[Users] OpenLDAP Simple Authentication in Ovirt Engine
Jure Kranjc
jure.kranjc at arnes.si
Thu Feb 28 04:04:43 EST 2013
I was also testing simple auth without success. Our ldap doesn't support
kerberos so we're stuck. Engine log doesn't report anything, and the
server log shows:
2013-02-28 09:53:52,850 INFO [org.jboss.as.server]
(DeploymentScanner-threads - 2) JBAS015870: Deploy of deployment
"engine.ear" was rolled back with failure message {"JBAS014671: Failed
services" =>
{"jboss.deployment.subunit.\"engine.ear\".\"engine-bll.jar\".component.UsersDomainsCacheManagerService.START"
=> "org.jboss.msc.service.StartException in service
jboss.deployment.subunit.\"engine.ear\".\"engine-bll.jar\".component.UsersDomainsCacheManagerService.START:
Failed to start service"}}
We're using 3.1 on CentOS, rpms from dev.centos.org repo.
On 02/28/2013 09:33 AM, Yair Zaslavsky wrote:
> Hi Eduardo,
> We mainly focus on supporting Kerberos authentication at the moment
> Can you switch to kerberos authentication?
>
>
>
> ----- Original Message -----
>> From: "Eduardo Ramos" <eduardo at freedominterface.org>
>> To: users at ovirt.org
>> Sent: Wednesday, February 27, 2013 11:04:17 PM
>> Subject: Re: [Users] OpenLDAP Simple Authentication in Ovirt Engine
>>
>> Anyone has made success with that?
>>
>>
>> On 12/10/2012 10:18 AM, Eduardo Ramos wrote:
>>> Hi dudes!
>>>
>>> I was following the model below, but without success. That is my
>>> db:
>>>
>>>
>>> engine=# select * from vdc_options where option_name in
>>> ('DomainName','LdapServers','LDAPSecurityAuthentication','LDAPProviderTypes','AdUserName','AdUserPassword','AdUserId');
>>> option_id | option_name | option_value
>>> | version
>>> -----------+----------------------------+------------------------------------------------------------+---------
>>>
>>> 63 | DomainName | ovirt
>>> | general
>>> 8 | AdUserName |
>>> ovirt:admin |
>>> general
>>> 113 | LDAPProviderTypes |
>>> ovirt:ipa |
>>> general
>>> 112 | LdapServers |
>>> ovirt:172.16.21.240 |
>>> general
>>> 110 | LDAPSecurityAuthentication |
>>> ovirt:SIMPLE |
>>> general
>>> 9 | AdUserPassword |
>>> ovirt:e1NTSEF9aENLaXVoNUQzOXV0S1A0QlBZa3J4WVBaM2doUjNMNFg= |
>>> general
>>> (7 rows)
>>>
>>> As you can see, my ldap server and domain are internal. That's my
>>> ldap
>>> user object:
>>>
>>> # admin, Users, Accounts, inpe.br
>>> dn: cn=admin,cn=Users,cn=Accounts,dc=ovirt
>>> givenName: Admin
>>> sn: istrator
>>> uid: admin
>>> userPassword:: e1NTSEF9aENLaXVoNUQzOXV0S1A0QlBZa3J4WVBaM2doUjNMNFg=
>>> uidNumber: 1001
>>> gidNumber: 502
>>> homeDirectory: /home/users/admin
>>> loginShell: /bin/sh
>>> objectClass: inetOrgPerson
>>> objectClass: posixAccount
>>> objectClass: top
>>> cn: admin
>>>
>>> But the log aways returns:
>>>
>>> 2012-12-10 10:07:00,317 ERROR
>>> [org.ovirt.engine.core.bll.adbroker.LdapSearchExceptionHandler]
>>> (ajp--0.0.0.0-8009-11) Ldap authentication failed. Please check
>>> that
>>> the login name , password and path are correct.
