Re: [ovirt-users] Error authenticating bind using the AAA OpenLDAP module

Thu, 15 Jan 2015 01:35:53 -0800 

Can you try add this line:

pool.default.auth.type = simple

to your prop file?

Something like:

......
pool.default.serverset.single.server = ${global:vars.server}
pool.default.auth.type = simple
pool.default.auth.simple.bindDN = cn=authenticate,ou=System,dc=example,dc=org 
pool.default.auth.simple.password = XXXXXXXXX
........

Thanks,
Ondra

On 01/15/2015 10:20 AM, Bruno Rodriguez wrote:

Thank you very much,

using the following ldap.example.org <http://ldap.example.org> file:

---------------------

include = <openldap_example.properties>
include = <rfc2307.properties>

vars.server = ldap1.example.org <http://ldap1.example.org>
#vars.user = cn=authenticate,ou=System,dc=example,dc=org
#vars.password = XXXXXXXXX

pool.default.serverset.single.server = ${global:vars.server}
pool.default.auth.simple.bindDN =
cn=authenticate,ou=System,dc=example,dc=org
pool.default.auth.simple.password = XXXXXXXXX

pool.default.ssl.startTLS = true
pool.default.ssl.truststore.file =
/etc/ovirt-engine/extensions.d/ldap.example.org_keystore.jks
pool.default.ssl.truststore.password = XXXXXXXXX

---------------------

Then I get the following in the engine log:


