my ovirt can not login to openldap server
i configure ovirt with self-host , and i want then to configure an external LDAP provider i follow the step in this link https://www.ovirt.org/documentation/admin-guide/chap-Users_and_Roles/ but this following error appear when i true to login: Enter user name: user002 Enter user password: [ INFO ] Executing login sequence... Login output: 2018-09-13 12:59:01,015+03 INFO ======================================================================== 2018-09-13 12:59:01,032+03 INFO ============================ Initialization ============================ 2018-09-13 12:59:01,033+03 INFO ======================================================================== 2018-09-13 12:59:01,064+03 INFO Loading extension 'ldap23.exalt.ps-authn' 2018-09-13 12:59:01,119+03 INFO Extension 'ldap23.exalt.ps-authn' loaded 2018-09-13 12:59:01,122+03 INFO Loading extension 'ldap23.exalt.ps-authz' 2018-09-13 12:59:01,130+03 INFO Extension 'ldap23.exalt.ps-authz' loaded 2018-09-13 12:59:01,130+03 INFO Initializing extension 'ldap23.exalt.ps-authn' 2018-09-13 12:59:01,131+03 INFO [ovirt-engine-extension-aaa-ldap.authn::ldap23.exalt.ps-authn] Creating LDAP pool 'authz' 2018-09-13 12:59:01,628+03 INFO [ovirt-engine-extension-aaa-ldap.authn::ldap23.exalt.ps-authn] LDAP pool 'authz' information: vendor='null' version='null' 2018-09-13 12:59:01,629+03 INFO [ovirt-engine-extension-aaa-ldap.authn::ldap23.exalt.ps-authn] Creating LDAP pool 'authn' 2018-09-13 12:59:01,882+03 INFO [ovirt-engine-extension-aaa-ldap.authn::ldap23.exalt.ps-authn] LDAP pool 'authn' information: vendor='null' version='null' 2018-09-13 12:59:01,882+03 INFO Extension 'ldap23.exalt.ps-authn' initialized 2018-09-13 12:59:01,883+03 INFO Initializing extension 'ldap23.exalt.ps-authz' 2018-09-13 12:59:01,883+03 INFO [ovirt-engine-extension-aaa-ldap.authz::ldap23.exalt.ps-authz] Creating LDAP pool 'authz' 2018-09-13 12:59:02,168+03 INFO [ovirt-engine-extension-aaa-ldap.authz::ldap23.exalt.ps-authz] LDAP pool 'authz' information: vendor='null' version='null' 2018-09-13 12:59:02,169+03 INFO [ovirt-engine-extension-aaa-ldap.authz::ldap23.exalt.ps-authz] Available Namespaces: [dc=exalt,dc=ps] 2018-09-13 12:59:02,169+03 INFO Extension 'ldap23.exalt.ps-authz' initialized 2018-09-13 12:59:02,169+03 INFO Start of enabled extensions list 2018-09-13 12:59:02,170+03 INFO Instance name: 'ldap23.exalt.ps-authn', Extension name: 'ovirt-engine-extension-aaa-ldap.authn', Version: '1.3.7', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.7-1.el7.centos', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: '/tmp/tmp1j67ra/extensions.d/ldap23.exalt.ps-authn.properties', Initialized: 'true' 2018-09-13 12:59:02,170+03 INFO Instance name: 'ldap23.exalt.ps-authz', Extension name: 'ovirt-engine-extension-aaa-ldap.authz', Version: '1.3.7', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.7-1.el7.centos', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: '/tmp/tmp1j67ra/extensions.d/ldap23.exalt.ps-authz.properties', Initialized: 'true' 2018-09-13 12:59:02,170+03 INFO End of enabled extensions list 2018-09-13 12:59:02,170+03 INFO ======================================================================== 2018-09-13 12:59:02,170+03 INFO ============================== Execution =============================== 2018-09-13 12:59:02,170+03 INFO ======================================================================== 2018-09-13 12:59:02,171+03 INFO Iteration: 0 2018-09-13 12:59:02,171+03 INFO Profile='ldap23.exalt.ps' authn='ldap23.exalt.ps-authn' authz='ldap23.exalt.ps-authz' mapping='null' 2018-09-13 12:59:02,171+03 INFO API: -->Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='ldap23.exalt.ps' user='user002' 2018-09-13 12:59:02,198+03 INFO API: <--Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='ldap23.exalt.ps' result=CREDENTIALS_INVALID 2018-09-13 12:59:02,203+03 SEVERE Authn.Result code is: CREDENTIALS_INVALID [ ERROR ] Login sequence failed Please investigate details of the failure (search for lines containing SEVERE log level). can anybody help ?
2018-09-13 12:59:02,171+03 INFO Profile='ldap23.exalt.ps' authn='ldap23.exalt.ps-authn' authz='ldap23.exalt.ps-authz' mapping='null' 2018-09-13 12:59:02,171+03 INFO API: -->Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='ldap23.exalt.ps' user='user002' 2018-09-13 12:59:02,198+03 INFO API: <--Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='ldap23.exalt.ps' result=CREDENTIALS_INVALID
I had a similar issue with our environment, have you installed the CA cert used to create your openldap certificate as a trusted authority? It may also help to rerun ovirt-engine-extension-aaa-ldap-setup and select the "Insecure" option for your CA cert. I'm not sure what has changed but it appears that ovirt 4.6 is more picky about CA certificates than previous releases.
i make my CA in ldap server and import CRT file to ovirt-self-host , i try choose insecure option put nothing has changed the error still appears . do you have any suggestion ?
participants (2)
-
Michael Watters -
mustafa.taha.mu95＠gmail.com