----- Original Message -----
> From: "Sharad Mishra" <snmis...@linux.vnet.ibm.com>
> To: "Itamar Heim" <ih...@redhat.com>
> Cc: "Oved Ourfalli" <ov...@redhat.com>, users@ovirt.org
> Sent: Wednesday, April 11, 2012 4:53:37 PM
> Subject: Re: [Users] Testing LDAP support.
>
> On Tue, 2012-04-10 at 10:55 +0300, Itamar Heim wrote:
> > On 04/10/2012 04:51 AM, Sharad Mishra wrote:
> > > On Mon, 2012-04-09 at 12:38 -0700, Sharad Mishra wrote:
> > >> On Mon, 2012-04-09 at 14:10 -0400, Oved Ourfalli wrote:
> > >>>>>
> > >>>>> When a call is made to construct InitialDirContext with
> > >>>>> following
> > >>>>> settings -
> > >>>>>
> > >>>>> {java.naming.provider.url=ldap://ldapserver.ibm.com:389,
> > >>>>> java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory,
> > >>>>> java.naming.security.principal=uid=1234567,c=us,ou=ldapserver,o=ibm.com,
> > >>>>> java.naming.security.authentication=DIGEST-MD5 GSSAPI,
> > >>>>> java.naming.security.credentials=password,
> > >>>>> java.naming.referral=follow,
> > >>>>> java.naming.ldap.attributes.binary=objectGUID}
> > >>>>>
> > >>>
>
> How do I configure the ovirt test setup on my workstation to use LDAP
> for authentication? I looked around webadmin GUI but could not find
> it.
>
> -Sharad
>
If you are working with an installed oVirt environment, you can use
engine-manage-domains utility in order to add/remove/edit domains.
It will create the krb5.conf file, update database entries, add permissions for
the user you use, and etc.
If, however, you are in a development environment, then currently it is not
easy to run this utility, as it requires some configuration files and jars that
are there when you install the engine, but not there in a development
environment.
So, in that case you'll need to run the following (change the domain name, user
name and user guid):
update vdc_options set option_value = '<your domain>' where option_name =
'DomainName';
update vdc_options set option_value = '<your domain>:<your user>@<your domain>'
where option_name= 'AdUserName';
update vdc_options set option_value = '<your domain>:<user guid>' where
option_name='AdUserId';
update vdc_options set option_value = '<your domain>:<your password>' where
option_name='AdUserPassword';
insert into permissions
(id,role_id,ad_element_id,object_id,object_type_id) values
('<choose a random guid>','00000000-0000-0000-0000-000000000001','<user
guid>','aaa00000-0000-0000-0000-123456789aaa',1);
Also, you'll have to create a krb5.conf file, and place it in
$JBOSS_HOME/standalone/configuration
An example for the contents of this file:
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = no
default_tkt_enctypes = arcfour-hmac-md5
udp_preference_limit = 1
[realms]
EXAMPLE.COM = {
kdc = my_host.example.com.:88
}
[domain_realm]
example.com = EXAMPLE.COM
Note that you need to have the following records for your LDAP server, defined
in the DNS:
* LDAP SRV record
* Kerberos SRV record
* PTR record
(You can use "dnsmasq" if you wish to create those records by yourself - if you
need help with this let me know).
Oved
> > >>> Can you also attach the jboss log and engine log? (assuming you
> > >>> are testing it in the ovirt-engine environment).
> > >>> They can be helpful, as it might be related to some class
> > >>> loading issue or something similar, and the log might shed
> > >>> light on that.
> > >>>
> > >>
> > > I think its my setup that is the issue here. I am unable to run
> > > ldapsearch CLI with DIGEST-MD5 protocol. I am not sure how to
> > > setup/use
> > > secret key with sasl. I am running my queries against a
> > > production ldap
> > > server on which I have user access. I tried to look around on
> > > internet
> > > but did not get a good hit.
> >
> > have you tried the kebreros based authentication with it?
> > I see it is supposed to have it:
> > http://publib.boulder.ibm.com/infocenter/lnxinfo/v3r0m0/index.jsp?topic=%2Fliaai%2Fkerberos%2Fliaaikerberos1.htm
> >
>
>
>
_______________________________________________
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