2015-01-15 10:04:15,250 ERROR
[org.ovirt.engine.core.bll.aaa.LoginAdminUserCommand]
(ajp--127.0.0.1-8702-3) Error during CanDoActionFailure.: Class: class
org.ovirt.engine.core.extensions.mgr.ExtensionInvokeCommandFailedException
Input:
{Extkey[name=AAA_AUTHN_CREDENTIALS;type=class
java.lang.String;uuid=AAA_AUTHN_CREDENTIALS[03b96485-4bb5-4592-8167-810a5c909706];]=***,
Extkey[name=EXTENSION_INVOKE_CONTEXT;type=class
org.ovirt.engine.api.extensions.ExtMap;uuid=EXTENSION_INVOKE_CONTEXT[886d2ebb-312a-49ae-9cc3-e1f849834b7d];]={Extkey[name=EXTENSION_INTERFACE_VERSION_MAX;type=class
java.lang.Integer;uuid=EXTENSION_INTERFACE_VERSION_MAX[f4cff49f-2717-4901-8ee9-df362446e3e7];]=0,
Extkey[name=EXTENSION_LICENSE;type=class
java.lang.String;uuid=EXTENSION_LICENSE[8a61ad65-054c-4e31-9c6d-1ca4d60a4c18];]=ASL
2.0, Extkey[name=EXTENSION_NOTES;type=class
java.lang.String;uuid=EXTENSION_NOTES[2da5ad7e-185a-4584-aaff-97f66978e4ea];]=Display
name: ovirt-engine-extension-aaa-ldap-1.0.0-1.el6,
Extkey[name=EXTENSION_HOME_URL;type=class
java.lang.String;uuid=EXTENSION_HOME_URL[4ad7a2f4-f969-42d4-b399-72d192e18304];]=http://www.ovirt.org,Extkey[name=EXTENSION_LOCALE;type=class
java.lang.String;uuid=EXTENSION_LOCALE[0780b112-0ce0-404a-b85e-8765d778bb29];]=en_US,
Extkey[name=EXTENSION_NAME;type=class
java.lang.String;uuid=EXTENSION_NAME[651381d3-f54f-4547-bf28-b0b01a103184];]=ovirt-engine-extension-aaa-ldap.authn,
Extkey[name=EXTENSION_INTERFACE_VERSION_MIN;type=class
java.lang.Integer;uuid=EXTENSION_INTERFACE_VERSION_MIN[2b84fc91-305b-497b-a1d7-d961b9d2ce0b];]=0,
Extkey[name=EXTENSION_CONFIGURATION;type=class
java.util.Properties;uuid=EXTENSION_CONFIGURATION[2d48ab72-f0a1-4312-b4ae-5068a226b0fc];]=***,
Extkey[name=EXTENSION_AUTHOR;type=class
java.lang.String;uuid=EXTENSION_AUTHOR[ef242f7a-2dad-4bc5-9aad-e07018b7fbcc];]=The
oVirt Project, Extkey[name=EXTENSION_INSTANCE_NAME;type=class
java.lang.String;uuid=EXTENSION_INSTANCE_NAME[65c67ff6-aeca-4bd5-a245-8674327f011b];]=authn-ldap.example.org
<http://authn-ldap.example.org>,
Extkey[name=EXTENSION_BUILD_INTERFACE_VERSION;type=class
java.lang.Integer;uuid=EXTENSION_BUILD_INTERFACE_VERSION[cb479e5a-4b23-46f8-aed3-56a4747a8ab7];]=0,
Extkey[name=EXTENSION_CONFIGURATION_SENSITIVE_KEYS;type=interface
java.util.Collection;uuid=EXTENSION_CONFIGURATION_SENSITIVE_KEYS[a456efa1-73ff-4204-9f9b-ebff01e35263];]=[],
Extkey[name=AAA_AUTHN_CAPABILITIES;type=class
java.lang.Long;uuid=AAA_AUTHN_CAPABILITIES[9d16bee3-10fd-46f2-83f9-3d3c54cf258d];]=12,
Extkey[name=EXTENSION_GLOBAL_CONTEXT;type=class
org.ovirt.engine.api.extensions.ExtMap;uuid=EXTENSION_GLOBAL_CONTEXT[9799e72f-7af6-4cf1-bf08-297bc8903676];]=*skip*,
Extkey[name=EXTENSION_VERSION;type=class
java.lang.String;uuid=EXTENSION_VERSION[fe35f6a8-8239-4bdb-ab1a-af9f779ce68c];]=1.0.0,
Extkey[name=EXTENSION_MANAGER_TRACE_LOG;type=interface
org.slf4j.Logger;uuid=EXTENSION_MANAGER_TRACE_LOG[863db666-3ea7-4751-9695-918a3197ad83];]=org.slf4j.impl.Slf4jLogger(org.ovirt.engine.core.extensions.mgr.ExtensionsManager.trace.ovirt-engine-extension-aaa-ldap.authn.authn-ldap.example.org
<http://org.ovirt.engine.core.extensions.mgr.ExtensionsManager.trace.ovirt-engine-extension-aaa-ldap.authn.authn-ldap.example.org>),
Extkey[name=EXTENSION_PROVIDES;type=interface
java.util.Collection;uuid=EXTENSION_PROVIDES[8cf373a6-65b5-4594-b828-0e275087de91];]=[org.ovirt.engine.api.extensions.aaa.Authn]},
Extkey[name=AAA_AUTHN_USER;type=class
java.lang.String;uuid=AAA_AUTHN_USER[1ceaba26-1bdc-4663-a3c6-5d926f9dd8f0];]=bruno,
Extkey[name=EXTENSION_INVOKE_COMMAND;type=class
org.ovirt.engine.api.extensions.ExtUUID;uuid=EXTENSION_INVOKE_COMMAND[485778ab-bede-4f1a-b823-77b262a2f28d];]=AAA_AUTHN_AUTHENTICATE_CREDENTIALS[d9605c75-6b43-4b00-b32c-06bdfa80244c]}
  Output:
  {Extkey[name=EXTENSION_INVOKE_RESULT;type=class
java.lang.Integer;uuid=EXTENSION_INVOKE_RESULT[0909d91d-8bde-40fb-b6c0-099c772ddd4e];]=2,
Extkey[name=EXTENSION_INVOKE_MESSAGE;type=class
java.lang.String;uuid=EXTENSION_INVOKE_MESSAGE[b7b053de-dc73-4bf7-9d26-b8bdb72f5893];]=anonymous
bind disallowed}

