<div dir="ltr">Thank you very much for the fast reply !<div><br></div><div>I grepped "org.ovirt.engineextensions.aaa.ldap" in the engine log file, but I wasn't able to get enough information for me to know which was the problem...</div><div><br></div><div><div>2015-01-14 16:04:18,575 INFO [org.ovirt.engineextensions.aaa.ldap.Framework] (MSC service thread 1-3) [ovirt-engine-extension-aaa-ldap.authz::<a href="http://authz-ldap.example.org">authz-ldap.example.org</a>] Creating LDAP pool 'authz'</div><div>2015-01-14 16:04:18,648 ERROR [org.ovirt.engineextensions.aaa.ldap.AuthzExtension] (MSC service thread 1-3) [ovirt-engine-extension-aaa-ldap.authz::<a href="http://authz-ldap.example.org">authz-ldap.example.org</a>] Cannot initialize LDAP framework, deferring initialization. Error: invalid credentials</div><div>2015-01-14 16:04:36,913 INFO [org.ovirt.engineextensions.aaa.ldap.Framework] (ajp--127.0.0.1-8702-2) [ovirt-engine-extension-aaa-ldap.authn::<a href="http://authn-ldap.example.org">authn-ldap.example.org</a>] Creating LDAP pool 'authz'</div><div>2015-01-14 16:08:34,521 INFO [org.ovirt.engineextensions.aaa.ldap.Framework] (ajp--127.0.0.1-8702-1) [ovirt-engine-extension-aaa-ldap.authn::<a href="http://authn-ldap.example.org">authn-ldap.example.org</a>] Creating LDAP pool 'authz'</div><div>2015-01-14 16:35:25,670 INFO [org.ovirt.engineextensions.aaa.ldap.Framework] (ajp--127.0.0.1-8702-6) [ovirt-engine-extension-aaa-ldap.authn::<a href="http://authn-ldap.example.org">authn-ldap.example.org</a>] Creating LDAP pool 'authz'</div><div>2015-01-14 17:44:19,769 INFO [org.ovirt.engineextensions.aaa.ldap.Framework] (MSC service thread 1-4) [ovirt-engine-extension-aaa-ldap.authn::<a href="http://authn-ldap.example.org">authn-ldap.example.org</a>] Creating LDAP pool 'authz'</div><div>2015-01-14 17:44:20,096 ERROR [org.ovirt.engineextensions.aaa.ldap.AuthnExtension] (MSC service thread 1-4) [ovirt-engine-extension-aaa-ldap.authn::<a href="http://authn-ldap.example.org">authn-ldap.example.org</a>] Cannot initialize LDAP framework, deferring initialization. Error: invalid credentials</div><div>2015-01-14 17:44:20,105 INFO [org.ovirt.engineextensions.aaa.ldap.Framework] (MSC service thread 1-4) [ovirt-engine-extension-aaa-ldap.authz::<a href="http://authz-ldap.example.org">authz-ldap.example.org</a>] Creating LDAP pool 'authz'</div><div>2015-01-14 17:44:20,178 ERROR [org.ovirt.engineextensions.aaa.ldap.AuthzExtension] (MSC service thread 1-4) [ovirt-engine-extension-aaa-ldap.authz::<a href="http://authz-ldap.example.org">authz-ldap.example.org</a>] Cannot initialize LDAP framework, deferring initialization. Error: invalid credentials</div></div><div><br></div><div>Thanks again.</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 14, 2015 at 5:08 PM, Alon Bar-Lev <span dir="ltr"><<a href="mailto:alonbl@redhat.com" target="_blank">alonbl@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi!<br>
<br>
Great information!<br>
<br>
I really need you to add the log for org.ovirt.engineextensions.aaa.ldap, see [1] so I can see the entire sequence.<br>
<br>
You are trying to authenticate the esthera user, this result in bind request using this user, so you should really try to see if bind succeeds with this user and passwod.<br>
