[Users] openldap
Juan Hernandez
jhernand at redhat.com
Thu Oct 17 11:22:59 EDT 2013
On 10/17/2013 05:15 PM, Itamar Heim wrote:
> On 10/17/2013 09:57 AM, Jonas Israelsson wrote:
>> I saw that openldap is now listed as a provider when invoking
>> engine-manage-domains. I'm eager to find more information about this.
>> Does anyone know if there is any updated documentation floating around
>> somewhere ?
>>
>> Found this: http://www.ovirt.org/LDAP_Quick_Start
>>
>> But the article seem only half-finished.
>>
>> Rgds Jonas
>>
>
> this may help you.
> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c4
> https://bugzilla.redhat.com/show_bug.cgi?id=967327#c5
>
> help finishing the wiki would be great...
>
> thanks,
> Itamar
>
I am attaching slightly updated notes on how to configure OpenLDAP and
Kerberos for both Fedora and RHEL/CentOS.
--
Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta
3ºD, 28016 Madrid, Spain
Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.
-------------- next part --------------
This are instructions to setup an environment for testing authentication
of ovirt-engine with OpenLDAP. All the instructions are based on
Fedora 18 and assume that the name of the domain is f19.example.com and
that the name of the realm is F19.EXAMPLE.COM.
1. Install the OpenLDAP server and clients:
# yum -y install openldap-{clients,servers}
# yum -y install cyrus-sasl-gssapi
2. Start and enable the OpenLDAP service:
# systemctl start slapd
# systemctl enable slapd
3. Add the cosine and inetorgperson schemas:
# ldapadd -H ldapi:/// -Y EXTERNAL -f /etc/openldap/schema/cosine.ldif
# ldapadd -H ldapi:/// -Y EXTERNAL -f /etc/openldap/schema/inetorgperson.ldif
4. Add the memberof overlay:
# cat > memberof.ldif <<'.'
dn: cn={0}module,cn=config
objectClass: olcModuleList
cn: {0}module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: {0}memberof.la
dn: olcOverlay={0}memberof,olcDatabase={2}hdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {0}memberof
.
# ldapadd -H ldapi:/// -Y EXTERNAL -f memberof.ldif
5. Create a password for the directory administrator (I used example123):
# slappasswd
New password:
Re-enter new password:
{SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2
6. Change the suffix and the credentians of the directory manager:
# cat > config.ldif <<'.'
dn: cn=config
replace: olcSaslSecProps
olcSaslSecProps: noanonymous,noplain,minssf=1
-
dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=f19,dc=example,dc=com
-
replace: olcRootDN
olcRootDN: cn=Manager,dc=f19,dc=example,dc=com
-
replace: olcRootPW
olcRootPW: {SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2
-
.
# ldapmodify -H ldapi:/// -Y EXTERNAL -f config.ldif
7. Create the top level structure of the directory, with a branch for
users and another for groups:
# cat > structure.ldif <<'.'
dn: dc=f19,dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: f19
o: F19 Example Inc.
dn: ou=Users,dc=f19,dc=example,dc=com
objectClass: organizationalUnit
ou: Users
dn: ou=Groups,dc=f19,dc=example,dc=com
objectClass: organizationalUnit
ou: Groups
.
# ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f structure.ldif
8. Create some users:
# cat > users.ldif <<'.'
dn: uid=user0,ou=Users,dc=f19,dc=example,dc=com
objectclass: inetOrgPerson
objectclass: uidObject
uid: user0
cn: User2
givenName: User
title: User
mail: user0 at f19.example.com
sn: 0
dn: uid=user1,ou=Users,dc=f19,dc=example,dc=com
objectclass: inetOrgPerson
objectclass: uidObject
uid: user1
cn: User1
givenName: User
title: User
mail: user1 at f19.example.com
sn: 1
.
Note that the users don't need to have a memberof attribute, as this
will be calculated and assigned by the memberof overlay when the group
is created or modified.
# ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f users.ldif
9. Create some groups:
# cat > groups.ldif <<'.'
dn: cn=Group0,ou=Groups,dc=f19,dc=example,dc=com
objectclass: groupOfNames
cn: Group0
member: uid=user0,ou=Users,dc=f19,dc=example,dc=com
member: uid=user1,ou=Users,dc=f19,dc=example,dc=com
.
# ldapadd -H ldapi:/// -D 'cn=Manager,dc=f19,dc=example,dc=com' -x -W -f groups.ldif
Once this is done the directory should return the memberOf attributes
when quering users:
# ldapsearch -H ldapi:/// -b 'dc=f19,dc=example,dc=com' -x '(uid=user0)' memberOf -LLL
dn: uid=user0,ou=Users,dc=f19,dc=example,dc=com
memberOf: cn=Group0,ou=Groups,dc=f19,dc=example,dc=com
10. Install the kerberos server packages:
# yum -y install krb5-{workstation,server}
11. Adjust the /etc/krb5.conf file, should be something like this:
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
default_realm = F19.EXAMPLE.COM
[realms]
F19.EXAMPLE.COM = {
kdc = f19.example.com
admin_server = f19.example.com
}
[domain_realm]
.f19.example.com = F19.EXAMPLE.COM
f19.example.com = F19.EXAMPLE.COM
11. Create the kerberos database:
# cd /var/kerberos/krb5kdc
# kdb5_util create -s
Modify the /var/kerberos/krb5kdc/kdc.conf and
/var/kerberos/krb5kdc/kadm5.acl and replace EXAMPLE.COM with your realm
name.
12. Create the a kerberos admin user, for root, for example:
# kadmin.local
Authenticating as principal root/admin at F19.EXAMPLE.COM with password.
kadmin.local: add_principal root/admin
WARNING: no policy specified for root/admin at F19.EXAMPLE.COM; defaulting to no policy
Enter password for principal "root/admin at F19.EXAMPLE.COM":
Re-enter password for principal "root/admin at F19.EXAMPLE.COM":
Principal "root/admin at F19.EXAMPLE.COM" created.
13. Start and enable the krb5kdc and kadmin services:
# systemctl start krb5kdc
# systemctl enable krb5kdc
# systemctl start kadmin
# systemctl enable kadmin
14. Check that you can login with the admin user:
# kadmin
Authenticating as principal root/admin at F19.EXAMPLE.COM with password.
Password for root/admin at F19.EXAMPLE.COM:
kadmin: list_principals
K/M at F19.EXAMPLE.COM
kadmin/admin at F19.EXAMPLE.COM
15. Add the users to the kerberos database and verify that they can login:
# kadmin
kadmin: add_principal user0
kadmin: add_principal user1
# kinit user0
Password for user0 at F19.EXAMPLE.COM:
16. Create a password for the LDAP server and extract it to a keytab
file with read permissions for the user running the LDAP server (usually
the "ldap" user):
# kadmin
kadmin: add_principal -randkey ldap/f19.example.com
kadmin: ktadd -keytab /etc/openldap/ldap.keytab ldap/f19.example.com
# chgrp ldap /etc/openldap/ldap.keytab
# chmod 640 /etc/openldap/ldap.keytab
17. Make sure that the LDAP server is using the keytab file created in
the previous step, adding the KRB5_KTNAME to the /etc/sysconfig/slapd
file (it is already there, just uncomment it):
KRB5_KTNAME="FILE:/etc/openldap/ldap.keytab"
Then restart the LDAP server:
# systemctl restart slapd
18. Test that users can do LDAP queries using the kerberos credentials:
# kinit user0
# Password for user0 at F19.EXAMPLE.COM:
# ldapsearch -H ldap://f19.example.com -Y GSSAPI -b 'dc=f19,dc=example,dc=com' '(uid=user0)' memberOf
The query should succeed without asking any password.
