[Users] OpenLDAP Simple Authentication in Ovirt Engine

[Charlie]

True LDAP does not require a password encryption method and is
perfectly happy with cleartext storage and use.

In practice, one uses a secure channel (LDAPS or Starttls or encrypted
network) and most LDAP servers (such as OpenLDAP) will allow several
different kinds of password encryption.

An application, though, should not ever deal with this issue.  The
password should be validated by doing a BIND operation, and the
application should not do any READ operations on the userPassword
value at any time, only authenticate operations.  Let the LDAP server
manage authentication.

Groups are harder.  You cannot rely on the presence of a memberOf
attribute, unfortunately, and schema are contextually meaningless, so
you need a way for the directory administrator to tell the client code
how groups are being stored in the server.  Thierry gives one example,
another is groupOfNames using a "member" attribute containing DNs of
members.  Those are the two most common methods, but there are more.

--Charlie

On Tue, Dec 4, 2012 at 2:31 AM, Thierry Kauffmann
<thierry.kauffmann at univ-montp2.fr> wrote:
>
> Le 04/12/2012 00:51, Itamar Heim a écrit :
>
> On 11/30/2012 12:30 PM, Thierry Kauffmann wrote:
>
> Hi,
>
> I am currently testing Ovirt 3.1 standalone on Fedora 17.
>
> Until now, I could only use the default user admin at internal.
>
> Our Directory at the University is OpenLDAP. We use it for
> authentication WITHOUT Kerberos : Simple authentication.
>
>
> just wondering, i'm sure it is encrypted somehow, do you know which way?
> also, when using openldap, which scheme are you using?
>
> thanks,
>    Itamar
>
>
> Hi,
>
> the password is transmitted by the client encrypted (hashed) to the openldap server.
> We use the standard schemes delivered by openldap : core, cosine, nis, inetorgperson and samba
>
> A normal user dn is : uid=username,ou=Users,dc=example,dc=com
> A normal group dn is : cn=groupname,ou=Groups,dc=example,dc=com
> Group members are a list of values for the attribute "memberUid" of a group dn.
>
> regards,
>
> Thierry
>
>
> I wonder how to use this backend to authenticate users and manage groups
> in Ovirt.
>
> Has anyone already set this up ?
> How to configure Ovirt to use Simple Authentication (No Kerberos).
>
> Cheers,
>
> --
> signature-TK Thierry Kauffmann
> Chef du Service Informatique // Faculté des Sciences // Université de
> Montpellier 2
>
> SIF - Service Informatique de la Faculté des Sciences
> <http://sif.info-ufr.univ-montp2.fr/>     UM2 - Université de Montpellier 2
> <http://www.univ-montp2.fr/>     Service informatique de la Faculté des
> Sciences (SIF)
> Université de Montpellier 2
> CC437 // Place Eugène Bataillon // 34095 Montpellier Cedex 5
>
> Tél : 04 67 14 31 58
> email : thierry.kauffmann at univ-montp2.fr
> <mailto:thierry.kauffmann at univ-montp2.fr>
> web : http://sif.info-ufr.univ-montp2.fr/ http://www.fdsweb.univ-montp2.fr/
>
>
>
>
> _______________________________________________
> Users mailing list
> Users at ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
>
>
>
>
> --
> Thierry Kauffmann
> Chef du Service Informatique // Faculté des Sciences // Université de Montpellier 2
>
> Service informatique de la Faculté des Sciences (SIF)
> Université de Montpellier 2
> CC437 // Place Eugène Bataillon // 34095 Montpellier Cedex 5
>
> Tél : 04 67 14 31 58
> email : thierry.kauffmann at univ-montp2.fr
> web : http://sif.info-ufr.univ-montp2.fr/  http://www.fdsweb.univ-montp2.fr/
>
>
> _______________________________________________
> Users mailing list
> Users at ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>