-----------------------------------

And this is the ldap connection log:

/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 fd=114
ACCEPT from IP=192.168.XX.XX:41469 (IP=0.0.0.0:389 <http://0.0.0.0:389>)
/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=0
EXT oid=1.3.6.1.4.1.1466.20037
/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=0
STARTTLS
/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=0
RESULT oid= err=0 text=
/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 fd=114
TLS established tls_ssf=128 ssf=128
/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=1
BIND dn="cn=authenticate,ou=System,dc=example,dc=org" method=128
/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=1
BIND dn="cn=authenticate,ou=System,dc=example,dc=org" mech=SIMPLE ssf=0
/var/log/ldap.log:Jan 15 10:04:15 ldap1 slapd[6712]: conn=1671350 op=1
RESULT tag=97 err=0 text=

-----------------------------------

It looks like it got the dn correctly but it's unable to bind anyway ...

Thank you,

Bruno


On Wed, Jan 14, 2015 at 5:50 PM, Ondra Machacek <omach...@redhat.com
<mailto:omach...@redhat.com>> wrote:

    Hi,

    On 01/14/2015 04:53 PM, Bruno Rodriguez wrote:

        Good afternoon,

        We cannot access to Ovirt using LDAP authentication against our
        openldap
        server. We created the following files in
        /etc/ovirt-engine/extensions.d
        (the organization name is not example.org <http://example.org>
        <http://example.org> and the
        passwords are not XXXXXXXX, obviously) :

        ----------- /etc/ovirt-engine/extensions.__d/ldap.example.org
        <http://ldap.example.org>
        <http://ldap.example.org> -----------

        include = <openldap_example.properties>

        vars.server = ldap1.example.org <http://ldap1.example.org>
        <http://ldap1.example.org>
        vars.user = cn=authenticate,ou=System,dc=__example,dc=org
        vars.password = "XXXXXXXX"

        pool.default.serverset.single.__server = ${global:vars.server}
        pool.default.auth.simple.__bindDN = ${global:vars.user}
        pool.default.auth.simple.__password = ${global:vars.password}

        pool.default.ssl.startTLS = true
        pool.default.ssl.truststore.__file =
        /etc/ovirt-engine/extensions.__d/ldap.example.org_keystore.__jks
        pool.default.ssl.truststore.__password = XXXXXXXX

        -----------
        /etc/ovirt-engine/extensions.__d/authn-ldap.example.org
        <http://authn-ldap.example.org>.__properties -----------

        ovirt.engine.extension.name <http://ovirt.engine.extension.name>
        <http://ovirt.engine.__extension.name
        <http://ovirt.engine.extension.name>> =
        authn-ldap.example.org <http://authn-ldap.example.org>
        <http://authn-ldap.example.org__>
        ovirt.engine.extension.__bindings.method = jbossmodule
        ovirt.engine.extension.__binding.jbossmodule.module =
        org.ovirt.engine-extensions.__aaa.ldap
        ovirt.engine.extension.__binding.jbossmodule.class =
        org.ovirt.engineextensions.__aaa.ldap.AuthnExtension
        ovirt.engine.extension.__provides =
        org.ovirt.engine.api.__extensions.aaa.Authn

        ovirt.engine.aaa.authn.__profile.name
        <http://ovirt.engine.aaa.authn.profile.name>
        <http://ovirt.engine.aaa.__authn.profile.name
        <http://ovirt.engine.aaa.authn.profile.name>> = ldap.example.org
        <http://ldap.example.org>
        <http://ldap.example.org>
        ovirt.engine.aaa.authn.authz.__plugin = authz-ldap.example.org
        <http://authz-ldap.example.org>
        <http://authz-ldap.example.org__>

        config.profile.file.1 =
        /etc/ovirt-engine/extensions.__d/ldap.example.org
        <http://ldap.example.org>
        <http://ldap.example.org>

