12:53 p.m.
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--2LvNVti3HDOn1MhIrbe5B2snDhjNOnQPn
Content-Type: multipart/mixed; boundary="cUgn38JlIV4VKxpoXvonH2a8Rp00918Nu";
protected-headers="v1"
From: Richard Neuboeck <hawk(a)tbi.univie.ac.at>
To: users <users(a)ovirt.org>
Message-ID: <ce3a6463-b08d-6af6-8adc-66f236ce0bed(a)tbi.univie.ac.at>
Subject: Re: [ovirt-users] Unable to add permissions for LDAP users
References: <71057a13-ee3d-aba0-b005-9fcbc906f375(a)tbi.univie.ac.at>
In-Reply-To: <71057a13-ee3d-aba0-b005-9fcbc906f375(a)tbi.univie.ac.at>
--cUgn38JlIV4VKxpoXvonH2a8Rp00918Nu
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
On 03/10/2017 09:46 AM, Ondra Machacek wrote:
So what's your provider 389ds or FreeIPA?
=20
Note that both use differrent unique ID. IPA is using 'ipaUniqueID',
and 389ds is using 'nsuniqueid'. DId you tried both?
Thanks for pointing that out! It works perfectly if I use IPA.
I didn't know they have different identifiers (though it might have
been obvious to me since there is a separate IPA option...). I clung
to the thought that FreeIPA uses 389ds internally.
Thanks a lot!
Richard
=20
I can successfully run a search and also login
from the setup script.
=20
After running the setup I rebootet the Engine VM to make sure
everything is restarted.
=20
In the web UI configuration for 'System Permissions' I'm able to
find users from LDAP but when I try to 'Add' a selected user the UI=
shows me this error: 'User admin@internal-authz failed to
grant
permission for Role SuperUser on System to User/Group <UNKNOWN>.'.
=20
In then engine.log the following lines are generated:
2017-03-09 14:02:49,308+01 INFO
[org.ovirt.engine.core.bll.AddSystemPermissionCommand]
(org.ovirt.thread.pool-6-thread-4)
[1ebae5e0-e5f6-49ba-ac80-95266c582893] Running command:
AddSystemPermissionCommand internal: false. Entities affected : ID=
:
aaa00000-0000-0000-0000-123456789aaa Type: SystemAction group
MANIPULATE_PERMISSIONS with role type USER, ID:
aaa00000-0000-0000-0000-123456789aaa Type: SystemAction group
ADD_USERS_AND_GROUPS_FROM_DIRECTORY with role type USER
2017-03-09 14:02:49,319+01 ERROR
[org.ovirt.engine.core.bll.AddSystemPermissionCommand]
(org.ovirt.thread.pool-6-thread-4)
[1ebae5e0-e5f6-49ba-ac80-95266c582893] Transaction rolled-back for
command 'org.ovirt.engine.core.bll.AddSystemPermissionCommand'.
2017-03-09 14:02:49,328+01 ERROR
[org.ovirt.engine.core.dal.dbbroker.auditloghandling.AuditLogDirect=
or]
(org.ovirt.thread.pool-6-thread-4)
[1ebae5e0-e5f6-49ba-ac80-95266c582893] EVENT_ID:
USER_ADD_SYSTEM_PERMISSION_FAILED(867), Correlation ID:
1ebae5e0-e5f6-49ba-ac80-95266c582893, Call Stack: null, Custom Even=
t
ID: -1, Message: User admin@internal-authz failed to grant
permission for Role SuperUser on System to User/Group <UNKNOWN>.
=20
=20
So far I've re-run the ldap-setup routine. I made sure all newly
generated files in /etc/ovirt-engine/[aaa|extensions.d] are owned b=
y
ovirt:ovirt (instead of root) and have 0600 as permission
(instead
of 0644). That didn't change anything.
=20
I've also found an older bug report but for oVirt 3.5
https://bugzilla.redhat.com/show_bug.cgi?id=3D1121954
<https://bugzilla.redhat.com/show_bug.cgi?id=3D1121954>
That didn't reveal any new either.
=20
Any ideas what I could try next?
=20
Thanks!
Cheers
Richard
=20
=20
=20
=20
On 10/06/2016 04:36 PM, Ondra Machacek wrote:
> On 10/06/2016 01:47 PM, Michael Burch wrote:
>> I'm using the latest ovirt on CentOS7 with the aaa-ldap
extension.