>>> 2012-12-10 10:07:00,321 ERROR
>>> [org.ovirt.engine.core.bll.adbroker.DirectorySearcher]
>>> (ajp--0.0.0.0-8009-8) Failed ldap search server
>>> ldap://172.16.21.240:389 due to
>>> org.ovirt.engine.core.bll.adbroker.EngineDirectoryServiceException.
>>> We
>>> should not try the next server:
>>> org.ovirt.engine.core.bll.adbroker.EngineDirectoryServiceException
>>>
>>> Am I doing the right way?
>>>
>>> On 12/04/2012 07:07 AM, Oved Ourfalli wrote:
>>>> ----- Original Message -----
>>>>> From: "Thierry Kauffmann" <thierry.kauffmann at univ-montp2.fr>
>>>>> To: "Oved Ourfalli" <ovedo at redhat.com>
>>>>> Cc: "Itamar Heim" <iheim at redhat.com>, users at ovirt.org
>>>>> Sent: Tuesday, December 4, 2012 10:35:34 AM
>>>>> Subject: Re: [Users] OpenLDAP Simple Authentication in Ovirt
>>>>> Engine
>>>>>
>>>>>
>>>>> Le 04/12/2012 09:09, Oved Ourfalli a écrit :
>>>>>
>>>>>
>>>>> ----- Original Message -----
>>>>>
>>>>> From: "Itamar Heim" <iheim at redhat.com> To: "Oved Ourfalli"
>>>>> <ovedo at redhat.com> Cc: users at ovirt.org , "Thierry Kauffmann"
>>>>> <thierry.kauffmann at univ-montp2.fr> Sent: Tuesday, December 4,
>>>>> 2012
>>>>> 1:47:52 AM
>>>>> Subject: Re: [Users] OpenLDAP Simple Authentication in Ovirt
>>>>> Engine
>>>>>
>>>>> On 12/02/2012 08:10 AM, Oved Ourfalli wrote:
>>>>>
>>>>> ----- Original Message -----
>>>>>
>>>>> From: "Thierry Kauffmann" <thierry.kauffmann at univ-montp2.fr> To:
>>>>> "cristi falcas" <cristi.falcas at gmail.com> Cc: users at ovirt.org
>>>>> Sent:
>>>>> Saturday, December 1, 2012 5:56:14 PM
>>>>> Subject: [Users] OpenLDAP Simple Authentication in Ovirt Engine
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> Hi,
>>>>>
>>>>> I am currently testing Ovirt 3.1 standalone on Fedora 17.
>>>>>
>>>>> Until now, I could only use the default user admin at internal.
>>>>>
>>>>> Our Directory at the University is OpenLDAP. We use it for
>>>>> authentication
>>>>> WITHOUT Kerberos : Simple authentication.
>>>>>
>>>>> I wonder how to use this backend to authenticate users and manage
>>>>> groups
>>>>> in Ovirt.
>>>>>
>>>>> Has anyone already set this up ?
>>>>> How to configure Ovirt to use Simple Authentication (No
>>>>> Kerberos).
>>>>>
>>>>> Cheers,
>>>>>
>>>>> --
>>>>> Thierry Kauffmann
>>>>> Chef du Service Informatique // Facult? des Sciences //
>>>>> Universit?
>>>>> de
>>>>> Montpellier 2
>>>>>
>>>>> [image: SIF - Service Informatique de la Facult? des
>>>>> Sciences]
>>>>> <http://sif.info-ufr.univ-montp2.fr/> [image:
>>>>> UM2 - Universit? de Montpellier 2] <http://www.univ-montp2.fr/>
>>>>> Service
>>>>> informatique de la Facult? des Sciences (SIF)
>>>>> Universit? de Montpellier 2
>>>>> CC437 // Place Eug?ne Bataillon // 34095 Montpellier Cedex 5
>>>>>
>>>>> T?l : 04 67 14 31 58
>>>>> email : thierry.kauffmann at univ-montp2.fr web :
>>>>> http://sif.info-ufr.univ-montp2.fr/
>>>>> http://www.fdsweb.univ-montp2.fr/
>>>>> _______________________________________________
>>>>> Users mailing list Users at ovirt.org
>>>>> http://lists.ovirt.org/mailman/listinfo/users Hi,
>>>>>
>>>>> This is a response from an older thread from Yair Zaslavsky:
>>>>>
>>>>> " there is no code allowing to add simple-authentication domains
>>>>> to
>>>>> Manage-Domains.