        -----------
        /etc/ovirt-engine/extensions.__d/authz-ldap.example.org
        <http://authz-ldap.example.org>.__properties -----------

        ovirt.engine.extension.name <http://ovirt.engine.extension.name>
        <http://ovirt.engine.__extension.name
        <http://ovirt.engine.extension.name>> =
        authz-ldap.example.org <http://authz-ldap.example.org>
        <http://authz-ldap.example.org__>
        ovirt.engine.extension.__bindings.method = jbossmodule
        ovirt.engine.extension.__binding.jbossmodule.module =
        org.ovirt.engine-extensions.__aaa.ldap
        ovirt.engine.extension.__binding.jbossmodule.class =
        org.ovirt.engineextensions.__aaa.ldap.AuthzExtension

        ovirt.engine.extension.__provides =
        org.ovirt.engine.api.__extensions.aaa.Authz
        config.profile.file.1 =
        /etc/ovirt-engine/extensions.__d/ldap.example.org
        <http://ldap.example.org>
        <http://ldap.example.org>

        ------------------------------__------------------

        After all of this we restarted the service and tried to access
        via the
        administration portal. The JKS has the right permissions and
        contains
        the TLS CA, the password is correct and the user "esthera"
        exists. But
        when we try to log in, we obtain the following error in the
        engine.log
        (we already set the verbosity to ALL):

        ------------------------------__------------------

        2015-01-14 16:35:25,750 ERROR
        [org.ovirt.engine.core.bll.__aaa.LoginAdminUserCommand]
        (ajp--127.0.0.1-8702-6) Error during CanDoActionFailure.: Class:
        class
        
org.ovirt.engine.core.__extensions.mgr.__ExtensionInvokeCommandFailedEx__ception
        Input:
        {Extkey[name=AAA_AUTHN___CREDENTIALS;type=class
        
java.lang.String;uuid=AAA___AUTHN_CREDENTIALS[03b96485-__4bb5-4592-8167-810a5c909706];]__=***,
        Extkey[name=EXTENSION_INVOKE___CONTEXT;type=class
        
org.ovirt.engine.api.__extensions.ExtMap;uuid=__EXTENSION_INVOKE_CONTEXT[__886d2ebb-312a-49ae-9cc3-__e1f849834b7d];]={Extkey[name=__EXTENSION_INTERFACE_VERSION___MAX;type=class
        
java.lang.Integer;uuid=__EXTENSION_INTERFACE_VERSION___MAX[f4cff49f-2717-4901-8ee9-__df362446e3e7];]=0,
        Extkey[name=EXTENSION_LICENSE;__type=class
        
java.lang.String;uuid=__EXTENSION_LICENSE[8a61ad65-__054c-4e31-9c6d-1ca4d60a4c18];]__=ASL
        2.0, Extkey[name=EXTENSION_NOTES;__type=class
        
java.lang.String;uuid=__EXTENSION_NOTES[2da5ad7e-185a-__4584-aaff-97f66978e4ea];]=__Display
        name: ovirt-engine-extension-aaa-__ldap-1.0.0-1.el6,
        Extkey[name=EXTENSION_HOME___URL;type=class
        
java.lang.String;uuid=__EXTENSION_HOME_URL[4ad7a2f4-__f969-42d4-b399-72d192e18304];]__=http://www.ovirt.org
        <http://www.ovirt.org/>, Extkey[name=EXTENSION_LOCALE;__type=class
        
java.lang.String;uuid=__EXTENSION_LOCALE[0780b112-__0ce0-404a-b85e-8765d778bb29];]__=en_US,
        Extkey[name=EXTENSION_NAME;__type=class
        
