Trying to configure LDAP auth on engine. After adding user from LDAP i cannot
login with this error "server_error: Cannot locate principal"
Errors from engine.log
2021-06-30 17:24:23,830+05 ERROR
[org.ovirt.engine.core.sso.servlets.InteractiveAuthServlet] (default task-5)
[686f77b] Internal Server Error: Cannot locate principal 'Domain Reader'
2021-06-30 17:24:23,830+05 ERROR [org.ovirt.engine.core.sso.utils.SsoUtils]
(default task-5) [686f77b] Cannot locate principal 'Domain Reader'
2021-06-30 17:24:23,851+05 ERROR
[org.ovirt.engine.core.aaa.servlet.SsoPostLoginServlet] (default task-5)
[686f77b] server_error: Cannot locate principal 'Domain Reader'
How i can fix this error?
ovirt 4.3.10
Config /etc/ovirt-engine/aaa/openldap_rfc.properties:
include = <rfc2307-openldap.properties>
vars.server = LDAP.testdom.local
vars.user = CN=Domain Reader,OU=AD,OU=SERVICE,DC=testdom,DC=local
vars.password = password
pool.default.auth.simple.bindDN = ${global:vars.user}
pool.default.auth.simple.password = ${global:vars.password}
pool.default.serverset.type = single
pool.default.serverset.single.server = ${global:vars.server}
pool.default.ssl.startTLS = tlocale
pool.default.ssl.insecure = tlocale
attrmap.map-principal-record.attr.PrincipalRecord_ID.map = uid
attrmap.map-principal-record.attr.PrincipalRecord_PRINCIPAL.map = cn
#LDAP value changes
sequence.openldap-init-vars.030.var-set.value = entryUUID, uid, cn, givenName,
sn, Email
sequence.openldap-init-vars.040.var-set.value =
(objectClass=posixAccount)(uid=*)
sequence.openldap-init-vars.050.var-set.value = entryUUID, uid
sequence.openldap-init-vars.060.var-set.value = (objectClass=posixGroup)
sequence.openldap-init-vars.070.var-set.value = membelocalid
User attribures:
ovirt-engine-extensions-tool aaa search --extension-name=openldap_rfc-authz
--entity=principal --entity-name=domreader
2021-07-21 17:14:33,805+05 INFO
========================================================================
2021-07-21 17:14:33,833+05 INFO ============================ Initialization
============================
2021-07-21 17:14:33,833+05 INFO
========================================================================
2021-07-21 17:14:33,878+05 INFO Loading extension 'internal-authz'
2021-07-21 17:14:33,885+05 INFO Extension 'internal-authz' loaded
------
2021-07-21 17:14:35,885+05 INFO
========================================================================
2021-07-21 17:14:35,886+05 INFO ============================== Execution
===============================
2021-07-21 17:14:35,886+05 INFO
========================================================================
2021-07-21 17:14:35,886+05 INFO Iteration: 0
2021-07-21 17:14:35,891+05 INFO --- Begin QueryFilterRecord ---
2021-07-21 17:14:35,892+05 INFO AAA_AUTHZ_QUERY_FILTER_OPERATOR: 102
2021-07-21 17:14:35,892+05 INFO AAA_AUTHZ_QUERY_ENTITY:
AAA_AUTHZ_QUERY_ENTITY_PRINCIPAL[1695cd36-4656-474f-b7bc-4466e12634e4]
2021-07-21 17:14:35,893+05 INFO --- Begin QueryFilterRecord ---
2021-07-21 17:14:35,893+05 INFO AAA_AUTHZ_QUERY_FILTER_OPERATOR: 0
2021-07-21 17:14:35,894+05 INFO AAA_AUTHZ_QUERY_FILTER_KEY:
Extkey[name=AAA_AUTHZ_PRINCIPAL_NAME;type=class
java.lang.String;uuid=AAA_AUTHZ_PRINCIPAL_NAME[a0df5bcc-6ead-40a2-8565-2f5cc8773bdd];]
2021-07-21 17:14:35,894+05 INFO AAA_AUTHZ_PRINCIPAL_NAME: domreader
2021-07-21 17:14:35,894+05 INFO --- End QueryFilterRecord ---
2021-07-21 17:14:35,895+05 INFO --- End QueryFilterRecord ---
2021-07-21 17:14:35,895+05 INFO API: -->Authz.InvokeCommands.QUERY_OPEN
namespace='dc=testdom,dc=local'
2021-07-21 17:14:35,904+05 INFO API: <--Authz.InvokeCommands.QUERY_OPEN
2021-07-21 17:14:35,904+05 INFO API: -->Authz.InvokeCommands.QUERY_EXECUTE