>>>>> In the past we did have the ability to do that, but there are
>>>>> several
>>>>> problematic issues."
>>>>>
>>>>> Best regards, Hi,
>>>>>
>>>>> correct-me if I am wrong but this wiki page (
>>>>> http://www.ovirt.org/DomainInfrastructure ) states clearly :
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> 1. Authenticating Active Directory, IPA and RHDS using
>>>>> either
>>>>> simple or gssapi authentication
>>>>> 2. Querying the directory using the LDAP protocol
>>>>> 3. Auto deducing the LDAP provider type
>>>>> 4. Easily adding new LDAP provider types
>>>>> 5. Easily adding new query types
>>>>>
>>>>> So what ? We supported simple authentication in the past, but it
>>>>> is
>>>>> no longer
>>>>> supported, that's why you can't set that using the manage domains
>>>>> utility.
>>>>> It may work well in some providers (in the past we supported that
>>>>> for active directory, so I guess it would work there). I don't
>>>>> think
>>>>> we removed SIMPLE from the engine, we just don't
>>>>> recommend
>>>>> using it, since it doesn't encrypt user/password on the network
>>>>> (it
>>>>> is
>>>>> sometime useful for debugging). We indeed didn't remove the
>>>>> engine
>>>>> code. We just blocked it from the utility.
>>>>> Once you have a configured oVirt domain, you can set the
>>>>> LDAPSecurityAuthentication configuration parameter (in the
>>>>> vdc_options table), to use simple, by putting a value of:
>>>>> domain1:SIMPLE,domain2:GSSAPI,domain3:SIMPLE and etc....
>>>>>
>>>>> but, if you want to add a new domain with it then you would need
>>>>> to
>>>>> add it manually (can give a detailed explanation on how, if
>>>>> relevant). Yes, I would like to know how to add directly a domain
>>>>> which is not GSSAPI controlled.
>>>>>
>>>> The vdc_options table is a table containing the configuration
>>>> values
>>>> of the engine. Among those, there are directory-related
>>>> configuration
>>>> values:
>>>>
>>>> engine=# select * from vdc_options where option_name in
>>>> ('DomainName','LdapServers','LDAPSecurityAuthentication','LDAPProviderTypes','AdUserName','AdUserPassword');
>>>> option_id | option_name |
>>>> option_value | version
>>>> -----------+----------------------------+-------------------------------------------------+---------
>>>>
>>>> 9 | AdUserName |
>>>> domain1:user1,domain2:user2 | general
>>>> 10 | AdUserPassword |
>>>> domain1:password1,domain2:password2 | general
>>>> 114 | LdapServers |
>>>> deomain1:ldap_server_address1,domain2:ldap_server_address2 |
>>>> general
>>>> 64 | DomainName |
>>>> domain1,domain2 | general
>>>> 112 | LDAPSecurityAuthentication |
>>>> domain1:GSSAPI,domain2:SIMPLE | general
>>>> 115 | LDAPProviderTypes |
>>>> domain1:activeDirectory,domain2:ipa | general
>>>>
>>>> AdUserName is the user that will be used to query the directory.
>>>> AdUserPassword is the password that will be used to query the
>>>> directory.
>>>> LdapServers - the LDAP server that will be used (only one is
>>>> allowed
>>>> in this configuration. This configuration is optional. If empty,
>>>> we
>>>> will check the DNS for LDAP SRV records for the relevant domain).
>>>> DomainName - the names of the domains
>>>> LDAPSecurityAuthentication - SIMPLE/GSSAPI
>>>> LDAPProviderTypes - the provider type
>>>> (activeDirectory/ipa/rhds/itds)
>>>>
>>>> All the entries above are per-domain, in the format
>>>> domain1:value1,
>>>> domain2:value2 and etc....