java.lang.String;uuid=__EXTENSION_NAME[651381d3-f54f-__4547-bf28-b0b01a103184];]=__ovirt-engine-extension-aaa-__ldap.authn,
        Extkey[name=EXTENSION___INTERFACE_VERSION_MIN;type=__class
        
java.lang.Integer;uuid=__EXTENSION_INTERFACE_VERSION___MIN[2b84fc91-305b-497b-a1d7-__d961b9d2ce0b];]=0,
        Extkey[name=EXTENSION___CONFIGURATION;type=class
        
java.util.Properties;uuid=__EXTENSION_CONFIGURATION[__2d48ab72-f0a1-4312-b4ae-__5068a226b0fc];]=***,
        Extkey[name=EXTENSION_AUTHOR;__type=class
        
java.lang.String;uuid=__EXTENSION_AUTHOR[ef242f7a-__2dad-4bc5-9aad-e07018b7fbcc];]__=The
        oVirt Project, Extkey[name=EXTENSION___INSTANCE_NAME;type=class
        
java.lang.String;uuid=__EXTENSION_INSTANCE_NAME[__65c67ff6-aeca-4bd5-a245-__8674327f011b];]=authn-ldap.
        <http://authn-ldap.pic.es/>exa__mple.org <http://example.org>
        <http://example.org>,
        Extkey[name=EXTENSION_BUILD___INTERFACE_VERSION;type=class
        
java.lang.Integer;uuid=__EXTENSION_BUILD_INTERFACE___VERSION[cb479e5a-4b23-46f8-__aed3-56a4747a8ab7];]=0,
        Extkey[name=EXTENSION___CONFIGURATION_SENSITIVE_KEYS;__type=interface
        
java.util.Collection;uuid=__EXTENSION_CONFIGURATION___SENSITIVE_KEYS[a456efa1-73ff-__4204-9f9b-ebff01e35263];]=[],
        Extkey[name=AAA_AUTHN___CAPABILITIES;type=class
        
java.lang.Long;uuid=AAA_AUTHN___CAPABILITIES[9d16bee3-10fd-__46f2-83f9-3d3c54cf258d];]=12,
        Extkey[name=EXTENSION_GLOBAL___CONTEXT;type=class
        
org.ovirt.engine.api.__extensions.ExtMap;uuid=__EXTENSION_GLOBAL_CONTEXT[__9799e72f-7af6-4cf1-bf08-__297bc8903676];]=*skip*,
        Extkey[name=EXTENSION_VERSION;__type=class
        
java.lang.String;uuid=__EXTENSION_VERSION[fe35f6a8-__8239-4bdb-ab1a-af9f779ce68c];]__=1.0.0,
        Extkey[name=EXTENSION_MANAGER___TRACE_LOG;type=interface
        
org.slf4j.Logger;uuid=__EXTENSION_MANAGER_TRACE_LOG[__863db666-3ea7-4751-9695-__918a3197ad83];]=org.slf4j.__impl.Slf4jLogger(org.ovirt.__engine.core.extensions.mgr.__ExtensionsManager.trace.ovirt-__engine-extension-aaa-ldap.__authn.authn-ldap.
        
<http://org.ovirt.engine.core.__extensions.mgr.__extensionsmanager.trace.ovirt-__engine-extension-aaa-ldap.__authn.authn-ldap.pic.es/
        
<http://org.ovirt.engine.core.extensions.mgr.extensionsmanager.trace.ovirt-engine-extension-aaa-ldap.authn.authn-ldap.pic.es/>>examp__le.org
        <http://example.org>
        <http://example.org>),
        Extkey[name=EXTENSION___PROVIDES;type=interface
        
java.util.Collection;uuid=__EXTENSION_PROVIDES[8cf373a6-__65b5-4594-b828-0e275087de91];]__=[org.ovirt.engine.api.__extensions.aaa.Authn]},
        Extkey[name=AAA_AUTHN_USER;__type=class
        
