[Users] openldap
Juan Hernandez
jhernand at redhat.com
Mon Nov 18 13:09:32 EST 2013
On 11/18/2013 06:51 PM, Jonas Israelsson wrote:
> On 18/11/13 18:41, Juan Hernandez wrote:
>> On 11/18/2013 06:37 PM, Jonas Israelsson wrote:
>>> On 18/11/13 18:26, Juan Hernandez wrote:
>>>> On 11/18/2013 06:21 PM, Jonas Israelsson wrote:
>>>>> On 18/11/13 17:24, Juan Hernandez wrote:
>>>>>> On 11/18/2013 12:17 PM, Jonas Israelsson wrote:
>>>>>>> On 17/10/13 17:22, Juan Hernandez wrote:
>>>>>>>> On 10/17/2013 05:15 PM, Itamar Heim wrote:
>>>>>>>>> On 10/17/2013 09:57 AM, Jonas Israelsson wrote:
>>>>>>>>>> I saw that openldap is now listed as a provider when invoking
>>>>>>>>>> engine-manage-domains. I'm eager to find more information about this.
>>>>>>>>>> Does anyone know if there is any updated documentation floating around
>>>>>>>>>> somewhere ?
>>>>>>>>>>
>>>>>>>>>> Found this:http://www.ovirt.org/LDAP_Quick_Start
>>>>>>>>>>
>>>>>>>>>> But the article seem only half-finished.
>>>>>>>>>>
>>>>>>>>>> Rgds Jonas
>>>>>>>>>>
>>>>>>>>> this may help you.
>>>>>>>>> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c4
>>>>>>>>> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5
>>>>>>>>>
>>>>>>>>> help finishing the wiki would be great...
>>>>>>>>>
>>>>>>>>> thanks,
>>>>>>>>> Itamar
>>>>>>>>>
>>>>>>>> I am attaching slightly updated notes on how to configure OpenLDAP and
>>>>>>>> Kerberos for both Fedora and RHEL/CentOS.
>>>>>>>>
>>>>>> I just updated the wiki with the latest version of the instructions that
>>>>>> I use. I think they work. Any enhancement is welcome.
>>>>>>
>>>>>>> Anyone knows if ovirt is able to handle that the kdc and directory
>>>>>>> service are running on separate hosts ? In my environment this is the
>>>>>>> case where the kdc is located at a service with it's own name/IP
>>>>>>> (admin.elementary.se), and the directory-service on ldap.elementary.se.
>>>>>>> Even though I see both names are resolved by a name server lookup a
>>>>>>> network sniffer trace shows that later (ldap.elementary.se) used for
>>>>>>> both kerberos and ldap access.
>>>>>>>
>>>>>> By default oVirt uses the Kerberos and LDAP servers that are provided by
>>>>>> DNS. Can you please check what is the result of the following DNS query?
>>>>>>
>>>>>> # dig -t SRV _kerberos._tcp.elementary.se
>>>>> All DNS querys gets the correct answer (both forward and reverse)
>>>>>
>>>>> Engine -- 192.168.24.217 -- dashboard.elementary.se
>>>>> LDAP-Server -- 192.168.24.239 -- ldap.elementary.se
>>>>> KDC -- 192.168.24.240 -- admin.elementary.se
>>>>>
>>>>> dig -t SRV _kerberos._tcp.elementary.se
>>>>>
>>>>> ; <<>> DiG 9.9.3-rpz2+rl.156.01-P2 <<>> -t SRV _kerberos._tcp.elementary.se
>>>>> ;; global options: +cmd
>>>>> ;; Got answer:
>>>>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 19187
>>>>> ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 4
>>>>>
>>>>> ;; OPT PSEUDOSECTION:
>>>>> ; EDNS: version: 0, flags:; udp: 4096
>>>>> ;; QUESTION SECTION:
>>>>> ;_kerberos._tcp.elementary.se. IN SRV
>>>>>
>>>>> ;; ANSWER SECTION:
>>>>> _kerberos._tcp.elementary.se. 3600 IN SRV 0 0 88 admin.elementary.se.
>>>>>
>>>>> ;; AUTHORITY SECTION:
>>>>> elementary.se. 3600 IN NS ns2.elementary.se.
>>>>> elementary.se. 3600 IN NS ns1.elementary.se.
>>>>>
>>>>> ;; ADDITIONAL SECTION:
>>>>> admin.elementary.se. 3600 IN A 192.168.24.240
>>>>> ns1.elementary.se. 3600 IN A 192.168.24.231
>>>>> ns2.elementary.se. 3600 IN A 192.168.24.232
>>>>>
>>>>> ;; Query time: 0 msec
>>>>> ;; SERVER: 192.168.24.231#53(192.168.24.231)
>>>>> ;; WHEN: Mon Nov 18 18:05:05 CET 2013
>>>>> ;; MSG SIZE rcvd: 180
>>>>>
>>>>>
>>>>> Still...
