<html>
<body>
<br>
On 01/22/2015 12:59 PM, Alon Bar-Lev wrote: <br>
<font color="#000000">> </font><br>
<font color="#000000">> ----- Original Message ----- </font><br>
<font color="#000000">>> From: "Jorick Astrego" <j.astrego@<a href="mailto:netbulae.eu">netbulae.eu</a>> </font><br>
<font color="#000000">>> To: users@<a href="mailto:ovirt.org">ovirt.org</a> </font><br>
<font color="#000000">>> Sent: Thursday, January 22, 2015 1:41:40 PM </font><br>
<font color="#000000">>> Subject: Re: [ovirt-users] oVirt 3.5 and FreeIpa </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> On 10/31/2014 02:47 PM, Marcelo Donato wrote: </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> Below the solution. Resolved By "Alon Bar-Lev" < alonbl@<a href="mailto:redhat.com">redhat.com</a> > </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> 1. install ovirt-engine-extension-aaa- ldap, it is available in </font><br>
<font color="#000000">>> ovirt-3.5-snapshots repository. </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> 2. create /etc/ovirt-engine/extensions. d/din.intranet-authz. properties </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> ovirt.engine.extension.name = din-intranet-authz </font><br>
<font color="#000000">>> ovirt.engine.extension. bindings.method = jbossmodule </font><br>
<font color="#000000">>> ovirt.engine.extension. binding.jbossmodule.module = </font><br>
<font color="#000000">>> org.ovirt.engine-extensions. aaa.ldap </font><br>
<font color="#000000">>> ovirt.engine.extension. binding.jbossmodule.class = </font><br>
<font color="#000000">>> org.ovirt.engineextensions. aaa.ldap.AuthzExtension </font><br>
<font color="#000000">>> ovirt.engine.extension. provides = org.ovirt.engine.api. extensions.aaa.Authz </font><br>
<font color="#000000">>> config.profile.file.1 = /etc/ovirt-engine/aaa/din. intranet.properties </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> 3. create /etc/ovirt-engine/extensions. d/din.intranet-authn. properties </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> ovirt.engine.extension.name = din-intranet-authn </font><br>
<font color="#000000">>> ovirt.engine.extension. bindings.method = jbossmodule </font><br>
<font color="#000000">>> ovirt.engine.extension. binding.jbossmodule.module = </font><br>
<font color="#000000">>> org.ovirt.engine-extensions. aaa.ldap </font><br>
<font color="#000000">>> ovirt.engine.extension. binding.jbossmodule.class = </font><br>
<font color="#000000">>> org.ovirt.engineextensions. aaa.ldap.AuthnExtension </font><br>
<font color="#000000">>> ovirt.engine.extension. provides = org.ovirt.engine.api. extensions.aaa.Authn </font><br>
<font color="#000000">>> ovirt.engine.aaa.authn.profile.name = din.intranet </font><br>
<font color="#000000">>> ovirt.engine.aaa.authn.authz. plugin = din-intranet-authz </font><br>
<font color="#000000">>> config.profile.file.1 = /etc/ovirt-engine/aaa/din. intranet.properties </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> 4. create /etc/ovirt-engine/aaa/din. intranet.properties </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> include = <ipa.properties> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> vars.user = uid=admin,cn=users,cn= accounts,dc=din,dc=intranet </font><br>
<font color="#000000">>> vars.password = 123456 </font><br>
<font color="#000000">>> vars.server = ipa1.din.intranet </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> pool.default.serverset.single. server = ${global:vars.server} </font><br>
<font color="#000000">>> pool.default.auth.simple. bindDN = ${global:vars.user} </font><br>
<font color="#000000">>> pool.default.auth.simple. password = ${global:vars.password} </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> 5. restart engine. </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> Thanks a lot Alon. </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> Thanks for this, saved me some time! </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> Just a couple of addtions, please hash the password with SSHA (I really hate </font><br>
<font color="#000000">>> plain text admin passwords...) </font><br>
<font color="#000000">>> I tried putting an {SSHA} encoded password in " vars.password =" , but it </font><br>
