On 10/11/2016 05:32 PM, cmc wrote:

Hi Ondra,

Not really. aaa-ldap by default uses just simple bind, no gssapi. If you have any problems with certificate I would suggest you to check if you are using the correct one, correctly. More info for it can be found here:

https://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git;a=blob... <https://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git;a=blob;f=README;h=1f4381e4f0d22acdda63c56a84863fcb0f72bc3a;hb=HEAD#l397>

I've run the following tests in that README you posted above, and all worked fine:

ovirt-engine-extensions-tool aaa login-user --profile=mydomain.com <http://mydomain.com> --user-name=myuser ovirt-engine-extensions-tool aaa search --extension-name=mydomain.com-authz --entity=principal --entity-name=myuser LDAPTLS_REQCERT=never ldapsearch -ZZ -H ldap://ad.mydomain.com <http://ad.mydomain.com> -x -D "CN=myuser,CN=Users,DC=mydomain,DC=com" -W -b "dc=mydomain,dc=com"

I thought I wouldn't need to import any certificate from AD - is that a requirement?

It's not, but you need to use insecure connection then (you need to have following line in /etc/ovirt-engine/aaa/domain.properties): pool.default.ssl.insecure = true So double check that, and if it still won't work, the logs from ovirt-engine-extensions-tool would help, you can generate them as follows: $ ovirt-engine-extensions-tool --log-level=FINEST --log-file=/tmp/aaa.log aaa ....

Do I need to set up Apache separately to use LDAP auth? The service principals exist in the krb5.keytab, but I don't if that is only if you are using SSO.

Yes, that's only if you use SSO. If you use plain LDAP simple bind, you don't need anything related to kerberos.

Thanks,

Cam

_______________________________________________

Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users>

On 10/12/2016 03:31 PM, cmc wrote:

Hi Ondra,

It's not, but you need to use insecure connection then (you need to have following line in /etc/ovirt-engine/aaa/domain.properties):

pool.default.ssl.insecure = true

I ended up generating a cert on one of the AD machines, copying it to the host, and then specified it in the setup process via ovirt-engine-extension-aaa-ldap-setup. It seems to create a .jks file. It still gave me the same 'peer not authenticated' so I checked the krb5.keytab and saw that there was no SPN for http, so I rejoined the domain and specified http as a service name via adcli, and then things worked.

So double check that, and if it still won't work, the logs from ovirt-engine-extensions-tool would help, you can generate them as follows:

$ ovirt-engine-extensions-tool --log-level=FINEST --log-file=/tmp/aaa.log aaa ....

Do I need to set up Apache separately to use LDAP auth? The service principals exist in the krb5.keytab, but I don't if that is only if you are using SSO.

Yes, that's only if you use SSO. If you use plain LDAP simple bind, you don't need anything related to kerberos.

I think I was under the impression that you needed to join the domain in order to auth via AD. However, I've now seen one HOWTO that says that you just need the cert from AD to be able to auth securely though I'm not entirely clear whether that works for Apache. Is that correct - Kerberos, binding etc is not needed for the oVirt web interface to auth securely?

Yes, you really do not need anything kerberos related to securely bind to AD via LDAP simple bind over TLS/SSL. This is really strange to me what errors you are getting, but you probably configured apache (or something else?) to require keytab, but you don't have to, and you can remove that configuration.

Thanks,

Cam

Thanks,

Cam

_______________________________________________

Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>> http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users> <http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users>>

Hi Ondra, It manages to authenticate, but appends the domain again once I'm logged in, for instance, if I log in as user 'cam', it will log me in, and display the login name in the top right corner as 'cam@domain.com@ domain.com' (this shows up in the log as well: it shows me logging in as cam@domain.com, but then returns an error as user cam@domain.com@domain.com is not authorized). My thought was that something done earlier when I was playing around with sssd, kerberos and AD is doing this, though I have removed these packages and run authconfig to remove sssd. Any ideas? Cheers, Cam On Thu, Oct 13, 2016 at 2:04 PM, cmc <iucounu@gmail.com> wrote:

Hi Ondra,

That is good to know that we don't need Kerberos - it complicates things a lot.

