Re: [ovirt-users] Adding users through LDAP fails on "external_id"

You should add *ONLY* the ca certificate top level to the keystore. ----- Original Message ----- > From: "Zach La Celle" <lacelle(a)roboticresearch.com&gt; > To: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; > Sent: Monday, June 15, 2015 10:54:02 PM > Subject: Re: [ovirt-users] Adding users through LDAP fails on "external_id" > > OK, started using the STARTTLS protocol. Tested working using > ldapsearch, but now ovirt-engine's engine.log complains: > > java.io.IOException: Unable to verify an attempt to to establish a > secure connection to 'directory.roboticresearch.com:389' becau\ > se an unexpected error was encountered during validation processing: > javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated > > Not sure what is wrong. We fixed this before by adding the > ca-certificates from the LDAP server as well as the LDAP server > certificate into the .jks keystore. > > On 06/15/2015 03:21 PM, Alon Bar-Lev wrote: >> ----- Original Message ----- >>> From: "Zach La Celle" <lacelle(a)roboticresearch.com&gt; >>> To: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; >>> Sent: Monday, June 15, 2015 10:14:34 PM >>> Subject: Re: [ovirt-users] Adding users through LDAP fails on >>> "external_id" >>> >>> My mistake. We're using OpenLDAP 2.4.28-1.1ubuntu4.4 on Ubuntu 12.04. >>> >>> The full configuration files are as follows (I removed commented-out >>> lines for brevity). Communications with the LDAP server seem to work >>> correctly now. >>> >>> __profile1.properties__ >>> >>> # >>> >>> # Select >>> one >>> >>> # >>> >>> include = <openldap.properties> >> reading bellow, you may want to try rfc2307-openldap as your schema seems >> to be rfc2307 compatible. >> >> <snip> >> >>> pool.default.serverset.type = single >>> pool.default.serverset.single.server = ${global:vars.server} >>> pool.default.serverset.single.port = 636 >> why do you modify port? please use startTLS on default port. >> >>> #pool.default.auth.simple.bindDN = ${global:vars.user} >>> #pool.default.auth.simple.password = ${global:vars.password} >> why did you comment this, do you allow anonymous access? >> >>> # Create keystore, import certificate chain and uncomment >>> # if using ssl/tls. >>> #pool.default.ssl.startTLS = true >> please uncomment this^ >> >>> pool.default.ssl.truststore.file = >>> ${local:_basedir}/${global:vars.server}.jks >>> pool.default.ssl.truststore.password = sdfnliwneponalsdinosaivnewal >>> >>> # TLS settings and authentication >>> pool.default.ssl.enable = true >> please do not use ssl unless startTLS is not supported, and it is in >> openldap. >> >>> pool.default.ssl.startTLS = false >> please set this to true. >> >>> pool.default.ssl.host-name-verify.enable = true >>> pool.default.ssl.host-name-verify.wildcards = false >>> pool.default.ssl.insecure = false >>> pool.default.ssl.protocol = TLSv1 >>> #pool.default.ssl.startTLSProtocol = TLSv1 >> these are the default, you do not need to add these. >> >>> pool.default.auth.type = none >> why have you set this explicitly? >> >>> # Mapping >>> attrmap.map-principal-record.attr.PrincipalRecord_DISPLAY_NAME.map = cn >>> attrmap.map-principal-record.attr.PrincipalRecord_EMAIL.map = Email >>> attrmap.map-group-record.attr.GroupRecord_DISPLAY_NAME.map = cn >> please remove mapping, it should work without. >> >>> # Variables >>> sequence.openldap-init-vars.030.var-set.value = entryUUID, uid, cn, >>> givenName, sn, Email >>> sequence.openldap-init-vars.040.var-set.value = >>> (objectClass=posixAccount)(uid=*) >>> sequence.openldap-init-vars.050.var-set.value = entryUUID, cn >>> sequence.openldap-init-vars.060.var-set.value = (objectClass=posixGroup) >>> sequence.openldap-init-vars.070.var-set.value = memberUid >> why have you added these? maybe you have rfc2307 compatible schema? >> >>> On 06/15/2015 03:07 PM, Alon Bar-Lev wrote: >>>> This probably state that you do not use the correct driver. >>>> >>>> You did not mention what LDAP server do you use, and you pasted only >>>> partial profile. >>>> >>>> ----- Original Message ----- >>>>> From: "Zach La Celle" <lacelle(a)roboticresearch.com&gt; >>>>> To: users(a)ovirt.org >>>>> Sent: Monday, June 15, 2015 10:04:47 PM >>>>> Subject: [ovirt-users] Adding users through LDAP fails on "external_id" >>>>> >>>>> Hello, >>>>> >>>>> We have a small oVirt cluster set up, and are trying to get it >>>>> integrated with our LDAP server. >>>>> >>>>> I've changed some configuration values in order to try and make it >>>>> function, and it seems to communicate correctly with the LDAP server. >>>>> However, when trying to add the user, I get the following error upon SQL >>>>> entry add: >>>>> >>>>> 2015-06-15 14:44:49,439 ERROR >>>>> [org.ovirt.engine.core.bll.aaa.AddUserCommand] (ajp--127.0.0.1-8702-6) >>>>> [3b15cbfe] Command org.ovirt.engine.core.bll.aaa.AddUserCommand throw >>>>> exception: org.springframework.da\ >>>>> o.DataIntegrityViolationException: CallableStatementCallback; SQL [{call >>>>> insertuser(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)}]; ERROR: null >>>>> value in column "external_id" violates not-null constraint >>>>> Where: SQL statement "INSERT INTO users(department, domain, email, >>>>> groups, name, note, role, active, surname, user_id, username, group_ids, >>>>> external_id,namespace) VALUES( $1 , $2 , $3 , $4 , $5 , $\ >>>>> 6 , $7 , $8 , $9 , $10 , $11 , $12 , $13 , $14 )" >>>>> PL/pgSQL function "insertuser" line 2 at SQL statement; nested exception >>>>> is org.postgresql.util.PSQLException: ERROR: null value in column >>>>> "external_id" violates not-null constraint >>>>> Where: SQL statement "INSERT INTO users(department, domain, email, >>>>> groups, name, note, role, active, surname, user_id, username, group_ids, >>>>> external_id,namespace) VALUES( $1 , $2 , $3 , $4 , $5 , $\ >>>>> 6 , $7 , $8 , $9 , $10 , $11 , $12 , $13 , $14 )" >>>>> >>>>> I can't figure out what maps from the LDAP user to "external_id" for the >>>>> SQL table entry. >>>>> >>>>> Here are the changes I made to profile1.properties: >>>>> >>>>> #Mapping changes >>>>> attrmap.map-principal-record.attr.PrincipalRecord_DISPLAY_NAME.map = cn >>>>> attrmap.map-principal-record.attr.PrincipalRecord_EMAIL.map = Email >>>>> attrmap.map-group-record.attr.GroupRecord_DISPLAY_NAME.map = cn >>>>> >>>>> #LDAP value changes >>>>> sequence.openldap-init-vars.030.var-set.value = entryUUID, uid, cn, >>>>> givenName, sn, Email >>>>> sequence.openldap-init-vars.040.var-set.value = >>>>> (objectClass=posixAccount)(uid=*) >>>>> sequence.openldap-init-vars.050.var-set.value = entryUUID, cn >>>>> sequence.openldap-init-vars.060.var-set.value = (objectClass=posixGroup) >>>>> sequence.openldap-init-vars.070.var-set.value = memberUid >>>>> >>>>> Any help is appreciated! >>>>> _______________________________________________ >>>>> Users mailing list >>>>> Users(a)ovirt.org >>>>> http://lists.ovirt.org/mailman/listinfo/users >>>>> >