<font color="#000000">>> fails to authenticate while plain text works fine. </font><br>
<font color="#000000">> I am unsure I understand. </font><br>
<font color="#000000">> using hash to store password hint at server side makes sense. </font><br>
<font color="#000000">> but using hash to store password at client side does not makes sens, this means that if I get the server database I can authenticate to any user without knowing his password. </font><br>
<font color="#000000">> </font><br>
<font color="#000000">> Also, please note that the user you specify within configuration should not have any special privilege but to query public objects within ldap. </font><br>
I don't like storing plain text in textfiles, so I try to avoid it. Even <br>
if it is a read only user there are no "public" objects that I like to <br>
expose to anyone. I can query groups, group members, e-mail addresses, <br>
krbPasswordExpiration, krbLastPwdChange etc. with this user. <br>
<br>
So that's why I try to have the bind user password hashed in the <br>
properties file. <br>
<font color="#000000">>> For people with multiple ipa replica's I you guess you need to use: </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> Round robin configuration: vars.server1 = ipa1.din.intranet </font><br>
<font color="#000000">>> vars.server2 = ipa2.din.intranet pool.default.serverset.type = </font><br>
<font color="#000000">>> round-robin </font><br>
<font color="#000000">>> pool.default.serverset.round-robin.1.server = ${global:vars.server1} </font><br>
<font color="#000000">>> pool.default.serverset.round-robin.2.server = ${global:vars.server2} </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> instead of </font><br>
<font color="#000000">>> </font><br>
<font color="#000000">>> vars.server = ipa1.din.intranet pool.default.serverset.single.server = </font><br>
<font color="#000000">>> ${global:vars.server} </font><br>
<font color="#000000">>> But I still have to test that as our second replica is down at the moment. </font><br>
<font color="#000000">> Correct, there are multiple policies for you to choose from. </font><br>
<font color="#000000">> </font><br>
<font color="#000000">>> Also can we get rid of the internal admin or better just disable internal </font><br>
<font color="#000000">>> authenticationt </font><br>
without problems? As we have ipa we don't want local login <br>
<font color="#000000">>> enabled, but in emergency situations we might need to turn it on quickly. </font><br>
<font color="#000000">> Yes, you can disable the internal by creating /etc/ovirt-engine/engine.conf.d/50-disable-internal.conf </font><br>
<font color="#000000">> --- </font><br>
<font color="#000000">> ENGINE_EXTENSION_ENABLED_builtin-authn-internal = false </font><br>
<font color="#000000">> --- </font><br>
<font color="#000000">> </font><br>
<font color="#000000">> Hmmm.... we have a bug in this case... will fix, so let's just disable the authz for now. </font><br>
<font color="#000000">> --- </font><br>
<font color="#000000">> ENGINE_EXTENSION_ENABLED_internal = false </font><br>
<font color="#000000">> --- </font><br>
<font color="#000000">> </font><br>
<font color="#000000">> Regards, </font><br>
<font color="#000000">> Alon </font><br>
thanks! that will work. <br>
<br>
<br>
<BR />
<BR />
<b style="color:#604c78"></b><br><span style="color:#604c78;"><font color="000000"><span style="mso-fareast-language:en-gb;" lang="NL">Met vriendelijke groet, With kind regards,<br><br></span>Jorick Astrego</font></span><b style="color:#604c78"><br><br>Netbulae Virtualization Experts </b><br><hr style="border:none;border-top:1px solid #ccc;"><table style="width: 522px"><tbody><tr><td style="width: 130px;font-size: 10px">Tel: 053 20 30 270</td> <td style="width: 130px;font-size: 10px">info@netbulae.eu</td> <td style="width: 130px;font-size: 10px">Staalsteden 4-3A</td> <td style="width: 130px;font-size: 10px">KvK 08198180</td></tr><tr> <td style="width: 130px;font-size: 10px">Fax: 053 20 30 271</td> <td style="width: 130px;font-size: 10px">www.netbulae.eu</td> <td style="width: 130px;font-size: 10px">7547 TA Enschede</td> <td style="width: 130px;font-size: 10px">BTW NL821234584B01</td></tr></tbody></table><br><hr style="border:none;border-top:1px solid #ccc;"><BR />
</body>
</html>