This are instructions to setup an environment for testing authentication of ovirt-engine with OpenLDAP. All the instructions are based on Fedora 18 and assume that the name of the domain is f19.example.com and that the name of the realm is F19.EXAMPLE.COM. 1. Install the OpenLDAP server and clients: # yum -y install openldap-{clients,servers} # yum -y install cyrus-sasl-gssapi 2. Start and enable the OpenLDAP service: # systemctl start slapd # systemctl enable slapd 3. Add the cosine and inetorgperson schemas: # ldapadd -H ldapi:/// -Y EXTERNAL -f /etc/openldap/schema/cosine.ldif # ldapadd -H ldapi:/// -Y EXTERNAL -f /etc/openldap/schema/inetorgperson.ldif 4. Add the memberof overlay: # cat > memberof.ldif <<'.' dn: cn={0}module,cn=config objectClass: olcModuleList cn: {0}module olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}memberof.la dn: olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: {0}memberof . # ldapadd -H ldapi:/// -Y EXTERNAL -f memberof.ldif 5. Create a password for the directory administrator (I used example123): # slappasswd New password: Re-enter new password: {SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2 6. Change the suffix and the credentians of the directory manager: # cat > config.ldif <<'.' dn: cn=config replace: olcSaslSecProps olcSaslSecProps: noanonymous,noplain,minssf=1 - dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=f19,dc=example,dc=com - replace: olcRootDN olcRootDN: cn=Manager,dc=f19,dc=example,dc=com - replace: olcRootPW olcRootPW: {SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2 - . # ldapmodify -H ldapi:/// -Y EXTERNAL -f config.ldif 7. Create the top level structure of the directory, with a branch for users and another for groups: # cat > structure.ldif <<'.' dn: dc=f19,dc=example,dc=com objectClass: dcObject objectClass: organization dc: f19 o: F19 Example Inc. dn: ou=Users,dc=f19,dc=example,dc=com objectClass: organizationalUnit ou: Users dn: ou=Groups,dc=f19,dc=example,dc=com objectClass: organizationalUnit ou: Groups . # ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f structure.ldif 8. Create some users: # cat > users.ldif <<'.' dn: uid=user0,ou=Users,dc=f19,dc=example,dc=com objectclass: inetOrgPerson objectclass: uidObject uid: user0 cn: User2 givenName: User title: User mail: user0@f19.example.com sn: 0 dn: uid=user1,ou=Users,dc=f19,dc=example,dc=com objectclass: inetOrgPerson objectclass: uidObject uid: user1 cn: User1 givenName: User title: User mail: user1@f19.example.com sn: 1 . Note that the users don't need to have a memberof attribute, as this will be calculated and assigned by the memberof overlay when the group is created or modified. # ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f users.ldif 9. Create some groups: # cat > groups.ldif <<'.' dn: cn=Group0,ou=Groups,dc=f19,dc=example,dc=com objectclass: groupOfNames cn: Group0 member: uid=user0,ou=Users,dc=f19,dc=example,dc=com member: uid=user1,ou=Users,dc=f19,dc=example,dc=com . # ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f groups.ldif Once this is done the directory should return the memberOf attributes when quering users: # ldapsearch -H ldapi:/// -b 'dc=f19,dc=example,dc=com' -x '(uid=user0)' memberOf -LLL dn: uid=user0,ou=Users,dc=f19,dc=example,dc=com memberOf: cn=Group0,ou=Groups,dc=f19,dc=example,dc=com 10. Install the kerberos server packages: # yum -y install krb5-{workstation,server} 11. Adjust the /etc/krb5.conf file, should be something like this: [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true default_realm = F19.EXAMPLE.COM [realms] F19.EXAMPLE.COM = { kdc = f19.example.com admin_server = f19.example.com } [domain_realm] .f19.example.com = F19.EXAMPLE.COM f19.example.com = F19.EXAMPLE.COM 11. Create the kerberos database: # cd /var/kerberos/krb5kdc # kdb5_util create -s Modify the /var/kerberos/krb5kdc/kdc.conf and /var/kerberos/krb5kdc/kadm5.acl and replace EXAMPLE.COM with your realm name. 12. Create the a kerberos admin user, for root, for example: # kadmin.local Authenticating as principal root/admin@F19.EXAMPLE.COM with password. kadmin.local: add_principal root/admin WARNING: no policy specified for root/admin@F19.EXAMPLE.COM; defaulting to no policy Enter password for principal "root/admin@F19.EXAMPLE.COM": Re-enter password for principal "root/admin@F19.EXAMPLE.COM": Principal "root/admin@F19.EXAMPLE.COM" created. 13. Start and enable the krb5kdc and kadmin services: # systemctl start krb5kdc # systemctl enable krb5kdc # systemctl start kadmin # systemctl enable kadmin 14. Check that you can login with the admin user: # kadmin Authenticating as principal root/admin@F19.EXAMPLE.COM with password. Password for root/admin@F19.EXAMPLE.COM: kadmin: list_principals K/M@F19.EXAMPLE.COM kadmin/admin@F19.EXAMPLE.COM 15. Add the users to the kerberos database and verify that they can login: # kadmin kadmin: add_principal user0 kadmin: add_principal user1 # kinit user0 Password for user0@F19.EXAMPLE.COM: 16. Create a password for the LDAP server and extract it to a keytab file with read permissions for the user running the LDAP server (usually the "ldap" user): # kadmin kadmin: add_principal -randkey ldap/f19.example.com kadmin: ktadd -keytab /etc/openldap/ldap.keytab ldap/f19.example.com # chgrp ldap /etc/openldap/ldap.keytab # chmod 640 /etc/openldap/ldap.keytab 17. Make sure that the LDAP server is using the keytab file created in the previous step, adding the KRB5_KTNAME to the /etc/sysconfig/slapd file (it is already there, just uncomment it): KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab" Then restart the LDAP server: # systemctl restart slapd 18. Test that users can do LDAP queries using the kerberos credentials: # kinit user0 # Password for user0@F19.EXAMPLE.COM: # ldapsearch -H ldap://f19.example.com -Y GSSAPI -b 'dc=f19,dc=example,dc=com' '(uid=user0)' memberOf The query should succeed without asking any password. 19. Add DNS SRV records for the LDAP and Kerberos servers, something like this in the zone file: _kerberos._tcp.f19.example.com. SRV 0 100 88 f19.example.com. _ldap._tcp.f19.example.com. SRV 0 100 389 f19.example.com. 20. Register the domain with engine-manage-domains: # engine-manage-domains -action=add -domain=f19.example.com -provider=OpenLDAP -user=user0 -interactive