Re: [ovirt-users] oVirt 3.6 AAA LDAP cannot not log in when end of UPN is different from domain base

What the heck, my message disappeares! Trying again. Ok, so it's mapping now but the only thing working is: config.mapUser.regex.pattern = user(a)baz.foo.bar config.mapUser.regex.replacement = user(a)foo.bar And that isn't very useful. Please advice! /K On 03/25/2016 12:26 AM, Karli Sjöberg wrote: > > Den 25 mars 2016 12:10 fm skrev Karli Sjöberg <karli.sjoberg(a)slu.se&gt;: > > > > > > Den 24 mars 2016 11:26 em skrev Ondra Machacek <omachace(a)redhat.com&gt;: > > > > > > On 03/24/2016 11:14 PM, Karli Sjöberg wrote: > > > > > > > > Den 24 mars 2016 7:26 em skrev Ondra Machacek <omachace(a)redhat.com&gt;: > > > > > > > > > > On 03/24/2016 06:16 PM, Karli Sjöberg wrote: > > > > > > Hi! > > > > > > > > > > > > > > > > > > Starting new thread instead of jacking someone else´s. > > > > > > > > > > > > > > > > > > Managed to migrate from old 'engine-manage-domains' auth to > > > > aaa-ldap using: > > > > > > > > > > > > #| ovirt-engine-kerbldap-migration-tool --domain baz.foo.bar > --cacert > > > > > > /tmp/ca.crt --apply > > > > > > | > > > > > > > > > > > > > > > > > > All OK, no errors, but cannot log in: > > > > > > > > > > > > # ovirt-engine-extensions-tool aaa login-user > --profile=baz.foo.bar-new > > > > > > --user-name=user: > > > > > > > > > > If you want to login with user with different upn suffix, then > just > > > > > append that suffix > > > > > > > > > > $ ovirt-engine-extensions-tool aaa login-user > --profile=baz.foo.bar-new > > > > > --user-name=user(a)foo.bar > > > > > > > > OK, some progress, that works! > > > > > > > > > > > > > > If you have more suffixes and want to have some as default you > can use > > > > > following approach: > > > > > > > > > > 1) install ovirt-engine-extension-aaa-misc > > > > > > > > > > 2) create new mapping extension like this: > > > > > /etc/ovirt-engine/extensions.d/mapping-suffix.properties > > > > > > > > > > ovirt.engine.extension.name = mapping-suffix > > > > > ovirt.engine.extension.bindings.method = jbossmodule > > > > > ovirt.engine.extension.binding.jbossmodule.module = > > > > > org.ovirt.engine-extensions.aaa.misc > > > > > ovirt.engine.extension.binding.jbossmodule.class = > > > > > org.ovirt.engineextensions.aaa.misc.mapping.MappingExtension > > > > > ovirt.engine.extension.provides = > > > > > org.ovirt.engine.api.extensions.aaa.Mapping > > > > > config.mapUser.type = regex > > > > > config.mapUser.pattern = ^(?<user>[^@]*)$ > > > > > > > > Is that supposed to really say '<user>' or should it be changed to a > > > > real user name? Either way, it doesn't work, I tried it all. > > > > > > '?<user>' is just a named group in that regex so you can later use > it in > > > 'config.mapUser.replacement' option. It should take everything until > > > first '@'. > > > > > > > > > > > > config.mapUser.replacement = ${user}(a)foo.bar > > > > > config.mapUser.mustMatch = false > > > > > > > > > > 3) select a mapping plugin in authn configuration: > > > > > > > > > > ovirt.engine.aaa.authn.mapping.plugin = mapping-suffix > > > > > > > > > > With above configuration in use, your user 'user' witll be > mapped to > > > > > user &#39;user(a)foo.bar&#39; > > > > > and users &#39;user(a)anotherdomain.foo.bar&#39; will remain > > > > > &#39;user(a)anotherdomain.foo.bar&#39;. > > > > > > > > This however does not, it doesn't replace the suffix as it's supposed > > > > to. I tried with many different types of the 'mapUser.pattern' but it > > > > simply won't change it, even if I type in '= ^user(a)baz.foo.bar$&#39;, the > > > > error is the same:( > > > > > > Hmm, hard to say what's wrong, try to run: > > > $ ovirt-engine-extensions-tool --log-level=FINEST aaa login-user > > > --profile=baz.foo.bar-new --user-name=user > > > > > > and search for a mapping part in log. > > > > Wow what a mouthfull:) Can you make anything out of it? > > > > https://dropoff.slu.se/index.php/s/EMe2NPmOfsWCNTv/download > > > > /K > > Just noticed after logging in to webadmin as &quot;user(a)foo.bar&quot; (which > worked btw, so good there) that the "User Name" in Users main tab looks > really odd: > user@foo.bar(a)baz.foo.bar-new-authz Sorry you are right, it don't work. I've sent you incorrect cofiguration, the correct one is: /etc/ovirt-engine/extensions.d/mapping-suffix.properties ... config.mapUser.regex.pattern = ^(?<user>[^@]*)$ config.mapUser.regex.replacement = ${user}(a)foo.bar config.mapUser.regex.mustMatch = false ... Notice there was missing 'regex', after 'mapUser'. > > /K > > > > > > > > > > > > > > /K > > > > > > > > > > > > > > > > > > > > > API: <--Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS > result=SUCCESS > > > > > > > > > > > > > > > > > > but: > > > > > > > > > > > > API: -->Authz.InvokeCommands.FETCH_PRINCIPAL_RECORD > > > > > > principal=&#39;user(a)baz.foo.bar&#39; > > > > > > SEVERE Cannot resolve principal &#39;user(a)baz.foo.bar&#39; > > > > > > > > > > > > > > > > > > So it fails. > > > > > > > > > > > > > > > > > > # ldapsearch -x -H ldap://baz.foo.bar -D user(a)foo.bar -W -b > > > > > > DC=baz,DC=foo,DC=bar -s sub "(samAccountName=user)" > userPrincipalName | > > > > > > grep 'userPrincipalName:' > > > > > > > > > > > > userPrincipalName: user(a)foo.bar > > > > > > > > > > > > > > > > > > |How do you configure AAA with base 'DC=baz,DC=foo,DC=bar' when > > > > > > userPrincipalName ends only on &#39;(a)foo.bar&#39;? > > > > > > > > > > > > /K > > > > > > | > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > Users mailing list > > > > > > Users(a)ovirt.org > > > > > > http://lists.ovirt.org/mailman/listinfo/users > > > > > > > > > > >