----- Original Message ----- > From: "Yair Zaslavsky" <[email protected]> > To: "Sharad Mishra" <[email protected]> > Cc: [email protected] > Sent: Tuesday, February 28, 2012 10:45:36 AM > Subject: Re: [Users] LDAP SimpleAuthentication issue. > > On 02/27/2012 09:11 PM, Sharad Mishra wrote: > > On Fri, 2012-02-24 at 22:19 +0200, Yair Zaslavsky wrote: > >> On 02/24/2012 09:19 PM, Sharad Mishra wrote: > >>> Hi, > >>> I am new to ovirt and LDAP. Looking at adding support for Tivoli > >>> Directory Server. Here is a small java/jndi program (not using > >>> Spring > >>> LDAP) that takes IBM intranet Id and searches the directory to > >>> return > >>> IBM serial number. > >> > >> Hi Sharard, welcome aboard. > >> First of all, although this can be found in our mailing list, I > >> would > >> like to point you that currently Roy Golan (rgolan at redhat dot > >> com), > >> Oved ourfali (ovedo at redhat dot com) and myself are the people > >> that > >> work mostly on ldap/authentication issues at engine-core - so feel > >> free > >> to ask us questions. > >> In addition, I would like to give you a WIKI to help that will > >> give you > >> some "getting started info" (This WIKI was written by Oved) - > >> > >> http://ovirt.org/wiki/DomainInfrastructure > > > > Yair, Thanks for your prompt reply. I did find a link to above wiki > > page > > in one of Oved's earlier post on this mailing list. I found the > > documentation very helpful. > > > >> > >> > >> > >>> > >>> ********* > >>> Hashtable env = new Hashtable(); > >>> env.put("java.naming.factory.initial", > >>> "com.sun.jndi.ldap.LdapCtxFactory"); > >>> env.put("java.naming.factory.url.pkgs", > >>> "com.ibm.jndi"); > >>> env.put("java.naming.provider.url", > >>> "ldap://<ldap-server>:389"); > >>> > >>> String dn = null; > >>> try{ > >>> InitialDirContext dirContext = new > >>> InitialDirContext(env); > >>> > >>> SearchControls constraints = new > >>> SearchControls(); > >>> String[] attr = new String[] {"uid"}; > >>> > >>> constraints.setSearchScope(SearchControls.SUBTREE_SCOPE); > >>> constraints.setReturningAttributes(attr); > >>> > >>> NamingEnumeration ne = > >>> dirContext.search("ou=<ldpap-server-name>,o=ibm.com", > >>> "(mail=" + intranetID + ")", > >>> constraints); > >>> > >>> ************** > >>> > >>> But when I try to use > >>> org.ovirt.engine.core.utils.ipa.SimpleAuthenticationCheck.java, I > >>> get a > >>> "javax.naming.AuthenticationException: [LDAP: error code 49 - > >>> Invalid > >>> Credentials]" > >>> > >>> I am issuing - ldapTemplate.search("", "", contextMapper); > >>> > >>> Where contextMapper is RHDSUserContextMapper and > >>> screenshots of ldapTemplate are attached. > >> As you willl probably see in Oved's WIKI, you don't need to > >> provide > >> RHDSUserContextMapper - the name may be misleading, but this class > >> is > >> for RedHat DS directory service - I think you need to have context > >> mappers for IBM Tivoli DS. > >> In addition you will have to add your own provider type, as can be > >> seen > >> for example in GetRootDSE java (we send a ROOT DSE query in order > >> to > >> "understand" what is our provider type, as currently engine-core > >> supports more than one type of DS. > > > > Yes, I understand that there will be much more code changes to add > > support for a new LDAP server. But my this post was to find the > > reason > > for AuthenticationException. > > > >>> > >>> There may be issues with the way I have setup filter and baseDN; > >>> but > >>> that should not give AuthEx. At this time I am looking for ways > >>> to get > >>> rid of authentication exception. Also, when using simple > >>> authentication, > >>> why do I need to give password? I can run "ldapsearch -LLL > >>> "(mail=<intranetID>)" -h <ldap-server>:389 -x" without password > >>> to give > >>> me expected results. > >> > >> This is a good question - I admit I did not work thoroughly enough > >> with > >> SIMPLE authentication - maybe we can bypass this. > >> I looked at the code of this class - it uses Spring-LDAP > >> LdapContextSource class which extends AbstractContextSource which > >> uses > >> SimpleDirContextAuthenticationStrategy as the default > >> "authentication > >> strategy" - so I guess that "playing" with the code of this > >> example, and > >> ignoring the password may work for you. > > > > Thanks for the hint. While "playing" with AbstractContextSource > > class, I > > was able to find the property AnonymousReadOnly. Setting it to > > 'true' > > eliminated the AuthEx. > Sharad, > I actually wasn't aware to this option in AbstractContextSource. > If spring-ldap does not have an LdapContextSource subclass that sets > this property , maybe you can create your own subclass > (AnoymousReadOnlyContextSource extends LdapContextSource) and set > this > property in its code - and then you can use it in > SimpleAuthenticationCheck, and also in our engine-core code at > PrepareLdapConntectionTask - > In this class we create the context source. Perhaps we can add some > configuration indicating whether to perform AnonymousReadOnly or not, > using our Config infra (See > org.ovirt.engine.core.common.config.Config > and its usages). > > Yair > +1 on that. Nice option indeed. We are here if you need more guidance and assistance.
Thank you, Oved > > > > > Regards, > > Sharad Mishra > > IBM > >> > >> I would like to also point out that when I look at Spring-LDAP's > >> SimpleDirContextAuthenticationStrategy I it does set > >> env.put(Context.SECURITY_CREDENTIALS, password) (look at public > >> void > >> setupEnvironment method ) - so what I have in mind is that you > >> might > >> need to create your own AuthenticationStrategy - see for example > >> org.ovirt.engine.core.bll.adbroker.GSSAPIDirContextAuthenticationStrategy > >> - > >> an authentication strategy that Oved, Roy and myself worked on to > >> support kerberos/GSS-API authentication with Spring-LDAP. > >> > >> You will have to call after you implement such strategy a call to > >> context.setAuthenticationStategy with your implemented > >> AuthenticationStategy (for example, I think it can be placed after > >> the > >> line of - LdapContextSource context = new LdapContextSource(); > >> at > >> SimpleAuthenticationCheck.java > >> > >> I think I gave you some pointers here, > >> Feel free to ask more questions > >> > >> Yair > >> > >> > >>> > >>> Thanks > >>> Sharad Mishra > >>> IBM > >>> > >>> > >>> > >>> > >>> > >>> > >>> > >>> _______________________________________________ > >>> Users mailing list > >>> [email protected] > >>> http://lists.ovirt.org/mailman/listinfo/users > >> > > > > > > _______________________________________________ > Users mailing list > [email protected] > http://lists.ovirt.org/mailman/listinfo/users > _______________________________________________ Users mailing list [email protected] http://lists.ovirt.org/mailman/listinfo/users
