[Users] openldap

Juan Hernandez jhernand at redhat.com
Thu Oct 17 11:22:59 EDT 2013


On 10/17/2013 05:15 PM, Itamar Heim wrote:
> On 10/17/2013 09:57 AM, Jonas Israelsson wrote:
>> I saw that openldap is now listed as a provider when invoking
>> engine-manage-domains. I'm eager to find more information about this.
>> Does anyone know if there is any updated documentation floating around
>> somewhere ?
>>
>> Found this: http://www.ovirt.org/LDAP_Quick_Start
>>
>> But the article seem only half-finished.
>>
>> Rgds Jonas
>>
> 
> this may help you.
> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c4
> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5
> 
> help finishing the wiki would be great...
> 
> thanks,
>     Itamar
> 

I am attaching slightly updated notes on how to configure OpenLDAP and
Kerberos for both Fedora and RHEL/CentOS.

-- 
Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta
3ºD, 28016 Madrid, Spain
Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.
-------------- next part --------------
This are instructions to setup an environment for testing authentication
of ovirt-engine with OpenLDAP. All the instructions are based on
Fedora 18 and assume that the name of the domain is f19.example.com and
that the name of the realm is F19.EXAMPLE.COM.

1. Install the OpenLDAP server and clients:

# yum -y install openldap-{clients,servers}
# yum -y install cyrus-sasl-gssapi

2. Start and enable the OpenLDAP service:

# systemctl start slapd
# systemctl enable slapd

3. Add the cosine and inetorgperson schemas:

# ldapadd -H ldapi:/// -Y EXTERNAL -f /etc/openldap/schema/cosine.ldif
# ldapadd -H ldapi:/// -Y EXTERNAL -f /etc/openldap/schema/inetorgperson.ldif

4. Add the memberof overlay:

# cat > memberof.ldif <<'.'
dn: cn={0}module,cn=config
objectClass: olcModuleList
cn: {0}module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: {0}memberof.la

dn: olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {0}memberof
.

# ldapadd -H ldapi:/// -Y EXTERNAL -f memberof.ldif

5. Create a password for the directory administrator (I used example123):

# slappasswd 
New password: 
Re-enter new password: 
{SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2

6. Change the suffix and the credentians of the directory manager:

# cat > config.ldif <<'.'
dn: cn=config
replace: olcSaslSecProps
olcSaslSecProps: noanonymous,noplain,minssf=1
-

dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=f19,dc=example,dc=com
-
replace: olcRootDN
olcRootDN: cn=Manager,dc=f19,dc=example,dc=com
-
replace: olcRootPW
olcRootPW: {SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2
-
.

# ldapmodify -H ldapi:/// -Y EXTERNAL -f config.ldif

7. Create the top level structure of the directory, with a branch for
users and another for groups:

# cat > structure.ldif <<'.'
dn: dc=f19,dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: f19
o: F19 Example Inc.

dn: ou=Users,dc=f19,dc=example,dc=com
objectClass: organizationalUnit
ou: Users

dn: ou=Groups,dc=f19,dc=example,dc=com
objectClass: organizationalUnit
ou: Groups
.

# ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f structure.ldif

8. Create some users:

# cat > users.ldif <<'.'
dn: uid=user0,ou=Users,dc=f19,dc=example,dc=com
objectclass: inetOrgPerson
objectclass: uidObject
uid: user0
cn: User2
givenName: User
title: User
mail: user0 at f19.example.com
sn: 0

dn: uid=user1,ou=Users,dc=f19,dc=example,dc=com
objectclass: inetOrgPerson
objectclass: uidObject
uid: user1
cn: User1
givenName: User
title: User
mail: user1 at f19.example.com
sn: 1
.

Note that the users don't need to have a memberof attribute, as this
will be calculated and assigned by the memberof overlay when the group
is created or modified.

# ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f users.ldif

9. Create some groups:

# cat > groups.ldif <<'.'
dn: cn=Group0,ou=Groups,dc=f19,dc=example,dc=com
objectclass: groupOfNames
cn: Group0
member: uid=user0,ou=Users,dc=f19,dc=example,dc=com
member: uid=user1,ou=Users,dc=f19,dc=example,dc=com
.

# ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f groups.ldif

Once this is done the directory should return the memberOf attributes
when quering users:

# ldapsearch -H ldapi:/// -b 'dc=f19,dc=example,dc=com' -x '(uid=user0)' memberOf -LLL
dn: uid=user0,ou=Users,dc=f19,dc=example,dc=com
memberOf: cn=Group0,ou=Groups,dc=f19,dc=example,dc=com

10. Install the kerberos server packages:

# yum -y install krb5-{workstation,server}

11. Adjust the /etc/krb5.conf file, should be something like this:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 default_realm = F19.EXAMPLE.COM

[realms]
 F19.EXAMPLE.COM = {
  kdc = f19.example.com
  admin_server = f19.example.com
 }

[domain_realm]
 .f19.example.com = F19.EXAMPLE.COM
 f19.example.com = F19.EXAMPLE.COM

11. Create the kerberos database:

# cd /var/kerberos/krb5kdc
# kdb5_util create -s

Modify the /var/kerberos/krb5kdc/kdc.conf and
/var/kerberos/krb5kdc/kadm5.acl and replace EXAMPLE.COM with your realm
name.