>>>>>
>>>>> 18:13:41.232154 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [S],
>>>>> seq 3592225170, win 14600, options [mss 1460,sackOK,TS val 160790012 ecr
>>>>> 0,nop,wscale 7], length 0
>>>>> 18:13:41.232238 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [S.],
>>>>> seq 2526310478, ack 3592225171, win 14480, options [mss 1460,sackOK,TS
>>>>> val 174749087 ecr 160790012,nop,wscale 7], length 0
>>>>> 18:13:41.232739 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
>>>>> ack 1, win 115, options [nop,nop,TS val 160790013 ecr 174749087], length 0
>>>>> 18:13:41.232787 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [P.],
>>>>> seq 1:141, ack 1, win 115, options [nop,nop,TS val 160790013 ecr
>>>>> 174749087], length 140
>>>>> 18:13:41.232804 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [.],
>>>>> ack 141, win 122, options [nop,nop,TS val 174749087 ecr 160790013], length 0
>>>>> 18:13:41.245137 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [P.],
>>>>> seq 1:704, ack 141, win 122, options [nop,nop,TS val 174749090 ecr
>>>>> 160790013], length 703
>>>>> 18:13:41.245517 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
>>>>> ack 704, win 126, options [nop,nop,TS val 160790026 ecr 174749090], length 0
>>>>> 18:13:41.245578 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [F.],
>>>>> seq 141, ack 704, win 126, options [nop,nop,TS val 160790026 ecr
>>>>> 174749090], length 0
>>>>> 18:13:41.246606 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [F.],
>>>>> seq 704, ack 142, win 122, options [nop,nop,TS val 174749090 ecr
>>>>> 160790026], length 0
>>>>>
>>>>>
>>>>>
>>>> Your SRV records look correct. We may have a bug here. What
>>>> "engine-manage-domains" command line are you exactly using? Are you
>>>> using the "-ldapServers" option?
>>> Yes,
>>>
>>> engine-manage-domains -action=add -domain=elementary.se
>>> -provider=OpenLDAP -user=ovirt -interactive -ldapServers=ldap.elementary.se
>>>
>> Ok. I am most certain now that engine-manage-domains ignores the DNS
>> query for Kerberos servers when the -ldapServers option is used, in fact
>> it doesn't run it. That is a bug. As a workaround you can manually fix
>> the generated krb5.conf file.
>>
>> To verify that it is actually a bug I would appreciate if you can run
>> the engine-manage-domains tool and check if it is performing the DNS
>> query for the Kerberos server (using the DNS server log, or tcpdump). I
>> think that it won't do it, but need to double check.
>>
> Here is the whole communication between the engine and the
> nameserver/kdc/ldap-server during the add-domain command. I'd say it
> does do the query for the kerberos-server.
>
> 18:13:38.037098 IP 192.168.24.217.48417 > 192.168.24.231.53: 1+ SRV?
> _kerberos._tcp.elementary.se. (46)
> 18:13:38.037835 IP 192.168.24.231.53 > 192.168.24.217.48417: 1* 1/2/3
> SRV admin.elementary.se.:88 0 0 (169)
These ^ two lines are the query for the Kerberos server and the
response. So it is doing the query, or maybe you ran the query manually
with dig or ran the tool without the -ldapServers option.
However I still think there is a bug and it is worth investigating it. I
created this bug to track the issue:
https://bugzilla.redhat.com/1031778
> 18:13:41.230377 IP 192.168.24.217.38038 > 192.168.24.231.53: 2207+ A?
> ldap.elementary.se. (36)
> 18:13:41.230424 IP 192.168.24.217.38038 > 192.168.24.231.53: 58788+
> AAAA? ldap.elementary.se. (36)
> 18:13:41.230716 IP 192.168.24.231.53 > 192.168.24.217.38038: 2207* 1/2/2
> A 192.168.24.239 (120)
> 18:13:41.230834 IP 192.168.24.231.53 > 192.168.24.217.38038: 58788*
> 0/1/0 (82)
> 18:13:41.232154 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [S],
> seq 3592225170, win 14600, options [mss 1460,sackOK,TS val 160790012 ecr
> 0,nop,wscale 7], length 0
> 18:13:41.232238 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [S.],
> seq 2526310478, ack 3592225171, win 14480, options [mss 1460,sackOK,TS
> val 174749087 ecr 160790012,nop,wscale 7], length 0
> 18:13:41.232739 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
> ack 1, win 115, options [nop,nop,TS val 160790013 ecr 174749087], length 0
> 18:13:41.232787 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [P.],
> seq 1:141, ack 1, win 115, options [nop,nop,TS val 160790013 ecr
> 174749087], length 140
> 18:13:41.232804 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [.],
> ack 141, win 122, options [nop,nop,TS val 174749087 ecr 160790013], length 0
> 18:13:41.245137 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [P.],
> seq 1:704, ack 141, win 122, options [nop,nop,TS val 174749090 ecr
> 160790013], length 703
> 18:13:41.245517 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
> ack 704, win 126, options [nop,nop,TS val 160790026 ecr 174749090], length 0
> 18:13:41.245578 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [F.],
> seq 141, ack 704, win 126, options [nop,nop,TS val 160790026 ecr
> 174749090], length 0
> 18:13:41.246606 IP 192.168.24.239.88 > 192.168.24.217.42362: Flags [F.],
> seq 704, ack 142, win 122, options [nop,nop,TS val 174749090 ecr
> 160790026], length 0
> 18:13:41.246949 IP 192.168.24.217.42362 > 192.168.24.239.88: Flags [.],
> ack 705, win 126, options [nop,nop,TS val 160790028 ecr 174749090], length 0
> 18:13:41.279159 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags [S],
> seq 2210256546, win 14600, options [mss 1460,sackOK,TS val 160790060 ecr
> 0,nop,wscale 7], length 0
> 18:13:41.279218 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags
> [S.], seq 323087650, ack 2210256547, win 14480, options [mss
> 1460,sackOK,TS val 174749098 ecr 160790060,nop,wscale 7], length 0
> 18:13:41.279627 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags [.],
> ack 1, win 115, options [nop,nop,TS val 160790060 ecr 174749098], length 0
> 18:13:41.288761 IP 192.168.24.217.49767 > 192.168.24.231.53: 13267+ PTR?