19. Add DNS SRV records for the LDAP and Kerberos servers, something
like this in the zone file:
_kerberos._tcp.f19.example.com. SRV 0 100 88 f19.example.com.
_ldap._tcp.f19.example.com. SRV 0 100 389 f19.example.com.
20. Register the domain with engine-manage-domains:
# engine-manage-domains -action=add -domain=f19.example.com -provider=OpenLDAP -user=user0 -interactive
-------------- next part --------------
This are instructions to setup an environment for testing authentication
of ovirt-engine with OpenLDAP. All the instructions are based on RHEL6
and assume that the name of the domain is rhel6.example.com and that the
name of the realm is RHEL6.EXAMPLE.COM.
1. Install the OpenLDAP server and clients and the support for the
GSSAPI SASL mechanism:
# yum -y install openldap-{clients,servers} cyrus-sasl-gsslapi
# yum -y install cyrus-sasl-gsslapi
2. Start and enable the OpenLDAP service:
# chkconfig slapd on
# service slapd start
3. Add the memberof overlay:
# cat > memberof.ldif <<'.'
dn: cn={0}module,cn=config
objectClass: olcModuleList
cn: {0}module
olcModulePath: /usr/lib64/openldap
olcModuleLoad: {0}memberof.la
dn: olcOverlay={0}memberof,olcDatabase={2}bdb,cn=config
objectClass: olcConfig
objectClass: olcMemberOf
objectClass: olcOverlayConfig
objectClass: top
olcOverlay: {0}memberof
.
# ldapadd -H ldapi:/// -Y EXTERNAL -f memberof.ldif
4. Create a password for the directory administrator (I used example123):
# slappasswd
New password:
Re-enter new password:
{SSHA}0EAIzAxRBMZ1LP/XAhq4q80DLpNpDzr2
5. Change the suffix and the credentials of the directory manager:
# cat > config.ldif <<'.'
dn: olcDatabase={2}bdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=rhel6,dc=example,dc=com
-
replace: olcRootDN
olcRootDN: cn=Manager,dc=rhel6,dc=example,dc=com
-
replace: olcRootPW
olcRootPW: {SSHA}47TDR/r8yaDQZ7rF9UyaO7MDTsEm/zqT
-
.
# ldapmodify -H ldapi:/// -Y EXTERNAL -f config.ldif
6. Create the top level structure of the directory, with a branch for
users and another for groups:
# cat > structure.ldif <<'.'
dn: dc=rhel6,dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: rhel6
o: RHEL6 Example Inc.
dn: ou=Users,dc=rhel6,dc=example,dc=com
objectClass: organizationalUnit
ou: Users
dn: ou=Groups,dc=rhel6,dc=example,dc=com
objectClass: organizationalUnit
ou: Groups
.
# ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f structure.ldif
7. Create some users:
# cat > users.ldif <<'.'
dn: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com
objectclass: inetOrgPerson
objectclass: uidObject
uid: user0
cn: User2
givenName: User
title: User
mail: user0 at rhel6.example.com
sn: 0
dn: uid=user1,ou=Users,dc=rhel6,dc=example,dc=com
objectclass: inetOrgPerson
objectclass: uidObject
uid: user1
cn: User1
givenName: User
title: User
mail: user1 at rhel6.example.com
sn: 1
.
Note that the users don't need to have a memberof attribute, as this
will be calculated and assigned by the memberof overlay when the group
is created or modified.
# ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f users.ldif
8. Create some groups:
# cat > groups.ldif <<'.'
dn: cn=Group0,ou=Groups,dc=rhel6,dc=example,dc=com
objectclass: groupOfNames
cn: Group0
member: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com
member: uid=user1,ou=Users,dc=rhel6,dc=example,dc=com
.