2021-07-21 17:16:04,079+05 INFO API: <--Authz.InvokeCommands.QUERY_EXECUTE
count=1
2021-07-21 17:16:04,080+05 INFO --- Begin PrincipalRecord ---
2021-07-21 17:16:04,081+05 INFO AAA_AUTHZ_PRINCIPAL_PRINCIPAL: Domain Reader
2021-07-21 17:16:04,081+05 INFO AAA_AUTHZ_PRINCIPAL_LAST_NAME: Reader
2021-07-21 17:16:04,081+05 INFO AAA_LDAP_UNBOUNDID_DN: cn=Domain
Reader,ou=AD,ou=SERVICE,dc=testdom,dc=local
2021-07-21 17:16:04,082+05 INFO AAA_AUTHZ_PRINCIPAL_NAMESPACE:
dc=testdom,dc=local
2021-07-21 17:16:04,082+05 INFO AAA_AUTHZ_PRINCIPAL_ID: domreader
2021-07-21 17:16:04,082+05 INFO AAA_AUTHZ_PRINCIPAL_DISPLAY_NAME: Domain
Reader
2021-07-21 17:16:04,083+05 INFO AAA_AUTHZ_PRINCIPAL_NAME: domreader
2021-07-21 17:16:04,083+05 INFO AAA_AUTHZ_PRINCIPAL_FIRST_NAME: Domain
2021-07-21 17:16:04,083+05 INFO --- End PrincipalRecord ---
2021-07-21 17:16:04,084+05 INFO API: -->Authz.InvokeCommands.QUERY_EXECUTE
2021-07-21 17:16:04,084+05 INFO API: <--Authz.InvokeCommands.QUERY_EXECUTE
count=END
2021-07-21 17:16:04,084+05 INFO API: -->Authz.InvokeCommands.QUERY_CLOSE
2021-07-21 17:16:04,084+05 INFO API: <--Authz.InvokeCommands.QUERY_CLOSE
Trying to auth using ovirt-engine-extensions-tool:
ovirt-engine-extensions-tool aaa login-user --profile=openldap_rfc
--user-name=domreader
2021-07-21 17:40:47,318+05 INFO
========================================================================
2021-07-21 17:40:47,350+05 INFO ============================ Initialization
============================
2021-07-21 17:40:47,351+05 INFO
========================================================================
2021-07-21 17:40:47,401+05 INFO Loading extension 'internal-authz'
2021-07-21 17:40:47,407+05 INFO Extension 'internal-authz' loaded
2021-07-21 17:40:47,409+05 INFO Loading extension 'internal-authn'
2021-07-21 17:40:47,410+05 INFO Extension 'internal-authn' loaded
2021-07-21 17:40:47,426+05 INFO Loading extension 'test_ldap'
2021-07-21 17:40:47,508+05 INFO Extension 'test_ldap' loaded
2021-07-21 17:40:47,509+05 INFO Loading extension 'test_ldap-authn'
2021-07-21 17:40:47,523+05 INFO Extension 'test_ldap-authn' loaded
2021-07-21 17:40:47,525+05 INFO Loading extension 'openldap_rfc-authz'
2021-07-21 17:40:47,538+05 INFO Extension 'openldap_rfc-authz' loaded
2021-07-21 17:40:47,540+05 INFO Loading extension 'openldap_rfc-authn'
2021-07-21 17:40:47,551+05 INFO Extension 'openldap_rfc-authn' loaded
2021-07-21 17:40:47,552+05 INFO Initializing extension 'internal-authz'
2021-07-21 17:40:47,671+05 INFO Extension 'internal-authz' initialized
2021-07-21 17:40:47,672+05 INFO Initializing extension 'internal-authn'
2021-07-21 17:40:47,685+05 INFO Extension 'internal-authn' initialized
2021-07-21 17:40:47,685+05 INFO Initializing extension 'test_ldap'
2021-07-21 17:40:47,686+05 INFO
[ovirt-engine-extension-aaa-ldap.authz::test_ldap] Creating LDAP pool 'authz'
2021-07-21 17:40:47,787+05 INFO
[ovirt-engine-extension-aaa-ldap.authz::test_ldap] LDAP pool 'authz'
information: vendor='null' version='null'
2021-07-21 17:40:47,788+05 INFO
[ovirt-engine-extension-aaa-ldap.authz::test_ldap] Available Namespaces:
[dc=field,dc=example,dc=com]
2021-07-21 17:40:47,789+05 INFO Extension 'test_ldap' initialized
2021-07-21 17:40:47,789+05 INFO Initializing extension 'test_ldap-authn'
2021-07-21 17:40:47,790+05 INFO
[ovirt-engine-extension-aaa-ldap.authn::test_ldap-authn] Creating LDAP pool
'authz'
2021-07-21 17:40:47,837+05 INFO
[ovirt-engine-extension-aaa-ldap.authn::test_ldap-authn] LDAP pool 'authz'
information: vendor='null' version='null'
2021-07-21 17:40:47,838+05 INFO
[ovirt-engine-extension-aaa-ldap.authn::test_ldap-authn] Creating LDAP pool
