.example.org" target="_blank">http://authn-ldap.example.org</a><u></u>><span class=""><br>
ovirt.engine.extension.<u></u>bindings.method = jbossmodule<br>
ovirt.engine.extension.<u></u>binding.jbossmodule.module =<br>
org.ovirt.engine-extensions.<u></u>aaa.ldap<br>
ovirt.engine.extension.<u></u>binding.jbossmodule.class =<br>
org.ovirt.engineextensions.<u></u>aaa.ldap.AuthnExtension<br>
ovirt.engine.extension.<u></u>provides = org.ovirt.engine.api.<u></u>extensions.aaa.Authn<br>
<br>
<a href="http://ovirt.engine.aaa.authn.profile.name" target="_blank">ovirt.engine.aaa.authn.<u></u>profile.name</a><br></span>
<<a href="http://ovirt.engine.aaa.authn.profile.name" target="_blank">http://ovirt.engine.aaa.<u></u>authn.profile.name</a>> = <a href="http://ldap.example.org" target="_blank">ldap.example.org</a><br>
<<a href="http://ldap.example.org" target="_blank">http://ldap.example.org</a>><br>
ovirt.engine.aaa.authn.authz.<u></u>plugin = <a href="http://authz-ldap.example.org" target="_blank">authz-ldap.example.org</a><br>
<<a href="http://authz-ldap.example.org" target="_blank">http://authz-ldap.example.org</a><u></u>><br>
<br>
config.profile.file.1 = /etc/ovirt-engine/extensions.<u></u>d/<a href="http://ldap.example.org" target="_blank">ldap.example.org</a><br>
<<a href="http://ldap.example.org" target="_blank">http://ldap.example.org</a>><br>
<br>
-----------<br>
/etc/ovirt-engine/extensions.<u></u>d/<a href="http://authz-ldap.example.org" target="_blank">authz-ldap.example.org</a>.<u></u>properties -----------<br>
<br>
<a href="http://ovirt.engine.extension.name" target="_blank">ovirt.engine.extension.name</a> <<a href="http://ovirt.engine.extension.name" target="_blank">http://ovirt.engine.<u></u>extension.name</a>> =<br>
<a href="http://authz-ldap.example.org" target="_blank">authz-ldap.example.org</a> <<a href="http://authz-ldap.example.org" target="_blank">http://authz-ldap.example.org</a><u></u>><span class=""><br>
ovirt.engine.extension.<u></u>bindings.method = jbossmodule<br>
ovirt.engine.extension.<u></u>binding.jbossmodule.module =<br>
org.ovirt.engine-extensions.<u></u>aaa.ldap<br>
ovirt.engine.extension.<u></u>binding.jbossmodule.class =<br>
org.ovirt.engineextensions.<u></u>aaa.ldap.AuthzExtension<br>
<br>
ovirt.engine.extension.<u></u>provides = org.ovirt.engine.api.<u></u>extensions.aaa.Authz<br>
config.profile.file.1 = /etc/ovirt-engine/extensions.<u></u>d/<a href="http://ldap.example.org" target="_blank">ldap.example.org</a><br></span>
<<a href="http://ldap.example.org" target="_blank">http://ldap.example.org</a>><span class=""><br>
<br>
------------------------------<u></u>------------------<br>
<br>
After all of this we restarted the service and tried to access via the<br>
administration portal. The JKS has the right permissions and contains<br>
the TLS CA, the password is correct and the user "esthera" exists. But<br>
when we try to log in, we obtain the following error in the engine.log<br>
(we already set the verbosity to ALL):<br>
<br>
------------------------------<u></u>------------------<br>
<br>
2015-01-14 16:35:25,750 ERROR<br>
[org.ovirt.engine.core.bll.<u></u>aaa.LoginAdminUserCommand]<br>
(ajp--127.0.0.1-8702-6) Error during CanDoActionFailure.: Class: class<br>
