9:19 p.m.
True LDAP does not require a password encryption method and is
perfectly happy with cleartext storage and use.
In practice, one uses a secure channel (LDAPS or Starttls or encrypted
network) and most LDAP servers (such as OpenLDAP) will allow several
different kinds of password encryption.
An application, though, should not ever deal with this issue. The
password should be validated by doing a BIND operation, and the
application should not do any READ operations on the userPassword
value at any time, only authenticate operations. Let the LDAP server
manage authentication.
Groups are harder. You cannot rely on the presence of a memberOf
attribute, unfortunately, and schema are contextually meaningless, so
you need a way for the directory administrator to tell the client code
how groups are being stored in the server. Thierry gives one example,
another is groupOfNames using a "member" attribute containing DNs of
members. Those are the two most common methods, but there are more.
--Charlie
On Tue, Dec 4, 2012 at 2:31 AM, Thierry Kauffmann
<thierry.kauffmann(a)univ-montp2.fr> wrote:
Le 04/12/2012 00:51, Itamar Heim a écrit :
On 11/30/2012 12:30 PM, Thierry Kauffmann wrote:
Hi,
I am currently testing Ovirt 3.1 standalone on Fedora 17.
Until now, I could only use the default user admin@internal.
Our Directory at the University is OpenLDAP. We use it for
authentication WITHOUT Kerberos : Simple authentication.
just wondering, i'm sure it is encrypted somehow, do you know which way?
also, when using openldap, which scheme are you using?
thanks,
Itamar
Hi,
the password is transmitted by the client encrypted (hashed) to the openldap server.
We use the standard schemes delivered by openldap : core, cosine, nis, inetorgperson and
samba
A normal user dn is : uid=username,ou=Users,dc=example,dc=com
A normal group dn is : cn=groupname,ou=Groups,dc=example,dc=com
Group members are a list of values for the attribute "memberUid" of a group
dn.
regards,
Thierry
I wonder how to use this backend to authenticate users and manage groups
in Ovirt.
Has anyone already set this up ?
How to configure Ovirt to use Simple Authentication (No Kerberos).
Cheers,
--
signature-TK Thierry Kauffmann
Chef du Service Informatique // Faculté des Sciences // Université de
Montpellier 2
SIF - Service Informatique de la Faculté des Sciences
<http://sif.info-ufr.univ-montp2.fr/> UM2 - Université de Montpellier 2
<http://www.univ-montp2.fr/> Service informatique de la Faculté des
Sciences (SIF)
Université de Montpellier 2
CC437 // Place Eugène Bataillon // 34095 Montpellier Cedex 5
Tél : 04 67 14 31 58
email : thierry.kauffmann(a)univ-montp2.fr
<mailto:thierry.kauffmann@univ-montp2.fr>
web : http://sif.info-ufr.univ-montp2.fr/ http://www.fdsweb.univ-montp2.fr/
_______________________________________________
Users mailing list
Users(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
--
Thierry Kauffmann
Chef du Service Informatique // Faculté des Sciences // Université de Montpellier 2
Service informatique de la Faculté des Sciences (SIF)
Université de Montpellier 2
CC437 // Place Eugène Bataillon // 34095 Montpellier Cedex 5
Tél : 04 67 14 31 58
email : thierry.kauffmann(a)univ-montp2.fr
web : http://sif.info-ufr.univ-montp2.fr/ http://www.fdsweb.univ-montp2.fr/
_______________________________________________
Users mailing list
Users(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/users