I think the errors might be the options I'd selected during the setup. I was thrown a bit that it passed all the internal tests provided by the setup script, but failed on the web GUI. When I've seen 'unspecified GSS failure' and 'peer not authenticated' it's usually been due to Kerberos (though admittedly these are just generic errors). So I tried the Redhat guide for SSO at:

https://access.redhat.com/documentation/en-US/Red_Hat_ Enterprise_Virtualization/3.6/html/Administration_Guide/ Configuring_LDAP_and_Kerberos_for_Single_Sign-on.html

which uses Kerberos (in ovirt-sso.conf) I had to remove the symlink to the Apache config it says to create, as it results in internal server errors in Apache. It uses an SPN for Apache in the keytab.

Now that you've confirmed that it can actually work without any need for the Kerberos stuff, I will start afresh from a clean setup and apply what I've learnt during this process.

I'll try it out and let you know either way.

Many thanks for all the help!

Kind regards,

Cam

...

Yes, you really do not need anything kerberos related to securely bind to AD via LDAP simple bind over TLS/SSL. This is really strange to me what errors you are getting, but you probably configured apache (or something else?) to require keytab, but you don't have to, and you can remove that configuration.

...

Thanks,

Cam

Thanks,

Cam

_______________________________________________

Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>> http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users> <http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users>>

Hi Ondra, I assigned permissions to an LDAP group and it just needed me to remove that group and re-add it for it to authorize again. Yes, the UPN is user@domain in our case. Not a big deal, but is there a plan to change the display name? I get confused looks and questions when people log in. All working now, many thanks once again for all your help! Cheers, Cam On Mon, Oct 17, 2016 at 10:06 AM, Ondra Machacek <omachace@redhat.com> wrote:

Hi Cam,

this is OK, because we use user principal name(UPN)[1] for the 'username' field of the oVirt. So the result username will consist of UPN@authz-extension, so if your user's UPN is 'user@domain' and you will name your authz extension as 'domain', then the result username will be 'user@domain@domain'.

The problem, that you can't get authorized is that you didn't assigned any permissions to your user.

[1] https://msdn.microsoft.com/en-us/library/ms680857(v=vs.85).aspx

On 10/14/2016 04:30 PM, cmc wrote:

...

Hi Ondra,

It manages to authenticate, but appends the domain again once I'm logged in, for instance, if I log in as user 'cam', it will log me in, and display the login name in the top right corner as 'cam@domain.com@domain.com <http://domain.com>' (this shows up in the log as well: it shows me logging in as cam@domain.com <mailto:cam@domain.com>, but then returns an error as user cam@domain.com@domain.com <http://domain.com> is not authorized). My thought was that something done earlier when I was playing around with sssd, kerberos and AD is doing this, though I have removed these packages and run authconfig to remove sssd. Any ideas?

Cheers,

Cam

On Thu, Oct 13, 2016 at 2:04 PM, cmc <iucounu@gmail.com <mailto:iucounu@gmail.com>> wrote:

Hi Ondra,

That is good to know that we don't need Kerberos - it complicates things a lot.

I think the errors might be the options I'd selected during the setup. I was thrown a bit that it passed all the internal tests provided by the setup script, but failed on the web GUI. When I've seen 'unspecified GSS failure' and 'peer not authenticated' it's usually been due to Kerberos (though admittedly these are just generic errors). So I tried the Redhat guide for SSO at:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterp rise_Virtualization/3.6/html/Administration_Guide/Configuri ng_LDAP_and_Kerberos_for_Single_Sign-on.html <https://access.redhat.com/documentation/en-US/Red_Hat_Enter prise_Virtualization/3.6/html/Administration_Guide/Configuri ng_LDAP_and_Kerberos_for_Single_Sign-on.html>

which uses Kerberos (in ovirt-sso.conf) I had to remove the symlink to the Apache config it says to create, as it results in internal server errors in Apache. It uses an SPN for Apache in the keytab.

Now that you've confirmed that it can actually work without any need for the Kerberos stuff, I will start afresh from a clean setup and apply what I've learnt during this process.

I'll try it out and let you know either way.

Many thanks for all the help!

Kind regards,

Cam

Yes, you really do not need anything kerberos related to securely bind to AD via LDAP simple bind over TLS/SSL. This is really strange to me what errors you are getting, but you probably configured apache (or something else?) to require keytab, but you don't have to, and you can remove that configuration.

Thanks,

Cam

Thanks,

Cam

_______________________________________________

Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>> <mailto:Users@ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>>>

http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users> <http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users>>

<http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users> <http://lists.ovirt.org/mailman/listinfo/users <http://lists.ovirt.org/mailman/listinfo/users>>>