org.ovirt.engine.core.<u></u>extensions.mgr.<u></u>ExtensionInvokeCommandFailedEx<u></u>ception<br>
Input:<br>
{Extkey[name=AAA_AUTHN_<u></u>CREDENTIALS;type=class<br>
java.lang.String;uuid=AAA_<u></u>AUTHN_CREDENTIALS[03b96485-<u></u>4bb5-4592-8167-810a5c909706];]<u></u>=***,<br>
Extkey[name=EXTENSION_INVOKE_<u></u>CONTEXT;type=class<br>
org.ovirt.engine.api.<u></u>extensions.ExtMap;uuid=<u></u>EXTENSION_INVOKE_CONTEXT[<u></u>886d2ebb-312a-49ae-9cc3-<u></u>e1f849834b7d];]={Extkey[name=<u></u>EXTENSION_INTERFACE_VERSION_<u></u>MAX;type=class<br>
java.lang.Integer;uuid=<u></u>EXTENSION_INTERFACE_VERSION_<u></u>MAX[f4cff49f-2717-4901-8ee9-<u></u>df362446e3e7];]=0,<br>
Extkey[name=EXTENSION_LICENSE;<u></u>type=class<br>
java.lang.String;uuid=<u></u>EXTENSION_LICENSE[8a61ad65-<u></u>054c-4e31-9c6d-1ca4d60a4c18];]<u></u>=ASL<br>
2.0, Extkey[name=EXTENSION_NOTES;<u></u>type=class<br>
java.lang.String;uuid=<u></u>EXTENSION_NOTES[2da5ad7e-185a-<u></u>4584-aaff-97f66978e4ea];]=<u></u>Display<br>
name: ovirt-engine-extension-aaa-<u></u>ldap-1.0.0-1.el6,<br>
Extkey[name=EXTENSION_HOME_<u></u>URL;type=class<br>
java.lang.String;uuid=<u></u>EXTENSION_HOME_URL[4ad7a2f4-<u></u>f969-42d4-b399-72d192e18304];]<u></u>=<a href="http://www.ovirt.org" target="_blank">http://www.ovirt.org</a><br></span>
<<a href="http://www.ovirt.org/" target="_blank">http://www.ovirt.org/</a>>, Extkey[name=EXTENSION_LOCALE;<u></u>type=class<span class=""><br>
java.lang.String;uuid=<u></u>EXTENSION_LOCALE[0780b112-<u></u>0ce0-404a-b85e-8765d778bb29];]<u></u>=en_US,<br>
Extkey[name=EXTENSION_NAME;<u></u>type=class<br>
java.lang.String;uuid=<u></u>EXTENSION_NAME[651381d3-f54f-<u></u>4547-bf28-b0b01a103184];]=<u></u>ovirt-engine-extension-aaa-<u></u>ldap.authn,<br>
Extkey[name=EXTENSION_<u></u>INTERFACE_VERSION_MIN;type=<u></u>class<br>
java.lang.Integer;uuid=<u></u>EXTENSION_INTERFACE_VERSION_<u></u>MIN[2b84fc91-305b-497b-a1d7-<u></u>d961b9d2ce0b];]=0,<br>
Extkey[name=EXTENSION_<u></u>CONFIGURATION;type=class<br>
java.util.Properties;uuid=<u></u>EXTENSION_CONFIGURATION[<u></u>2d48ab72-f0a1-4312-b4ae-<u></u>5068a226b0fc];]=***,<br>
Extkey[name=EXTENSION_AUTHOR;<u></u>type=class<br>
java.lang.String;uuid=<u></u>EXTENSION_AUTHOR[ef242f7a-<u></u>2dad-4bc5-9aad-e07018b7fbcc];]<u></u>=The<br>
oVirt Project, Extkey[name=EXTENSION_<u></u>INSTANCE_NAME;type=class<br>
java.lang.String;uuid=<u></u>EXTENSION_INSTANCE_NAME[<u></u>65c67ff6-aeca-4bd5-a245-<u></u>8674327f011b];]=authn-ldap.<br></span>
<<a href="http://authn-ldap.pic.es/" target="_blank">http://authn-ldap.pic.es/</a>><a href="http://example.org" target="_blank">exa<u></u>mple.org</a> <<a href="http://example.org" target="_blank">http://example.org</a>>,<span class=""><br>
Extkey[name=EXTENSION_BUILD_<u></u>INTERFACE_VERSION;type=class<br>
java.lang.Integer;uuid=<u></u>EXTENSION_BUILD_INTERFACE_<u></u>VERSION[cb479e5a-4b23-46f8-<u></u>aed3-56a4747a8ab7];]=0,<br>
Extkey[name=EXTENSION_<u></u>CONFIGURATION_SENSITIVE_KEYS;<u></u>type=interface<br>
java.util.Collection;uuid=<u></u>EXTENSION_CONFIGURATION_<u></u>SENSITIVE_KEYS[a456efa1-73ff-<u></u>4204-9f9b-ebff01e35263];]=[],<br>
Extkey[name=AAA_AUTHN_<u></u>CAPABILITIES;type=class<br>
java.lang.Long;uuid=AAA_AUTHN_<u></u>CAPABILITIES[9d16bee3-10fd-<u></u>46f2-83f9-3d3c54cf258d];]=12,<br>