>> I can
>> successfully authenticate as an LDAP user. I can also login as
>> admin@internal and search for, find, and select LDAP users but I=
>> cannot
>> add permissions for them. Each time I get the error "User
>> admin@internal-authz failed to grant permission for Role
UserRole on
>> System to User/Group <UNKNOWN>."
>
> This error usually means bad unique attribute used.
>
>>
>>
>> I have no control over the LDAP server, which uses custom
>> objectClasses
>> and uses groupOfNames instead of PosixGroups. I assume I need
to set
>> sequence variables to accommodate our group configuration but I'=
m
>> at a
>> loss as to where to begin. the The config I have is as follows:
>>
>>
>> include =3D <rfc2307-generic.properties>
>>
>> vars.server =3D labauth.lan.lab.org <http://labauth.lan.lab.org>=
>>
>> pool.authz.auth.type =3D none
>> pool.default.serverset.type =3D single
>> pool.default.serverset.single.server =3D ${global:vars.server}
>> pool.default.ssl.startTLS =3D true
>> pool.default.ssl.insecure =3D true
>>
>> pool.default.connection-options.connectTimeoutMillis =3D 10000
>> pool.default.connection-options.responseTimeoutMillis =3D 90000
>> sequence-init.init.100-my-basedn-init-vars =3D my-basedn-init-va=
rs
>> sequence.my-basedn-init-vars.010.description =3D set
baseDN
>> sequence.my-basedn-init-vars.010.type =3D var-set
>> sequence.my-basedn-init-vars.010.var-set.variable =3D simple_bas=
eDN
>> sequence.my-basedn-init-vars.010.var-set.value =3D
o=3DLANLAB
>>
>> sequence-init.init.101-my-objectclass-init-vars =3D
>> my-objectclass-init-vars
>> sequence.my-objectclass-init-vars.020.description =3D set
objectClass
>> sequence.my-objectclass-init-vars.020.type =3D var-set
>> sequence.my-objectclass-init-vars.020.var-set.variable =3D
>> simple_filterUserObject
>> sequence.my-objectclass-init-vars.020.var-set.value =3D
>> (objectClass=3DlabPerson)(uid=3D*)
>>
>> search.default.search-request.derefPolicy =3D NEVER
>>
>> sequence-init.init.900-local-init-vars =3D local-init-vars
>> sequence.local-init-vars.010.description =3D override name space=
>> sequence.local-init-vars.010.type =3D var-set
>> sequence.local-init-vars.010.var-set.variable =3D
>> simple_namespaceDefault
>> sequence.local-init-vars.010.var-set.value =3D *
>
> What's this^ for? I think it's unusable.
>
>>
>> sequence.local-init-vars.020.description =3D apply filter to use=
rs
>> sequence.local-init-vars.020.type =3D var-set
>> sequence.local-init-vars.020.var-set.variable =3D
>> simple_filterUserObject
>> sequence.local-init-vars.020.var-set.value =3D
>> ${seq:simple_filterUserObject}(employeeStatus=3D3)
>>
>> sequence.local-init-vars.030.description =3D apply filter to gro=
ups
>> sequence.local-init-vars.030.type =3D var-set
>> sequence.local-init-vars.030.var-set.variable =3D
>> simple_filterGroupObject
>> sequence.local-init-vars.030.var-set.value =3D
>> (objectClass=3DgroupOfUniqueNames)
>
> This looks as hard to maintain file. I would suggest you to inser=
t
> into this file just following:
>
> include =3D <rfc2307-mycustom.properties>
>
> vars.server =3D labauth.lan.lab.org <http://labauth.lan.lab.org>=
>
> pool.authz.auth.type =3D none
> pool.default.serverset.type =3D single
> pool.default.serverset.single.server =3D ${global:vars.server}
> pool.default.ssl.startTLS =3D true
> pool.default.ssl.insecure =3D true
>
> pool.default.connection-options.connectTimeoutMillis =3D 10000
> pool.default.connection-options.responseTimeoutMillis =3D 90000
>
> # Set custom base DN
> sequence-init.init.100-my-basedn-init-vars =3D my-basedn-init-va=
rs
> sequence.my-basedn-init-vars.010.description =3D set
baseDN
> sequence.my-basedn-init-vars.010.type =3D var-set
> sequence.my-basedn-init-vars.010.var-set.variable =3D simple_bas=
eDN
> sequence.my-basedn-init-vars.010.var-set.value =3D
o=3DLANLAB
>
> And then create in directory
> '/usr/share/ovirt-engine-extension-aaa-ldap/profiles/' file
> 'rfc2307-mycustom.properties' with content:
>
> include =3D <rfc2307.properties>
>
> sequence-init.init.100-rfc2307-mycustom-init-vars =3D
> rfc2307-mycustom-init-vars
> sequence.rfc2307-mycustom-init-vars.010.description =3D set
unique attr
> sequence.rfc2307-mycustom-init-vars.010.type =3D var-set
> sequence.rfc2307-mycustom-init-vars.010.var-set.variable =3D
> rfc2307_attrsUniqueId
> sequence.rfc2307-mycustom-init-vars.010.var-set.value =3D
FIND_THIS_ONE
>
> sequence.rfc2307-mycustom-init-vars.020.type =3D var-set
> sequence.rfc2307-mycustom-init-vars.020.var-set.variable =3D
> simple_filterUserObject
> sequence.rfc2307-mycustom-init-vars.020.var-set.value =3D
>
(objectClass=3DlabPerson)(employeeStatus=3D3)(${seq:simple_attrsUse=
rName}=3D*)
>
>
>
> The FIND_*THIS_ONE* replace with the unique attribute of
labPerson(I
> guess). It can be extended attribute(+,++).
