Hello everybody,
We have installed a new OpenNebula infraestructure at the moment with one host Hypervisor machine, (64GB RAM, 400 GB HD, 48 cores) and the SunSotone machine.
We have configure /etc/one/auth/ldap_auth.conf as the documentation says.
After that we execute the following command line in the sunstone console:
oneuser login “ldap_user”
and we receive the message after introduce user password:
Password:
[one.user.login] User couldn’t be authenticated, aborting call.
frontend: debian 9.3
hypervisor: debian 9.3
Steps to reproduce:
oneuser login "ldap_user"
Password:
Current results:
[one.user.login] User couldn’t be authenticated, aborting call.
Expected results:
Correct login:
ldap_auth.conf:
server 1:
# Ldap user able to query, if not set connects as anonymous. For
# Active Directory append the domain name. Example:
# Administrator@my.domain.com
:user: 'user_to_make_ldap_queries"
:password: ‘password_user_to_,make_ldap_queries’
# Ldap authentication method
:auth_method: :simple
# Ldap server
:host: our_ldap_server_name
:port: 389
# Uncomment this line for tsl conections
# :encryption: :simple_tls
# base hierarchy where to search for users and groups
:base: 'our_base_tree_for_users'
# group the users need to belong to. If not set any user will do
#:group: 'cn=cloud,ou=groups,dc=domain'
# field that holds the user name, if not set 'cn' will be used
:user_field: 'uid'
# for Active Directory use this user_field instead
#:user_field: 'sAMAccountName'
# field name for group membership, by default it is 'member'
# :group_field: 'dn'
# user field that that is in in the group group_field, if not set 'dn' will be used
# :user_group_field: 'uid'
# Generate mapping file from group template info
:mapping_generate: false
# Seconds a mapping file remain untouched until the next regeneration
:mapping_timeout: 300
# Name of the mapping file in OpenNebula var diretory
:mapping_filename: server1.yaml
# Key from the OpenNebula template to map to an AD group
:mapping_key: GROUP_DN
# Default group ID used for users in an AD group not mapped
:mapping_default: 1
# use RFC2307bis for groups
# if false, depending on your LDAP server configuration,
# set user_field and user_group_field 'uid' and group_field 'memberUid'
:rfc2307bis: true
this example server wont be called as it is not in the :order list
server 2:
:auth_method: :simple
:host: localhost
:port: 389
:base: ‘dc=domain’
#:group: ‘cn=cloud,ou=groups,dc=domain’
:user_field: ‘cn’
List the order the servers are queried
:order:
- server 1
#- server 2
oned.log after oneuser command:
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 Command execution fail: /var/lib/one/remotes/auth/ldap/authenticate 1104562 - ****
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: Command execution fail: /var/lib/one/remotes/auth/ldap/authenticate 1104562 - ****
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 hola que ase
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: hola que ase
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 Trying server server 1
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: Trying server server 1
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 Server conf= {:user=>“user_to_query_ldap”, :password=>“password_user_to_query_ldap”, :auth_method=>:simple, :host=>“our_ldap_server_name”, :port=>389, :base=>“our_base_tree”, :user_field=>“uid”, :mapping_generate=>false, :mapping_timeout=>300, :mapping_filename=>“server1.yaml”, :mapping_key=>“GROUP_DN”, :mapping_default=>1, :rfc2307bis=>true}
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: Server conf= {:user=>“user_to_query_ldap”, :password=>“password_user_to_query_ldap”, :auth_method=>:simple, :host=>“our_ldap_server_name”, :port=>389, :base=>“our_base_tree”, :user_field=>“uid”, :mapping_generate=>false, :mapping_timeout=>300, :mapping_filename=>“server1.yaml”, :mapping_key=>“GROUP_DN”, :mapping_default=>1, :rfc2307bis=>true}
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 Usuari a cercar= 1104562
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: Usuari a cercar= 1104562
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 user_name =
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: user_name =
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 user_group_name =
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: user_group_name =
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 User 1104562 not found
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: User 1104562 not found
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 Could not authenticate user 1104562
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: Could not authenticate user 1104562
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: LOG I 793 ExitCode: 255
Wed Jan 17 16:28:59 2018 [Z0][AuM][I]: ExitCode: 255
Wed Jan 17 16:28:59 2018 [Z0][AuM][D]: Message received: AUTHENTICATE FAILURE 793 -
Wed Jan 17 16:28:59 2018 [Z0][AuM][E]: Auth Error:
Wed Jan 17 16:28:59 2018 [Z0][ReM][D]: Req:9728 UID:-1 one.user.login invoked , “1104562”, ****, 36000, -1
Wed Jan 17 16:28:59 2018 [Z0][ReM][E]: Req:9728 UID:- one.user.login result FAILURE [one.user.login] User couldn’t be authenticated, aborting call.
Wed Jan 17 16:29:10 2018 [Z0][InM][D]: Host on-host1 (3) successfully monitored.
Many thanks in advanced.