<br>
$ ldapsearch -ZZ -D replace_with_esthera_DN -W -b 'dc=example,dc=org'<br>
<br>
It may be that the password of the user is not set or different than what you expect, or the schema is not openldap but rfc2307.<br>
<br>
Alon<br>
<br>
[1] <a href="http://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git;a=blob;f=README;hb=HEAD#l270" target="_blank">http://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git;a=blob;f=README;hb=HEAD#l270</a><br>
<span class=""><br>
----- Original Message -----<br>
> From: "Bruno Rodriguez" <<a href="mailto:bruno@pic.es">bruno@pic.es</a>><br>
> To: <a href="mailto:users@ovirt.org">users@ovirt.org</a>, "Esther Accion" <<a href="mailto:esthera@pic.es">esthera@pic.es</a>><br>
> Sent: Wednesday, January 14, 2015 5:53:06 PM<br>
> Subject: [ovirt-users] Error authenticating bind using the AAA OpenLDAP module<br>
><br>
> Good afternoon,<br>
><br>
> We cannot access to Ovirt using LDAP authentication against our openldap<br>
> server. We created the following files in /etc/ovirt-engine/extensions.d<br>
> (the organization name is not <a href="http://example.org" target="_blank">example.org</a> and the passwords are not<br>
> XXXXXXXX, obviously) :<br>
><br>
</span>> ----------- /etc/ovirt-engine/extensions.d/ <a href="http://ldap.example.org" target="_blank">ldap.example.org</a> -----------<br>
<div><div class="h5">><br>
> include = <openldap_example.properties><br>
><br>
> vars.server = <a href="http://ldap1.example.org" target="_blank">ldap1.example.org</a><br>
> vars.user = cn=authenticate,ou=System,dc=example,dc=org<br>
> vars.password = "XXXXXXXX"<br>
><br>
> pool.default.serverset.single.server = ${global:vars.server}<br>
> pool.default.auth.simple.bindDN = ${global:vars.user}<br>
> pool.default.auth.simple.password = ${global:vars.password}<br>
><br>
> pool.default.ssl.startTLS = true<br>
> pool.default.ssl.truststore.file =<br>
> /etc/ovirt-engine/extensions.d/ldap.example.org_keystore.jks<br>
> pool.default.ssl.truststore.password = XXXXXXXX<br>
><br>
> ----------- /etc/ovirt-engine/extensions.d/authn-ldap.example.org.properties<br>
> -----------<br>
><br>
> <a href="http://ovirt.engine.extension.name" target="_blank">ovirt.engine.extension.name</a> = <a href="http://authn-ldap.example.org" target="_blank">authn-ldap.example.org</a><br>
> ovirt.engine.extension.bindings.method = jbossmodule<br>
> ovirt.engine.extension.binding.jbossmodule.module =<br>
> org.ovirt.engine-extensions.aaa.ldap<br>
> ovirt.engine.extension.binding.jbossmodule.class =<br>
> org.ovirt.engineextensions.aaa.ldap.AuthnExtension<br>
> ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn<br>
><br>
> <a href="http://ovirt.engine.aaa.authn.profile.name" target="_blank">ovirt.engine.aaa.authn.profile.name</a> = <a href="http://ldap.example.org" target="_blank">ldap.example.org</a><br>
> ovirt.engine.aaa.authn.authz.plugin = <a href="http://authz-ldap.example.org" target="_blank">authz-ldap.example.org</a><br>
><br>
> config.profile.file.1 = /etc/ovirt-engine/extensions.d/ <a href="http://ldap.example.org" target="_blank">ldap.example.org</a><br>
><br>