12. Create the a kerberos admin user, for root, for example:

# kadmin.local
Authenticating as principal root/admin at F19.EXAMPLE.COM with password.
kadmin.local:  add_principal root/admin
WARNING: no policy specified for root/admin at F19.EXAMPLE.COM; defaulting to no policy
Enter password for principal "root/admin at F19.EXAMPLE.COM": 
Re-enter password for principal "root/admin at F19.EXAMPLE.COM": 
Principal "root/admin at F19.EXAMPLE.COM" created.

13. Start and enable the krb5kdc and kadmin services:

# systemctl start krb5kdc
# systemctl enable krb5kdc
# systemctl start kadmin
# systemctl enable kadmin

14. Check that you can login with the admin user:

# kadmin
Authenticating as principal root/admin at F19.EXAMPLE.COM with password.
Password for root/admin at F19.EXAMPLE.COM: 
kadmin:  list_principals
K/M at F19.EXAMPLE.COM
kadmin/admin at F19.EXAMPLE.COM

15. Add the users to the kerberos database and verify that they can login:

# kadmin
kadmin: add_principal user0
kadmin: add_principal user1

# kinit user0
Password for user0 at F19.EXAMPLE.COM: 

16. Create a password for the LDAP server and extract it to a keytab
file with read permissions for the user running the LDAP server (usually
the "ldap" user):

# kadmin
kadmin:  add_principal -randkey ldap/f19.example.com
kadmin:  ktadd -keytab /etc/openldap/ldap.keytab ldap/f19.example.com

# chgrp ldap /etc/openldap/ldap.keytab
# chmod 640 /etc/openldap/ldap.keytab

17. Make sure that the LDAP server is using the keytab file created in
the previous step, adding the KRB5_KTNAME to the /etc/sysconfig/slapd
file (it is already there, just uncomment it):

KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab"

Then restart the LDAP server:

# systemctl restart slapd

18. Test that users can do LDAP queries using the kerberos credentials:

# kinit user0
# Password for user0 at F19.EXAMPLE.COM:

# ldapsearch -H ldap://f19.example.com -Y GSSAPI -b 'dc=f19,dc=example,dc=com' '(uid=user0)' memberOf

The query should succeed without asking any password.

19. Add DNS SRV records for the LDAP and Kerberos servers, something
like this in the zone file:

_kerberos._tcp.f19.example.com. SRV 0 100 88 f19.example.com.
_ldap._tcp.f19.example.com. SRV 0 100 389 f19.example.com.

20. Register the domain with engine-manage-domains:

# engine-manage-domains -action=add -domain=f19.example.com -provider=OpenLDAP -user=user0 -interactive
-------------- next part --------------
This are instructions to setup an environment for testing authentication
of ovirt-engine with OpenLDAP. All the instructions are based on RHEL6
and assume that the name of the domain is rhel6.example.com and that the
name of the realm is RHEL6.EXAMPLE.COM.

1. Install the OpenLDAP server and clients and the support for the
GSSAPI SASL mechanism:

# yum -y install openldap-{clients,servers} cyrus-sasl-gsslapi
# yum -y install cyrus-sasl-gsslapi

2. Start and enable the OpenLDAP service:

# chkconfig slapd on
# service slapd start

3. Add the memberof overlay:

# cat > memberof.ldif <<'.'
dn: cn={0}module,cn=config
objectClass: olcModuleList
cn: {0}module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: {0}memberof.la

dn: olcOverlay={0}memberof,olcDatabase={2}bdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {0}memberof
.

# ldapadd -H ldapi:/// -Y EXTERNAL -f memberof.ldif

4. Create a password for the directory administrator (I used example123):

# slappasswd 
New password: 
Re-enter new password: 
{SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2

5. Change the suffix and the credentials of the directory manager:

# cat > config.ldif <<'.'
dn: olcDatabase={2}bdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=rhel6,dc=example,dc=com
-
replace: olcRootDN
olcRootDN: cn=Manager,dc=rhel6,dc=example,dc=com
-
replace: olcRootPW
olcRootPW: {SSHA}47TDR/r8yaDQZ7rF9UyaO7MDTsEm/zqT
-
.

# ldapmodify -H ldapi:/// -Y EXTERNAL -f config.ldif

6. Create the top level structure of the directory, with a branch for
users and another for groups:

# cat > structure.ldif <<'.'
dn: dc=rhel6,dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: rhel6
o: RHEL6 Example Inc.

dn: ou=Users,dc=rhel6,dc=example,dc=com
objectClass: organizationalUnit
ou: Users

dn: ou=Groups,dc=rhel6,dc=example,dc=com
objectClass: organizationalUnit
ou: Groups
.

# ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f structure.ldif

7. Create some users:

# cat > users.ldif <<'.'
dn: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com
objectclass: inetOrgPerson
objectclass: uidObject
uid: user0
cn: User2
givenName: User
title: User
mail: user0 at rhel6.example.com
sn: 0

dn: uid=user1,ou=Users,dc=rhel6,dc=example,dc=com
objectclass: inetOrgPerson
objectclass: uidObject
uid: user1
cn: User1
givenName: User
title: User
mail: user1 at rhel6.example.com
sn: 1
.

Note that the users don't need to have a memberof attribute, as this
will be calculated and assigned by the memberof overlay when the group
is created or modified.

# ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f users.ldif

8. Create some groups:

# cat > groups.ldif <<'.'
dn: cn=Group0,ou=Groups,dc=rhel6,dc=example,dc=com
objectclass: groupOfNames
cn: Group0
member: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com
member: uid=user1,ou=Users,dc=rhel6,dc=example,dc=com
.

# ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f groups.ldif

Once this is done the directory should return the memberOf attributes
when quering users:

# ldapsearch -H ldapi:/// -b 'dc=rhel6,dc=example,dc=com' -x '(uid=user0)' memberOf -LLL
dn: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com
memberOf: cn=Group0,ou=Groups,dc=rhel6,dc=example,dc=com

9. Install the kerberos server packages:

# yum -y install krb5-{workstation,server}

10. Adjust the /etc/krb5.conf file, should be something like this:

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 default_realm = RHEL6.EXAMPLE.COM

[realms]
 RHEL6.EXAMPLE.COM = {
  kdc = rhel6.example.com
  admin_server = rhel6.example.com
 }

[domain_realm]
 .rhel6.example.com = RHEL6.EXAMPLE.COM
 rhel6.example.com = RHEL6.EXAMPLE.COM

11. Create the kerberos database:

# cd /var/kerberos/krb5kdc
# kdb5_util create -s

Modify the /var/kerberos/krb5kdc/kdc.conf and
/var/kerberos/krb5kdc/kadm5.acl and replace EXAMPLE.COM with your realm
name.

12. Create the a kerberos admin user, for root, for example:

# kadmin.local
Authenticating as principal root/admin at RHEL6.EXAMPLE.COM with password.
kadmin.local:  add_principal root/admin
WARNING: no policy specified for root/admin at RHEL6.EXAMPLE.COM; defaulting to no policy
Enter password for principal "root/admin at RHEL6.EXAMPLE.COM": 
Re-enter password for principal "root/admin at RHEL6.EXAMPLE.COM": 
Principal "root/admin at RHEL6.EXAMPLE.COM" created.

13. Start and enable the krb5kdc and kadmin services:

# chkconfig krb5kdc on
# service krb5kdc start
# chkconfig kadmin on
# service kadmin start

14. Check that you can login with the admin user:

# kadmin
Authenticating as principal root/admin at RHEL6.EXAMPLE.COM with password.
Password for root/admin at RHEL6.EXAMPLE.COM: 
kadmin:  list_principals
K/M at RHEL6.EXAMPLE.COM
kadmin/admin at RHEL6.EXAMPLE.COM

15. Add the users to the kerberos database and verify that they can login:

# kadmin
kadmin: add_principal user0
kadmin: add_principal user1

# kinit user0
Password for user0 at RHEL6.EXAMPLE.COM: 

16. Create a password for the LDAP server and extract it to a keytab
file with read permissions for the user running the LDAP server (usually
the "ldap" user):

# kadmin
kadmin:  add_principal -randkey ldap/rhel6.example.com
kadmin:  ktadd -keytab /etc/openldap/ldap.keytab ldap/rhel6.example.com

# chgrp ldap /etc/openldap/ldap.keytab
# chmod 640 /etc/openldap/ldap.keytab

17. Make sure that the LDAP server is using the keytab file created in
the previous step, adding the KRB5_KTNAME to the /etc/sysconfig/ldap
file:

KRB5_KTNAME=/etc/openldap/ldap.keytab

Then restart the LDAP server:

# service slapd restart

18. Test that users can do LDAP queries using the kerberos credentials:

# kinit user0
# Password for user0 at RHEL6.EXAMPLE.COM:

# ldapsearch -H ldap://rhel6.example.com -Y GSSAPI -b 'dc=rhel6,dc=example,dc=com' '(uid=user0)' memberOf

The query should succeed without asking any password.

19. Add DNS SRV records for the LDAP and Kerberos servers, something
like this in the zone file:

_kerberos._tcp.rhel6.example.com. SRV 0 100 88 rhel6.example.com.
_ldap._tcp.rhel6.example.com. SRV 0 100 389 rhel6.example.com.

20. Register the domain with engine-manage-domains:

# engine-manage-domains -action=add -domain=rhel6.example.com -provider=OpenLDAP -user=user0 -interactive


More information about the Users mailing list