This are instructions to setup an environment for testing authentication of ovirt-engine with OpenLDAP. All the instructions are based on RHEL6 and assume that the name of the domain is rhel6.example.com and that the name of the realm is RHEL6.EXAMPLE.COM. 1. Install the OpenLDAP server and clients and the support for the GSSAPI SASL mechanism: # yum -y install openldap-{clients,servers} cyrus-sasl-gsslapi # yum -y install cyrus-sasl-gsslapi 2. Start and enable the OpenLDAP service: # chkconfig slapd on # service slapd start 3. Add the memberof overlay: # cat > memberof.ldif <<'.' dn: cn={0}module,cn=config objectClass: olcModuleList cn: {0}module olcModulePath: /usr/lib64/openldap olcModuleLoad: {0}memberof.la dn: olcOverlay={0}memberof,olcDatabase={2}bdb,cn=config objectClass: olcConfig objectClass: olcMemberOf objectClass: olcOverlayConfig objectClass: top olcOverlay: {0}memberof . # ldapadd -H ldapi:/// -Y EXTERNAL -f memberof.ldif 4. Create a password for the directory administrator (I used example123): # slappasswd New password: Re-enter new password: {SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2 5. Change the suffix and the credentials of the directory manager: # cat > config.ldif <<'.' dn: olcDatabase={2}bdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=rhel6,dc=example,dc=com - replace: olcRootDN olcRootDN: cn=Manager,dc=rhel6,dc=example,dc=com - replace: olcRootPW olcRootPW: {SSHA}47TDR/r8yaDQZ7rF9UyaO7MDTsEm/zqT - . # ldapmodify -H ldapi:/// -Y EXTERNAL -f config.ldif 6. Create the top level structure of the directory, with a branch for users and another for groups: # cat > structure.ldif <<'.' dn: dc=rhel6,dc=example,dc=com objectClass: dcObject objectClass: organization dc: rhel6 o: RHEL6 Example Inc. dn: ou=Users,dc=rhel6,dc=example,dc=com objectClass: organizationalUnit ou: Users dn: ou=Groups,dc=rhel6,dc=example,dc=com objectClass: organizationalUnit ou: Groups . # ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f structure.ldif 7. Create some users: # cat > users.ldif <<'.' dn: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com objectclass: inetOrgPerson objectclass: uidObject uid: user0 cn: User2 givenName: User title: User mail: user0@rhel6.example.com sn: 0 dn: uid=user1,ou=Users,dc=rhel6,dc=example,dc=com objectclass: inetOrgPerson objectclass: uidObject uid: user1 cn: User1 givenName: User title: User mail: user1@rhel6.example.com sn: 1 . Note that the users don't need to have a memberof attribute, as this will be calculated and assigned by the memberof overlay when the group is created or modified. # ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f users.ldif 8. Create some groups: # cat > groups.ldif <<'.' dn: cn=Group0,ou=Groups,dc=rhel6,dc=example,dc=com objectclass: groupOfNames cn: Group0 member: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com member: uid=user1,ou=Users,dc=rhel6,dc=example,dc=com . # ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f groups.ldif Once this is done the directory should return the memberOf attributes when quering users: # ldapsearch -H ldapi:/// -b 'dc=rhel6,dc=example,dc=com' -x '(uid=user0)' memberOf -LLL dn: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com memberOf: cn=Group0,ou=Groups,dc=rhel6,dc=example,dc=com 9. Install the kerberos server packages: # yum -y install krb5-{workstation,server} 10. Adjust the /etc/krb5.conf file, should be something like this: [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true default_realm = RHEL6.EXAMPLE.COM [realms] RHEL6.EXAMPLE.COM = { kdc = rhel6.example.com admin_server = rhel6.example.com } [domain_realm] .rhel6.example.com = RHEL6.EXAMPLE.COM rhel6.example.com = RHEL6.EXAMPLE.COM 11. Create the kerberos database: # cd /var/kerberos/krb5kdc # kdb5_util create -s Modify the /var/kerberos/krb5kdc/kdc.conf and /var/kerberos/krb5kdc/kadm5.acl and replace EXAMPLE.COM with your realm name. 12. Create the a kerberos admin user, for root, for example: # kadmin.local Authenticating as principal root/admin@RHEL6.EXAMPLE.COM with password. kadmin.local: add_principal root/admin WARNING: no policy specified for root/admin@RHEL6.EXAMPLE.COM; defaulting to no policy Enter password for principal "root/admin@RHEL6.EXAMPLE.COM": Re-enter password for principal "root/admin@RHEL6.EXAMPLE.COM": Principal "root/admin@RHEL6.EXAMPLE.COM" created. 13. Start and enable the krb5kdc and kadmin services: # chkconfig krb5kdc on # service krb5kdc start # chkconfig kadmin on # service kadmin start 14. Check that you can login with the admin user: # kadmin Authenticating as principal root/admin@RHEL6.EXAMPLE.COM with password. Password for root/admin@RHEL6.EXAMPLE.COM: kadmin: list_principals K/M@RHEL6.EXAMPLE.COM kadmin/admin@RHEL6.EXAMPLE.COM 15. Add the users to the kerberos database and verify that they can login: # kadmin kadmin: add_principal user0 kadmin: add_principal user1 # kinit user0 Password for user0@RHEL6.EXAMPLE.COM: 16. Create a password for the LDAP server and extract it to a keytab file with read permissions for the user running the LDAP server (usually the "ldap" user): # kadmin kadmin: add_principal -randkey ldap/rhel6.example.com kadmin: ktadd -keytab /etc/openldap/ldap.keytab ldap/rhel6.example.com # chgrp ldap /etc/openldap/ldap.keytab # chmod 640 /etc/openldap/ldap.keytab 17. Make sure that the LDAP server is using the keytab file created in the previous step, adding the KRB5_KTNAME to the /etc/sysconfig/ldap file: KRB5_KTNAME=/etc/openldap/ldap.keytab Then restart the LDAP server: # service slapd restart 18. Test that users can do LDAP queries using the kerberos credentials: # kinit user0 # Password for user0@RHEL6.EXAMPLE.COM: # ldapsearch -H ldap://rhel6.example.com -Y GSSAPI -b 'dc=rhel6,dc=example,dc=com' '(uid=user0)' memberOf The query should succeed without asking any password. 19. Add DNS SRV records for the LDAP and Kerberos servers, something like this in the zone file: _kerberos._tcp.rhel6.example.com. SRV 0 100 88 rhel6.example.com. _ldap._tcp.rhel6.example.com. SRV 0 100 389 rhel6.example.com. 20. Register the domain with engine-manage-domains: # engine-manage-domains -action=add -domain=rhel6.example.com -provider=OpenLDAP -user=user0 -interactive