> ----------- /etc/ovirt-engine/extensions.d/authz-ldap.example.org.properties<br>
> -----------<br>
><br>
> <a href="http://ovirt.engine.extension.name" target="_blank">ovirt.engine.extension.name</a> = <a href="http://authz-ldap.example.org" target="_blank">authz-ldap.example.org</a><br>
> ovirt.engine.extension.bindings.method = jbossmodule<br>
> ovirt.engine.extension.binding.jbossmodule.module =<br>
> org.ovirt.engine-extensions.aaa.ldap<br>
> ovirt.engine.extension.binding.jbossmodule.class =<br>
> org.ovirt.engineextensions.aaa.ldap.AuthzExtension<br>
><br>
> ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz<br>
> config.profile.file.1 = /etc/ovirt-engine/extensions.d/ <a href="http://ldap.example.org" target="_blank">ldap.example.org</a><br>
><br>
> ------------------------------------------------<br>
><br>
> After all of this we restarted the service and tried to access via the<br>
> administration portal. The JKS has the right permissions and contains the<br>
> TLS CA, the password is correct and the user "esthera" exists. But when we<br>
> try to log in, we obtain the following error in the engine.log (we already<br>
> set the verbosity to ALL):<br>
><br>
> ------------------------------------------------<br>
><br>
> 2015-01-14 16:35:25,750 ERROR [org.ovirt.engine.core.bll.<br>
> aaa.LoginAdminUserCommand] (ajp--127.0.0.1-8702-6) Error during<br>
> CanDoActionFailure.: Class: class org.ovirt.engine.core. extensions.mgr.<br>
> ExtensionInvokeCommandFailedEx ception<br>
> Input:<br>
> {Extkey[name=AAA_AUTHN_ CREDENTIALS;type=class java.lang.String;uuid=AAA_<br>
> AUTHN_CREDENTIALS[03b96485- 4bb5-4592-8167-810a5c909706];] =***,<br>
> Extkey[name=EXTENSION_INVOKE_ CONTEXT;type=class org.ovirt.engine.api.<br>
> extensions.ExtMap;uuid= EXTENSION_INVOKE_CONTEXT[ 886d2ebb-312a-49ae-9cc3-<br>
> e1f849834b7d];]={Extkey[name= EXTENSION_INTERFACE_VERSION_ MAX;type=class<br>
> java.lang.Integer;uuid= EXTENSION_INTERFACE_VERSION_<br>
</div></div>> MAX[f4cff49f-2717-4901-8ee9- df362446e3e7];]=0,<br>
<span class="">> Extkey[name=EXTENSION_LICENSE; type=class java.lang.String;uuid=<br>
</span>> EXTENSION_LICENSE[8a61ad65- 054c-4e31-9c6d-1ca4d60a4c18];] =ASL 2.0,<br>
<span class="">> Extkey[name=EXTENSION_NOTES; type=class java.lang.String;uuid=<br>
> EXTENSION_NOTES[2da5ad7e-185a- 4584-aaff-97f66978e4ea];]= Display name:<br>
> ovirt-engine-extension-aaa- ldap-1.0.0-1.el6, Extkey[name=EXTENSION_HOME_<br>
> URL;type=class java.lang.String;uuid= EXTENSION_HOME_URL[4ad7a2f4-<br>
> f969-42d4-b399-72d192e18304];] = <a href="http://www.ovirt.org" target="_blank">http://www.ovirt.org</a> ,<br>
> Extkey[name=EXTENSION_LOCALE; type=class java.lang.String;uuid=<br>
</span>> EXTENSION_LOCALE[0780b112- 0ce0-404a-b85e-8765d778bb29];] =en_US,<br>
<span class="">> Extkey[name=EXTENSION_NAME; type=class java.lang.String;uuid=<br>
> EXTENSION_NAME[651381d3-f54f- 4547-bf28-b0b01a103184];]=<br>
> ovirt-engine-extension-aaa- ldap.authn, Extkey[name=EXTENSION_<br>
> INTERFACE_VERSION_MIN;type= class java.lang.Integer;uuid=<br>
> EXTENSION_INTERFACE_VERSION_ MIN[2b84fc91-305b-497b-a1d7- d961b9d2ce0b];]=0,<br>
> Extkey[name=EXTENSION_ CONFIGURATION;type=class java.util.Properties;uuid=<br>