Extkey[name=EXTENSION_GLOBAL_<u></u>CONTEXT;type=class<br>
org.ovirt.engine.api.<u></u>extensions.ExtMap;uuid=<u></u>EXTENSION_GLOBAL_CONTEXT[<u></u>9799e72f-7af6-4cf1-bf08-<u></u>297bc8903676];]=*skip*,<br>
Extkey[name=EXTENSION_VERSION;<u></u>type=class<br>
java.lang.String;uuid=<u></u>EXTENSION_VERSION[fe35f6a8-<u></u>8239-4bdb-ab1a-af9f779ce68c];]<u></u>=1.0.0,<br>
Extkey[name=EXTENSION_MANAGER_<u></u>TRACE_LOG;type=interface<br>
org.slf4j.Logger;uuid=<u></u>EXTENSION_MANAGER_TRACE_LOG[<u></u>863db666-3ea7-4751-9695-<u></u>918a3197ad83];]=org.slf4j.<u></u>impl.Slf4jLogger(org.ovirt.<u></u>engine.core.extensions.mgr.<u></u>ExtensionsManager.trace.ovirt-<u></u>engine-extension-aaa-ldap.<u></u>authn.authn-ldap.<br></span>
<<a href="http://org.ovirt.engine.core.extensions.mgr.extensionsmanager.trace.ovirt-engine-extension-aaa-ldap.authn.authn-ldap.pic.es/" target="_blank">http://org.ovirt.engine.core.<u></u>extensions.mgr.<u></u>extensionsmanager.trace.ovirt-<u></u>engine-extension-aaa-ldap.<u></u>authn.authn-ldap.pic.es/</a>><a href="http://example.org" target="_blank">examp<u></u>le.org</a><br>
<<a href="http://example.org" target="_blank">http://example.org</a>>), Extkey[name=EXTENSION_<u></u>PROVIDES;type=interface<span class=""><br>
java.util.Collection;uuid=<u></u>EXTENSION_PROVIDES[8cf373a6-<u></u>65b5-4594-b828-0e275087de91];]<u></u>=[org.ovirt.engine.api.<u></u>extensions.aaa.Authn]},<br>
Extkey[name=AAA_AUTHN_USER;<u></u>type=class<br>
java.lang.String;uuid=AAA_<u></u>AUTHN_USER[1ceaba26-1bdc-4663-<u></u>a3c6-5d926f9dd8f0];]=esthera,<br>
Extkey[name=EXTENSION_INVOKE_<u></u>COMMAND;type=class<br>
org.ovirt.engine.api.<u></u>extensions.ExtUUID;uuid=<u></u>EXTENSION_INVOKE_COMMAND[<u></u>485778ab-bede-4f1a-b823-<u></u>77b262a2f28d];]=AAA_AUTHN_<u></u>AUTHENTICATE_CREDENTIALS[<u></u>d9605c75-6b43-4b00-b32c-<u></u>06bdfa80244c]}<br>
Output:<br>
{Extkey[name=EXTENSION_INVOKE_<u></u>RESULT;type=class<br>
java.lang.Integer;uuid=<u></u>EXTENSION_INVOKE_RESULT[<u></u>0909d91d-8bde-40fb-b6c0-<u></u>099c772ddd4e];]=2,<br>
Extkey[name=EXTENSION_INVOKE_<u></u>MESSAGE;type=class<br>
java.lang.String;uuid=<u></u>EXTENSION_INVOKE_MESSAGE[<u></u>b7b053de-dc73-4bf7-9d26-<u></u>b8bdb72f5893];]=invalid<br>
credentials}<br>
<br>
------------------------------<u></u>------------------<br>
<br>
Having a look at the LDAP log we check that there is a "invalid<br>
credentials" error while binding, but we are sure that the bind password<br>
is the right one. We already tried to set the bind password without<br>
quotes, but then the DN user then appear as an empty string ("")<br>
</span></blockquote>
<br>
I think problem is here. That's really strange, you have to use the password without quotes.<br>
<br>
Can you please try to set:<br>
pool.default.auth.simple.<u></u>bindDN = cn=authenticate,ou=System,dc=<u></u>example,dc=org<br>
pool.default.auth.simple.<u></u>password = XXXXXX<br>
<br>
just without the variables. if the DN is not empty now.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
<br>
------------------------------<u></u>------------------<br>
<br>
[root@ldap1 ~]# grep $(grep 192.168.XX.X /var/log/ldap.log | tail -n 1 |<br>
