12:39 p.m.
Hello oVirt guru's!
I want to configure MS Active Directory authentication for oVirt web UI.
I configured an External LDAP Provider in accordance with the instructions:
Link #1)
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtuali...
Link #2)
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtuali...
For support LDAP over TLS I did file with all Root certificates
(~/AD-LDAP-Files/myrootca_chain.pem).
Check file:
$ openssl verify -CAfile ~/AD-LDAP-Files/myrootca_chain.pem
~/AD-LDAP-Files/ldapserver.pem
/root/AD-LDAP-Files/end.pem: OK
Then I create JKS (Java Key Store) file (as described in Link #2):
# keytool -importcert -noprompt -trustcacerts -alias myrootcachain -file
~/AD-LDAP-Files/myrootca_chain.pem -keystore /etc/ovirt-engine/aaa/myrootca.jks -storepass
changeit
Certificate was added to keystore
Then I run ovirt-engine-extension-aaa-ldap-setup:
# ovirt-engine-extension-aaa-ldap-setup
[ INFO ] Stage: Initializing
[ INFO ] Stage: Environment setup
Configuration files:
['/etc/ovirt-engine-extension-aaa-ldap-setup.conf.d/10-packaging.conf']
Log file: /tmp/ovirt-engine-extension-aaa-ldap-setup-20160927202843-npv8ru.log
Version: otopi-1.5.2 (otopi-1.5.2-1.el7.centos)
[ INFO ] Stage: Environment packages setup
[ INFO ] Stage: Programs detection
[ INFO ] Stage: Environment customization
Welcome to LDAP extension configuration program
Available LDAP implementations:
1 - 389ds
2 - 389ds RFC-2307 Schema
3 - Active Directory
4 - IPA
5 - Novell eDirectory RFC-2307 Schema
6 - OpenLDAP RFC-2307 Schema
7 - OpenLDAP Standard Schema
8 - Oracle Unified Directory RFC-2307 Schema
9 - RFC-2307 Schema (Generic)
10 - RHDS
11 - RHDS RFC-2307 Schema
12 - iPlanet
Please select: 3
Please enter Active Directory Forest name: holding.com
[ INFO ] Resolving Global Catalog SRV record for holding.com
[ INFO ] Resolving LDAP SRV record for holding.com
NOTE:
It is highly recommended to use secure protocol to access the LDAP server.
Protocol startTLS is the standard recommended method to do so.
Only in cases in which the startTLS is not supported, fallback to non standard
ldaps protocol.
Use plain for test environments only.
Please select protocol to use (startTLS, ldaps, plain) [startTLS]:
Please select method to obtain PEM encoded CA certificate (File, URL, Inline,
System, Insecure): File
File path: /etc/ovirt-engine/aaa/myrootca.jks
[ ERROR ] Invalid CA certificate: unknown error (_ssl.c:2988)
Please select method to obtain PEM encoded CA certificate (File, URL, Inline,
System, Insecure):
In the log /tmp/ovirt-engine-extension-aaa-ldap-setup-20160927202843-npv8ru.log:
...
2016-09-27 20:28:57 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204
DIALOG:SEND Please select method to obtain PEM encoded CA certificate
(File, URL, Inline, System, Insecure):
2016-09-27 20:29:01 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204
DIALOG:RECEIVE File
2016-09-27 20:29:01 DEBUG otopi.plugins.otopi.dialog.human human.queryString:145 query
OVAAALDAP_LDAP_CACERT_FILE
2016-09-27 20:29:01 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204
DIALOG:SEND File path:
2016-09-27 20:29:10 DEBUG otopi.plugins.otopi.dialog.human dialog.__logString:204
DIALOG:RECEIVE /etc/ovirt-engine/aaa/myrootca.jks
2016-09-27 20:29:10 ERROR otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common
common._customization_late:756 Invalid CA certificate: unknown error (_ssl.c:2988)
2016-09-27 20:29:10 DEBUG otopi.plugins.ovirt_engine_extension_aaa_ldap.ldap.common
common._customization_late:757 Exception
Traceback (most recent call last):
File
"/usr/share/ovirt-engine-extension-aaa-ldap/setup/bin/../plugins/ovirt-engine-extension-aaa-ldap/ldap/common.py",
line 748, in _customization_late
cacert, cacertfile, insecure = self._getCACert()
File
"/usr/share/ovirt-engine-extension-aaa-ldap/setup/bin/../plugins/ovirt-engine-extension-aaa-ldap/ldap/common.py",
line 366, in _getCACert
error=e,
SoftRuntimeError: Invalid CA certificate: unknown error (_ssl.c:2988)
Tell me, please, what am I doing wrong.