java.lang.String;uuid=AAA___AUTHN_USER[1ceaba26-1bdc-4663-__a3c6-5d926f9dd8f0];]=esthera,
        Extkey[name=EXTENSION_INVOKE___COMMAND;type=class
        
org.ovirt.engine.api.__extensions.ExtUUID;uuid=__EXTENSION_INVOKE_COMMAND[__485778ab-bede-4f1a-b823-__77b262a2f28d];]=AAA_AUTHN___AUTHENTICATE_CREDENTIALS[__d9605c75-6b43-4b00-b32c-__06bdfa80244c]}
        Output:
        {Extkey[name=EXTENSION_INVOKE___RESULT;type=class
        
java.lang.Integer;uuid=__EXTENSION_INVOKE_RESULT[__0909d91d-8bde-40fb-b6c0-__099c772ddd4e];]=2,
        Extkey[name=EXTENSION_INVOKE___MESSAGE;type=class
        
java.lang.String;uuid=__EXTENSION_INVOKE_MESSAGE[__b7b053de-dc73-4bf7-9d26-__b8bdb72f5893];]=invalid
        credentials}

        ------------------------------__------------------

        Having a look at the LDAP log we check that there is a "invalid
        credentials" error while binding, but we are sure that the bind
        password
        is the right one. We already tried to set the bind password without
        quotes, but then the DN user then appear as an empty string ("")


    I think problem is here. That's really strange, you have to use the
    password without quotes.

    Can you please try to set:
    pool.default.auth.simple.__bindDN =
    cn=authenticate,ou=System,dc=__example,dc=org
    pool.default.auth.simple.__password = XXXXXX

    just without the variables. if the DN is not empty now.


        ------------------------------__------------------

        [root@ldap1 ~]# grep $(grep 192.168.XX.X /var/log/ldap.log |
        tail -n 1 |
        cut -d: -f4 | cut -d\  -f2) /var/log/ldap.log
        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 ACCEPT from
        IP=192.168.XX.X:39501 <http://192.168.95.2:39501/>
        (IP=0.0.0.0:389 <http://0.0.0.0:389>
        <http://0.0.0.0:389/>)

        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 EXT
        oid=1.3.6.1.4.1.1466.20037
        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 STARTTLS
        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=0 RESULT oid=
        err=0 text=
        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 TLS
        established
        tls_ssf=128 ssf=128
        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=1 BIND
        dn="cn=authenticate,ou=System,__dc=example,dc=org" method=128
        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=1 RESULT tag=97
        err=49 text=
        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 op=2 UNBIND
        Jan 14 16:35:25 ldap1 slapd[6712]: conn=1591408 fd=63 closed

        ------------------------------__------------------

        By the way, the Ovirt manager (ovmgr) machine can query
        correctly the
        openldap server and retrieves everything OK

        ------------------------------__------------------

        [root@ovmgr extensions.d]# ldapsearch -ZZ -D
        cn=authenticate,ou=System,dc=__example,dc=org -W
        Enter LDAP Password:
        # extended LDIF
        #
        # LDAPv3
        # base <dc=example,dc=org> (default) with scope subtree
        # filter: (objectclass=*)
        # requesting: ALL
        #

        # pic.es <http://pic.es> <http://pic.es/>
        dn: dc=example,dc=org
        dc: pic
        objectClass: top
        objectClass: domain

        ------------------------------__------------------

        Did anybody had a similar problem ? Is there anything that we
        didn't check ?

        Thanks in advance !

        --
        Bruno Rodríguez Rodríguez



        This body part will be downloaded on demand.




--
Bruno Rodríguez Rodríguez

PIC (Port d'Informació Científica)
Campus UAB, Edificio D
E-08193 Bellaterra, Barcelona
Tel: +34 93 581 33 22

"Si algo me ha enseñado el tetris, es que los errores se acumulan y los
triunfos desaparecen"

_______________________________________________
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users

Reply via email to