>
> $ LDAPTLS_REQCERT=3Dnever ldapsearch -ZZ -x -b 'o=3DLANLAB' -H
> ldap://labauth.lan.lab.org <http://labauth.lan.lab.org>
'objectClass=3DlabPerson'
>
> maybe (or even with two +):
> $ LDAPTLS_REQCERT=3Dnever ldapsearch -ZZ -x -b 'o=3DLANLAB' -H
> ldap://labauth.lan.lab.org <http://labauth.lan.lab.org>
'objectClass=3DlabPerson' +
>
> The question is if even your implementation has unique
attribute, does
> it?
>
> Also may you share what's your LDAP provider? And maybe if you
share
> content of some user it would help as well.
>
>>
>>
>>
>>
>> _______________________________________________
>> Users mailing list
>> Users(a)ovirt.org <mailto:Users@ovirt.org>
>> http://lists.ovirt.org/mailman/listinfo/users
<http://lists.ovirt.org/mailman/listinfo/users>
>>
> _______________________________________________
> Users mailing list
> Users(a)ovirt.org <mailto:Users@ovirt.org>
> http://lists.ovirt.org/mailman/listinfo/users
<http://lists.ovirt.org/mailman/listinfo/users>
=20
=20
--
/dev/null
=20
=20
--=20
/dev/null
--cUgn38JlIV4VKxpoXvonH2a8Rp00918Nu--
--2LvNVti3HDOn1MhIrbe5B2snDhjNOnQPn
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCgAGBQJYwnegAAoJEA7XCanqEVqIODIQAM4IumlowJYvAoH/+vVTaUT1
pxzYVsOFYHhs32f1in9aqJ37esa1CXngUcB1gHm1QcBixq1FEH1iVEF1Iy22nyXM
gNoOh4R7meoUzqpdlcqYpdTdo3F3v6KgWDRuz9yxH912MZzheXA9BGZ0qhdbQH3S
a1eo2UHNm6wpyS+6CCgUirM8fbrjdb6aTGTuXNQ1px3GaqFFHkQvlWPlENatSxGw
G3IqVoPHhuDNsFDyF6dG6oF2iTbQdzlvk84x3aOztX/nGnxV1dY00/73qEp+8aXK
0krTp0hjiGI0uRiOHChl0DSUuO9VvlTmmqjxYCN1z2ZYHZkMaK590v6YtXmT42tM
VRIsqt6J5HpyLLiQWmCNPPkXf/s7iuG1zAmO+fi4vd5x6gQlW7ao6lLFFRqB8dVr
FuJyv7DW6PcBNjNiG0zCLbGb431t2MK9AaSxF+qb8KmTluDBqQ2trdijM43J+3Jk
/ptoXfpSzWmX2HkDLuaJL0NeQ6F5vqGUZRgu9IkXS2RAvQwLXflm/cvMKsj32EkZ
39gF5k1ViYAdtk9YUwBObor6uxnb0UpdrvZyA5dUEHsYaP6Yw+hVNqi0tloTN9wL
Q+J6CdHK+lRkRppddoEdSmnAtBqhN5/woZEqrBZ1E1jFRUw7KTefbaeUpDbpWQvS
0csSL7D0IScsBJE2kLSA
=73cu
-----END PGP SIGNATURE-----
--2LvNVti3HDOn1MhIrbe5B2snDhjNOnQPn--