>>>>
>>>> If manually adding a GSSAPI domain, you also need to supply a
>>>> krb5.conf file, and put it in the ENGINE_ETC path. If adding a
>>>> SIMPLE
>>>> domain that isn't neccesary.
>>>>
>>>> We haven't worked with simple domain for a while now, so hopefully
>>>> it
>>>> will work for you as expected.
>>>>
>>>> Let me know if you have further questions.
>>>>
>>>> Oved
>>>>>
>>>>> By default we work GSSAPI (I think the config option is empty by
>>>>> default which is equivalent to working GSSAPI).
>>>>> If/When we would need to support that again it shouldn't be a
>>>>> major
>>>>> effort to add the code... the testing with the different
>>>>> providers
>>>>> will be the hard part.
>>>>>
>>>>> Oved
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> We also don't auto deduce the LDAP provider type anymore, as
>>>>> changes in the providers caused some issues with it.
>>>>>
>>>>> I'll edit the wiki accordingly (btw, I remember removing it from
>>>>> the wiki... so it is weird that it is still there...).
>>>>>
>>>>> Oved
>>>>>
>>>>> --
>>>>> signature-TK Thierry Kauffmann
>>>>> Chef du Service Informatique // Faculté des Sciences //
>>>>> Université
>>>>> de
>>>>> Montpellier 2
>>>>>
>>>>>
>>>>> SIF - Service Informatique de la Faculté
>>>>> des Sciences UM2 -
>>>>> Université de Montpellier 2 Service
>>>>> informatique de
>>>>> la Faculté des Sciences (SIF)
>>>>> Université de Montpellier 2
>>>>> CC437 // Place Eugène Bataillon // 34095 Montpellier Cedex 5
>>>>>
>>>>> Tél : 04 67 14 31 58
>>>>> email : thierry.kauffmann at univ-montp2.fr web :
>>>>> http://sif.info-ufr.univ-montp2.fr/
>>>>> http://www.fdsweb.univ-montp2.fr/
>>>>> _______________________________________________
>>>>> Users mailing list Users at ovirt.org
>>>>> http://lists.ovirt.org/mailman/listinfo/users
>>>>> _______________________________________________
>>>>> Users mailing list Users at ovirt.org
>>>>> http://lists.ovirt.org/mailman/listinfo/users
>>>>> _______________________________________________
>>>>> Users mailing list Users at ovirt.org
>>>>> http://lists.ovirt.org/mailman/listinfo/users
>>>>>
>>>>>
>>>>> --
>>>>> signature-TK Thierry Kauffmann
>>>>> Chef du Service Informatique // Faculté des Sciences //
>>>>> Université de
>>>>> Montpellier 2
>>>>>
>>>>>
>>>>> SIF - Service Informatique de la Faculté
>>>>> des Sciences UM2 -
>>>>> Université de Montpellier 2 Service
>>>>> informatique de
>>>>> la Faculté des Sciences (SIF)
>>>>> Université de Montpellier 2
>>>>> CC437 // Place Eugène Bataillon // 34095 Montpellier Cedex 5
>>>>>
>>>>> Tél : 04 67 14 31 58
>>>>> email : thierry.kauffmann at univ-montp2.fr
>>>>> web : http://sif.info-ufr.univ-montp2.fr/
>>>>> http://www.fdsweb.univ-montp2.fr/
>>>>>
>>>> _______________________________________________
>>>> Users mailing list
>>>> Users at ovirt.org
>>>> http://lists.ovirt.org/mailman/listinfo/users
>>> _______________________________________________
>>> Users mailing list
>>> Users at ovirt.org
>>> http://lists.ovirt.org/mailman/listinfo/users
>> _______________________________________________
>> Users mailing list
>> Users at ovirt.org
>> http://lists.ovirt.org/mailman/listinfo/users
>>
> _______________________________________________
> Users mailing list
> Users at ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
More information about the Users
mailing list