cut -d: -f4 | cut -d\ -f2) /var/log/ldap.log<br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 ACCEPT from<br></span>
IP=192.168.XX.X:39501 <<a href="http://192.168.95.2:39501/" target="_blank">http://192.168.95.2:39501/</a>> (IP=<a href="http://0.0.0.0:389" target="_blank">0.0.0.0:389</a><br>
<<a href="http://0.0.0.0:389/" target="_blank">http://0.0.0.0:389/</a>>)<div><div class="h5"><br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 EXT<br>
oid=1.3.6.1.4.1.1466.20037<br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 STARTTLS<br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 RESULT oid= err=0 text=<br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 TLS established<br>
tls_ssf=128 ssf=128<br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=1 BIND<br>
dn="cn=authenticate,ou=System,<u></u>dc=example,dc=org" method=128<br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=1 RESULT tag=97<br>
err=49 text=<br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=2 UNBIND<br>
Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 closed<br>
<br>
------------------------------<u></u>------------------<br>
<br>
By the way, the Ovirt manager (ovmgr) machine can query correctly the<br>
openldap server and retrieves everything OK<br>
<br>
------------------------------<u></u>------------------<br>
<br>
[root@ovmgr extensions.d]# ldapsearch -ZZ -D<br>
cn=authenticate,ou=System,dc=<u></u>example,dc=org -W<br>
Enter LDAP Password:<br>
# extended LDIF<br>
#<br>
# LDAPv3<br>
# base <dc=example,dc=org> (default) with scope subtree<br>
# filter: (objectclass=*)<br>
# requesting: ALL<br>
#<br>
<br></div></div>
# <a href="http://pic.es" target="_blank">pic.es</a> <<a href="http://pic.es/" target="_blank">http://pic.es/</a>><span class=""><br>
dn: dc=example,dc=org<br>
dc: pic<br>
objectClass: top<br>
objectClass: domain<br>
<br>
------------------------------<u></u>------------------<br>
<br>
Did anybody had a similar problem ? Is there anything that we didn't check ?<br>
<br>
Thanks in advance !<br>
<br>
--<br>
Bruno Rodríguez Rodríguez<br>
<br>
<br>
<br></span>
This body part will be downloaded on demand.<br>
<br>
</blockquote>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div style="text-align:left;font-family:Arial,Tahoma,Helvetica,FreeSans,sans-serif;line-height:20px;background-color:rgb(255,255,255)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;line-height:normal">Bruno Rodríguez Rodríguez</span></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br>PIC (Port d'Informació Científica)<br>Campus UAB, Edificio D<br>E-08193 Bellaterra, Barcelona<br></div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Tel: </span><a value="+34935813322" style="color:rgb(17,85,204);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">+34 93 581 33 22</a><div><a value="+34935813322" style="color:rgb(17,85,204);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></a></div><div><a value="+34935813322" style="color:rgb(17,85,204);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><span style="color:rgb(0,0,0);font-family:Arial,Tahoma,Helvetica,FreeSans,sans-serif;font-size:small;line-height:20px">"Si algo me ha enseñado el tetris, es que los errores se acumulan y los triunfos desaparecen"</span></a></div></div>
</div>