'authn'
2021-07-21 17:40:47,849+05 INFO
[ovirt-engine-extension-aaa-ldap.authn::test_ldap-authn] LDAP pool 'authn'
information: vendor='null' version='null'
2021-07-21 17:40:47,849+05 INFO Extension 'test_ldap-authn' initialized
2021-07-21 17:40:47,850+05 INFO Initializing extension 'openldap_rfc-authz'
2021-07-21 17:40:47,850+05 INFO
[ovirt-engine-extension-aaa-ldap.authz::openldap_rfc-authz] Creating LDAP pool
'authz'
2021-07-21 17:40:47,851+05 WARNING
[ovirt-engine-extension-aaa-ldap.authz::openldap_rfc-authz] TLS/SSL insecure
mode
2021-07-21 17:40:48,575+05 INFO
[ovirt-engine-extension-aaa-ldap.authz::openldap_rfc-authz] LDAP pool 'authz'
information: vendor='null' version='null'
2021-07-21 17:40:48,576+05 INFO
[ovirt-engine-extension-aaa-ldap.authz::openldap_rfc-authz] Available
Namespaces: [dc=testdom,dc=local]
2021-07-21 17:40:48,576+05 INFO Extension 'openldap_rfc-authz' initialized
2021-07-21 17:40:48,576+05 INFO Initializing extension 'openldap_rfc-authn'
2021-07-21 17:40:48,577+05 INFO
[ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] Creating LDAP pool
'authz'
2021-07-21 17:40:48,577+05 WARNING
[ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] TLS/SSL insecure
mode
2021-07-21 17:40:49,174+05 INFO
[ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] LDAP pool 'authz'
information: vendor='null' version='null'
2021-07-21 17:40:49,175+05 INFO
[ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] Creating LDAP pool
'authn'
2021-07-21 17:40:49,175+05 WARNING
[ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] TLS/SSL insecure
mode
2021-07-21 17:40:49,427+05 INFO
[ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] LDAP pool 'authn'
information: vendor='null' version='null'
2021-07-21 17:40:49,428+05 INFO Extension 'openldap_rfc-authn' initialized
2021-07-21 17:40:49,428+05 INFO Start of enabled extensions list
2021-07-21 17:40:49,429+05 INFO Instance name: 'openldap_rfc-authz',
Extension name: 'ovirt-engine-extension-aaa-ldap.authz', Version: '1.3.10',
Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.10-1.el7', License:
'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build
interface Version: '0', File:
'/etc/ovirt-engine/extensions.d/openldap_rfc-authz.properties', Initialized:
'tlocale'
2021-07-21 17:40:49,429+05 INFO Instance name: 'test_ldap', Extension name:
'ovirt-engine-extension-aaa-ldap.authz', Version: '1.3.10', Notes: 'Display
name: ovirt-engine-extension-aaa-ldap-1.3.10-1.el7', License: 'ASL 2.0', Home:
'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version:
'0', File: '/etc/ovirt-engine/extensions.d/test_ldap.properties', Initialized:
'tlocale'
2021-07-21 17:40:49,429+05 INFO Instance name: 'internal-authn', Extension
name: '"ovirt-engine-extension-aaa-jdbc".authn', Version: '"1.1.10"', Notes:
'Display name: "ovirt-engine-extension-aaa-jdbc"', License: 'ASL 2.0', Home:
'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version:
'0', File: '/etc/ovirt-engine/extensions.d/internal-authn.properties',
Initialized: 'tlocale'
2021-07-21 17:40:49,430+05 INFO Instance name: 'internal-authz', Extension
name: '"ovirt-engine-extension-aaa-jdbc".authz', Version: '"1.1.10"', Notes:
'Display name: "ovirt-engine-extension-aaa-jdbc"', License: 'ASL 2.0', Home:
'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version:
'0', File: '/etc/ovirt-engine/extensions.d/internal-authz.properties',
Initialized: 'tlocale'
2021-07-21 17:40:49,430+05 INFO Instance name: 'openldap_rfc-authn',
Extension name: 'ovirt-engine-extension-aaa-ldap.authn', Version: '1.3.10',
Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.10-1.el7', License:
'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build
interface Version: '0', File:
'/etc/ovirt-engine/extensions.d/openldap_rfc-authn.properties', Initialized:
'tlocale'
2021-07-21 17:40:49,430+05 INFO Instance name: 'test_ldap-authn', Extension
name: 'ovirt-engine-extension-aaa-ldap.authn', Version: '1.3.10', Notes:
'Display name: ovirt-engine-extension-aaa-ldap-1.3.10-1.el7', License: 'ASL
2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface
Version: '0', File:
'/etc/ovirt-engine/extensions.d/test_ldap-authn.properties', Initialized:
'tlocale'
2021-07-21 17:40:49,430+05 INFO End of enabled extensions list
2021-07-21 17:40:49,431+05 INFO
========================================================================
2021-07-21 17:40:49,431+05 INFO ============================== Execution
===============================
2021-07-21 17:40:49,431+05 INFO
========================================================================
2021-07-21 17:40:49,432+05 INFO Iteration: 0
2021-07-21 17:40:49,433+05 INFO Profile='openldap_rfc'
authn='openldap_rfc-authn' authz='openldap_rfc-authz' mapping='null'
2021-07-21 17:40:49,433+05 INFO API:
-->Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='openldap_rfc'
user='domreader'
Password:
2021-07-21 17:42:28,572+05 INFO API:
<--Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='openldap_rfc'
result=SUCCESS
2021-07-21 17:42:28,576+05 INFO --- Begin AuthRecord ---
2021-07-21 17:42:28,577+05 INFO AAA_AUTHN_AUTH_RECORD_PRINCIPAL: Domain
Reader
2021-07-21 17:42:28,577+05 INFO --- End AuthRecord ---
2021-07-21 17:42:28,578+05 INFO API:
-->Authz.InvokeCommands.FETCH_PRINCIPAL_RECORD principal='Domain Reader'
2021-07-21 17:43:28,582+05 SEVERE Cannot locate principal 'Domain Reader'
LDAP server working as proxy to AD.
slapd.conf listnig:
### Schema includes ###########################################################
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/misc.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/ad.schema
## Module paths ##############################################################
modulepath /usr/lib64/openldap/
moduleload back_ldap
moduleload rwm
### Logging ###################################################################
logfile /var/log/slapd/slapd.log
loglevel 256
# Main settings ###############################################################
pidfile /var/run/openldap/slapd.pid
argsfile /var/run/openldap/slapd.args
TLSCipherSuite HIGH:!NULL
TLSCACertificateFile /etc/pki/tls/certs/cacert.pem
TLSCertificateFile /etc/pki/tls/certs/slapd.pem
TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem
TLSVerifyClient never
# Disallow non-encrypted binds - this will refuse any connection that isn't
# secured with at least 128-bit encryption
security ssf=128
# Allow v2 binding for legacy clients #########################################
allow bind_v2
### Database definition (Proxy to AD) #########################################
database ldap
readonly yes
protocol-version 3
rebind-as-user yes
uri "ldap://testdom.local:389";
suffix "dc=testdom,dc=local"
idassert-bind bindmethod=simple
mode=none
binddn="CN=Domain Reader,OU=AD,OU=SERVICE,DC=testdom,DC=local"
credentials=eOv5rgrNv3eq
starttls=yes
tls_cacertdir=/etc/pki/tls/certs
tls_reqcert=never
idassert-authzFrom "*"
overlay rwm
_______________________________________________
Users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Privacy Statement: https://www.ovirt.org/privacy-policy.html
oVirt Code of Conduct:
https://www.ovirt.org/community/about/community-guidelines/
List Archives:
https://lists.ovirt.org/archives/list/[email protected]/message/PQOUOLBI52SHM4BLXRLDULS2O3TCHJCM/
