<div dir="ltr">I&#39;m trying to set up the new 3.5 AAA LDAP Auth, but it&#39;s lacking some serious detail in documentation, the rest is java-programmer-oriented docs only that I can find;<div><br></div><div><a href="https://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git">https://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git</a><br></div><div><br></div><div>Here&#39;s a sample config (sanitized) that I need to adapt to ovirt; *I HAVE NO control over the LDAP server.</div><div><br></div><div>So far I&#39;ve managed to figure out through search after search to use LDAPS (TLS isn&#39;t an option, thanks!)</div><div>Two parts I can&#39;t figure out; setting rootDN and setting the organization filter-- members of that particular organization should have access to ovirt, and none others.</div><div><br></div><div><div>vars.server = <a href="http://directory.ft.com">directory.ft.com</a></div><div><br></div><div>#</div><div># Search user and its password.</div><div>#</div><div>vars.user = uid=newproductslab,cn=users,cn=accounts,dc=corp,dc=ft,dc=com</div><div>vars.urootdn = cn=users,cn=accounts,dc=corp,dc=ft,dc=com</div><div>vars.password = <span style="color:rgb(122,71,7);line-height:19.1099987030029px">Ft######</span></div><div><br></div><div>pool.default.serverset.single.server = ${global:vars.server}</div><div>pool.default.serverset.single.port = 636</div><div>pool.default.auth.simple.bindDN = ${global:vars.user}</div><div>pool.default.auth.simple.rootDN = ${global:vars.urootdn}</div><div>pool.default.auth.simple.password = ${global:vars.password}</div><div><br></div><div># enable SSL</div><div>pool.default.ssl.enable = true</div><div>#pool.default.ssl.insecure = false</div><div><br></div><div># Create keystore, import certificate chain and uncomment</div><div># if using ssl/tls.</div><div>#pool.default.ssl.startTLS = true</div><div>pool.default.ssl.truststore.file = ${local:_basedir}/${global:vars.server}.jks</div><div>pool.default.ssl.truststore.password = changeit</div></div><div><br></div><div><br></div><div><pre style="width:auto;color:rgb(122,71,7);line-height:19.1099987030029px;overflow:auto!important">example config from testlink
$tlCfg-&gt;authentication[&#39;method&#39;] = &#39;LDAP&#39;;

/** LDAP authentication credentials */
$tlCfg-&gt;authentication[&#39;ldap_server&#39;] = &#39;ldaps://<a href="http://directory.ft.com">directory.ft.com</a>&#39;;
$tlCfg-&gt;authentication[&#39;ldap_port&#39;] = &#39;636&#39;;
$tlCfg-&gt;authentication[&#39;ldap_version&#39;] = &#39;3&#39;;
$tlCfg-&gt;authentication[&#39;ldap_root_dn&#39;] = &#39;cn=users,cn=accounts,dc=corp,dc=ft,dc=com&#39;;
$tlCfg-&gt;authentication[&#39;ldap_bind_dn&#39;] = &#39;uid=newproductslab,cn=users,cn=accounts,dc=corp,dc=ft,dc=com&#39;;
$tlCfg-&gt;authentication[&#39;ldap_bind_passwd&#39;] = &#39;Ft######&#39;;
$tlCfg-&gt;authentication[&#39;ldap_tls&#39;] = false; // true -&gt; use tls
$tlCfg-&gt;authentication[&#39;ldap_organization&#39;] = &#39;(nsRoleDN=cn=newproductslab,cn=accounts,dc=corp,dc=ft,dc=com)&#39;; // e.g. &#39;(organizationname=*Traffic)&#39;
$tlCfg-&gt;authentication[&#39;ldap_uid_field&#39;] = &#39;uid&#39;; // Use &#39;sAMAccountName&#39; for Active Directory</pre></div></div>