> 239.24.168.192.in-addr.arpa. (45)
> 18:13:41.289162 IP 192.168.24.231.53 > 192.168.24.217.49767: 13267*
> 1/1/1 PTR ldap.elementary.se. (111)
> 18:13:41.295950 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [S],
> seq 2256374539, win 14600, options [mss 1460,sackOK,TS val 160790076 ecr
> 0,nop,wscale 7], length 0
> 18:13:41.296006 IP 192.168.24.239.88 > 192.168.24.217.42364: Flags [S.],
> seq 1178658823, ack 2256374540, win 14480, options [mss 1460,sackOK,TS
> val 174749103 ecr 160790076,nop,wscale 7], length 0
> 18:13:41.296390 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [.],
> ack 1, win 115, options [nop,nop,TS val 160790077 ecr 174749103], length 0
> 18:13:41.296440 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [P.],
> seq 1:646, ack 1, win 115, options [nop,nop,TS val 160790077 ecr
> 174749103], length 645
> 18:13:41.296454 IP 192.168.24.239.88 > 192.168.24.217.42364: Flags [.],
> ack 646, win 124, options [nop,nop,TS val 174749103 ecr 160790077], length 0
> 18:13:41.313368 IP 192.168.24.239.88 > 192.168.24.217.42364: Flags [P.],
> seq 1:626, ack 646, win 124, options [nop,nop,TS val 174749107 ecr
> 160790077], length 625
> 18:13:41.313749 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [.],
> ack 626, win 124, options [nop,nop,TS val 160790094 ecr 174749107], length 0
> 18:13:41.313766 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [F.],
> seq 646, ack 626, win 124, options [nop,nop,TS val 160790094 ecr
> 174749107], length 0
> 18:13:41.314773 IP 192.168.24.239.88 > 192.168.24.217.42364: Flags [F.],
> seq 626, ack 647, win 124, options [nop,nop,TS val 174749107 ecr
> 160790094], length 0
> 18:13:41.315070 IP 192.168.24.217.42364 > 192.168.24.239.88: Flags [.],
> ack 627, win 124, options [nop,nop,TS val 160790096 ecr 174749107], length 0
> 18:13:41.374356 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags
> [P.], seq 1:621, ack 1, win 115, options [nop,nop,TS val 160790155 ecr
> 174749098], length 620
> 18:13:41.374425 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags [.],
> ack 621, win 123, options [nop,nop,TS val 174749122 ecr 160790155],
> length 0
> 18:13:41.458769 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags
> [P.], seq 1:77, ack 621, win 123, options [nop,nop,TS val 174749143 ecr
> 160790155], length 76
> 18:13:41.459284 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags [.],
> ack 77, win 115, options [nop,nop,TS val 160790240 ecr 174749143], length 0
> 18:13:41.462180 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags
> [P.], seq 621:677, ack 77, win 115, options [nop,nop,TS val 160790243
> ecr 174749143], length 56
> 18:13:41.462237 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags [.],
> ack 677, win 123, options [nop,nop,TS val 174749144 ecr 160790243],
> length 0
> 18:13:41.462855 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags
> [P.], seq 77:91, ack 677, win 123, options [nop,nop,TS val 174749144 ecr
> 160790243], length 14
> 18:13:41.475422 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags
> [F.], seq 677, ack 91, win 115, options [nop,nop,TS val 160790256 ecr
> 174749144], length 0
> 18:13:41.477538 IP 192.168.24.239.389 > 192.168.24.217.57156: Flags
> [F.], seq 91, ack 678, win 123, options [nop,nop,TS val 174749148 ecr
> 160790256], length 0
> 18:13:41.477853 IP 192.168.24.217.57156 > 192.168.24.239.389: Flags [.],
> ack 92, win 115, options [nop,nop,TS val 160790258 ecr 174749148], length 0
>
>
--
Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta
3ºD, 28016 Madrid, Spain
Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.
More information about the Users
mailing list