</span>> EXTENSION_CONFIGURATION[ 2d48ab72-f0a1-4312-b4ae- 5068a226b0fc];]=***,<br>
<span class="">> Extkey[name=EXTENSION_AUTHOR; type=class java.lang.String;uuid=<br>
> EXTENSION_AUTHOR[ef242f7a- 2dad-4bc5-9aad-e07018b7fbcc];] =The oVirt<br>
> Project, Extkey[name=EXTENSION_ INSTANCE_NAME;type=class<br>
> java.lang.String;uuid= EXTENSION_INSTANCE_NAME[ 65c67ff6-aeca-4bd5-a245-<br>
> 8674327f011b];]= authn-ldap. <a href="http://example.org" target="_blank">example.org</a> , Extkey[name=EXTENSION_BUILD_<br>
> INTERFACE_VERSION;type=class java.lang.Integer;uuid=<br>
> EXTENSION_BUILD_INTERFACE_ VERSION[cb479e5a-4b23-46f8-<br>
> aed3-56a4747a8ab7];]=0, Extkey[name=EXTENSION_ CONFIGURATION_SENSITIVE_KEYS;<br>
> type=interface java.util.Collection;uuid= EXTENSION_CONFIGURATION_<br>
> SENSITIVE_KEYS[a456efa1-73ff- 4204-9f9b-ebff01e35263];]=[],<br>
> Extkey[name=AAA_AUTHN_ CAPABILITIES;type=class<br>
> java.lang.Long;uuid=AAA_AUTHN_ CAPABILITIES[9d16bee3-10fd-<br>
> 46f2-83f9-3d3c54cf258d];]=12, Extkey[name=EXTENSION_GLOBAL_<br>
> CONTEXT;type=class org.ovirt.engine.api. extensions.ExtMap;uuid=<br>
</span>> EXTENSION_GLOBAL_CONTEXT[ 9799e72f-7af6-4cf1-bf08- 297bc8903676];]=*skip*,<br>
<span class="">> Extkey[name=EXTENSION_VERSION; type=class java.lang.String;uuid=<br>
> EXTENSION_VERSION[fe35f6a8- 8239-4bdb-ab1a-af9f779ce68c];] =1.0.0,<br>
> Extkey[name=EXTENSION_MANAGER_ TRACE_LOG;type=interface<br>
> org.slf4j.Logger;uuid= EXTENSION_MANAGER_TRACE_LOG[ 863db666-3ea7-4751-9695-<br>
> 918a3197ad83];]=org.slf4j. impl.Slf4jLogger(<br>
> org.ovirt.engine.core.extensions.mgr.ExtensionsManager.trace.ovirt-engine-extension-aaa-ldap.authn.authn-ldap.<br>
> <a href="http://example.org" target="_blank">example.org</a> ), Extkey[name=EXTENSION_ PROVIDES;type=interface<br>
> java.util.Collection;uuid= EXTENSION_PROVIDES[8cf373a6-<br>
> 65b5-4594-b828-0e275087de91];] =[org.ovirt.engine.api.<br>
> extensions.aaa.Authn]}, Extkey[name=AAA_AUTHN_USER; type=class<br>
> java.lang.String;uuid=AAA_ AUTHN_USER[1ceaba26-1bdc-4663-<br>
> a3c6-5d926f9dd8f0];]=esthera, Extkey[name=EXTENSION_INVOKE_<br>
> COMMAND;type=class org.ovirt.engine.api. extensions.ExtUUID;uuid=<br>
> EXTENSION_INVOKE_COMMAND[ 485778ab-bede-4f1a-b823-<br>
> 77b262a2f28d];]=AAA_AUTHN_ AUTHENTICATE_CREDENTIALS[<br>
> d9605c75-6b43-4b00-b32c- 06bdfa80244c]}<br>
> Output:<br>
> {Extkey[name=EXTENSION_INVOKE_ RESULT;type=class java.lang.Integer;uuid=<br>
> EXTENSION_INVOKE_RESULT[ 0909d91d-8bde-40fb-b6c0- 099c772ddd4e];]=2,<br>
> Extkey[name=EXTENSION_INVOKE_ MESSAGE;type=class java.lang.String;uuid=<br>
</span>> EXTENSION_INVOKE_MESSAGE[ b7b053de-dc73-4bf7-9d26- b8bdb72f5893];]=invalid<br>
<span class="">> credentials}<br>
><br>
> ------------------------------------------------<br>
><br>
> Having a look at the LDAP log we check that there is a "invalid credentials"<br>
> error while binding, but we are sure that the bind password is the right<br>
> one. We already tried to set the bind password without quotes, but then the<br>
> DN user then appear as an empty string ("")<br>
><br>
> ------------------------------------------------<br>
><br>
> [root@ldap1 ~]# grep $(grep 192.168.XX.X /var/log/ldap.log | tail -n 1 | cut<br>