# ldapadd -H ldapi:/// -D 'cn=Manager,dc=rhel6,dc=example,dc=com' -x -W -f groups.ldif
Once this is done the directory should return the memberOf attributes
when quering users:
# ldapsearch -H ldapi:/// -b 'dc=rhel6,dc=example,dc=com' -x '(uid=user0)' memberOf -LLL
dn: uid=user0,ou=Users,dc=rhel6,dc=example,dc=com
memberOf: cn=Group0,ou=Groups,dc=rhel6,dc=example,dc=com
9. Install the kerberos server packages:
# yum -y install krb5-{workstation,server}
10. Adjust the /etc/krb5.conf file, should be something like this:
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
default_realm = RHEL6.EXAMPLE.COM
[realms]
RHEL6.EXAMPLE.COM = {
kdc = rhel6.example.com
admin_server = rhel6.example.com
}
[domain_realm]
.rhel6.example.com = RHEL6.EXAMPLE.COM
rhel6.example.com = RHEL6.EXAMPLE.COM
11. Create the kerberos database:
# cd /var/kerberos/krb5kdc
# kdb5_util create -s
Modify the /var/kerberos/krb5kdc/kdc.conf and
/var/kerberos/krb5kdc/kadm5.acl and replace EXAMPLE.COM with your realm
name.
12. Create the a kerberos admin user, for root, for example:
# kadmin.local
Authenticating as principal root/admin at RHEL6.EXAMPLE.COM with password.
kadmin.local: add_principal root/admin
WARNING: no policy specified for root/admin at RHEL6.EXAMPLE.COM; defaulting to no policy
Enter password for principal "root/admin at RHEL6.EXAMPLE.COM":
Re-enter password for principal "root/admin at RHEL6.EXAMPLE.COM":
Principal "root/admin at RHEL6.EXAMPLE.COM" created.
13. Start and enable the krb5kdc and kadmin services:
# chkconfig krb5kdc on
# service krb5kdc start
# chkconfig kadmin on
# service kadmin start
14. Check that you can login with the admin user:
# kadmin
Authenticating as principal root/admin at RHEL6.EXAMPLE.COM with password.
Password for root/admin at RHEL6.EXAMPLE.COM:
kadmin: list_principals
K/M at RHEL6.EXAMPLE.COM
kadmin/admin at RHEL6.EXAMPLE.COM
15. Add the users to the kerberos database and verify that they can login:
# kadmin
kadmin: add_principal user0
kadmin: add_principal user1
# kinit user0
Password for user0 at RHEL6.EXAMPLE.COM:
16. Create a password for the LDAP server and extract it to a keytab
file with read permissions for the user running the LDAP server (usually
the "ldap" user):
# kadmin
kadmin: add_principal -randkey ldap/rhel6.example.com
kadmin: ktadd -keytab /etc/openldap/ldap.keytab ldap/rhel6.example.com
# chgrp ldap /etc/openldap/ldap.keytab
# chmod 640 /etc/openldap/ldap.keytab
17. Make sure that the LDAP server is using the keytab file created in
the previous step, adding the KRB5_KTNAME to the /etc/sysconfig/ldap
file:
KRB5_KTNAME=/etc/openldap/ldap.keytab
Then restart the LDAP server:
# service slapd restart
18. Test that users can do LDAP queries using the kerberos credentials:
# kinit user0
# Password for user0 at RHEL6.EXAMPLE.COM:
# ldapsearch -H ldap://rhel6.example.com -Y GSSAPI -b 'dc=rhel6,dc=example,dc=com' '(uid=user0)' memberOf
The query should succeed without asking any password.
19. Add DNS SRV records for the LDAP and Kerberos servers, something
like this in the zone file:
_kerberos._tcp.rhel6.example.com. SRV 0 100 88 rhel6.example.com.
_ldap._tcp.rhel6.example.com. SRV 0 100 389 rhel6.example.com.
20. Register the domain with engine-manage-domains:
# engine-manage-domains -action=add -domain=rhel6.example.com -provider=OpenLDAP -user=user0 -interactive
More information about the Users
mailing list