> -d: -f4 | cut -d\ -f2) /var/log/ldap.log<br>
> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 ACCEPT from IP=<br>
> 192.168.XX.X:39501 (IP= <a href="http://0.0.0.0:389" target="_blank">0.0.0.0:389</a> )<br>
> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 EXT<br>
> oid=1.3.6.1.4.1.1466.20037<br>
> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 STARTTLS<br>
> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 RESULT oid= err=0 text=<br>
> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 TLS established<br>
> tls_ssf=128 ssf=128<br>
> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=1 BIND<br>
</span>> dn="cn=authenticate,ou=System, dc=example,dc=org" method=128<br>
<span class="">> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=1 RESULT tag=97 err=49<br>
> text=<br>
> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=2 UNBIND<br>
> Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 closed<br>
><br>
> ------------------------------------------------<br>
><br>
> By the way, the Ovirt manager (ovmgr) machine can query correctly the<br>
> openldap server and retrieves everything OK<br>
><br>
> ------------------------------------------------<br>
><br>
> [root@ovmgr extensions.d]# ldapsearch -ZZ -D<br>
</span>> cn=authenticate,ou=System,dc=example ,dc=org -W<br>
<span class="">> Enter LDAP Password:<br>
> # extended LDIF<br>
> #<br>
> # LDAPv3<br>
> # base <dc=example,dc=org> (default) with scope subtree<br>
> # filter: (objectclass=*)<br>
> # requesting: ALL<br>
> #<br>
><br>
> # <a href="http://pic.es" target="_blank">pic.es</a><br>
> dn: dc=example,dc=org<br>
> dc: pic<br>
> objectClass: top<br>
> objectClass: domain<br>
><br>
> ------------------------------------------------<br>
><br>
> Did anybody had a similar problem ? Is there anything that we didn't check ?<br>
><br>
> Thanks in advance !<br>
><br>
> --<br>
> Bruno Rodríguez Rodríguez<br>
><br>
><br>
</span>> _______________________________________________<br>
> Users mailing list<br>
> <a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
> <a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div style="text-align:left;font-family:Arial,Tahoma,Helvetica,FreeSans,sans-serif;line-height:20px;background-color:rgb(255,255,255)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;line-height:normal">Bruno Rodríguez Rodríguez</span></div><div style="color:rgb(80,0,80);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br>PIC (Port d'Informació Científica)<br>Campus UAB, Edificio D<br>E-08193 Bellaterra, Barcelona<br></div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">Tel: </span><a value="+34935813322" style="color:rgb(17,85,204);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">+34 93 581 33 22</a><div><a value="+34935813322" style="color:rgb(17,85,204);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><br></a></div><div><a value="+34935813322" style="color:rgb(17,85,204);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)"><span style="color:rgb(0,0,0);font-family:Arial,Tahoma,Helvetica,FreeSans,sans-serif;font-size:small;line-height:20px">"Si algo me ha enseñado el tetris, es que los errores se acumulan y los triunfos desaparecen"</span></a></div></div>
</div>