<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>Here is the repo made public with the first beta release for testing: <a href="https://github.com/Terradue/DotNet4One">https://github.com/Terradue/DotNet4One</a></div><div><br></div><div>Cheers,</div><br><div apple-content-edited="true">
<span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><font class="Apple-style-span" face="Calibri"><span class="Apple-style-span" style="font-family: Helvetica;"><font class="Apple-style-span" face="Calibri" size="3"><span class="Apple-style-span" style="font-size: 13px;">Emmanuel Mathot</span></font></span><span class="Apple-style-span" style="font-family: Helvetica;"><span class="Apple-style-span" style="font-family: Times;"><br></span></span><span class="Apple-style-span" style="font-family: Helvetica;"><span class="Apple-style-span" style="font-family: Times;"><a href="http://www.terradue.com/"><span style="font-family: Calibri; color: rgb(0, 58, 161); text-decoration: none;">www.terradue.com</span></a></span></span><span class="Apple-style-span" style="font-family: Helvetica;"><span class="Apple-style-span" style="font-family: Times;"><br></span></span><br></font></div><br class="Apple-interchange-newline"><span><img height="46" width="150" apple-inline="yes" id="1138C773-AA68-4490-AF7C-0FEEE3794D49" apple-width="yes" apple-height="yes" src="cid:B40837EC-A014-495C-9294-A8ED68D85EC9"></span>
</span></div>
</span></div><br><div><div>On 30 Jul 2014, at 12:48, Daniel Molina <<a href="mailto:dmolina@opennebula.org">dmolina@opennebula.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Sound good, thank you for the info Emmanuel. Looking forward to seeing the code</div><div class="gmail_extra"><br><br><div class="gmail_quote">On 30 July 2014 12:44, Emmanuel Mathot <span dir="ltr"><<a href="mailto:emmanuel.mathot@terradue.com" target="_blank">emmanuel.mathot@terradue.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>We are developing an API library for .Net framework. Soon available in OpenSource on Github.</div>
<div><br></div><div>Cheers,</div><br><div>
<span style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; border-spacing: 0px;"><div style="word-wrap:break-word">
<span style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; border-spacing: 0px;"><div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; word-wrap: break-word;">
<font face="Calibri"><span style="font-family:Helvetica"><font face="Calibri" size="3"><span style="font-size:13px">Emmanuel Mathot</span></font></span><span style="font-family:Helvetica"><span style="font-family:Times"><br>
</span></span><span style="font-family:Helvetica"><span style="font-family:Times"><a href="http://www.terradue.com/" target="_blank"><span style="font-family:Calibri;color:rgb(0,58,161);text-decoration:none">www.terradue.com</span></a></span></span><span style="font-family:Helvetica"><span style="font-family:Times"><br>
</span></span><br></font></div><br><span><span><PastedGraphic-1.tiff></span></span>
</span></div>
</span></div><div><div class="h5"><br><div><div>On 30 Jul 2014, at 12:37, Daniel Molina <<a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a>> wrote:</div><br><blockquote type="cite"><div dir="ltr">
Great!!. May I ask what kind of tool/integration are you building on top OpenNebula?<div><br></div><div>Cheers</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 30 July 2014 09:49, Cesare Rossi <span dir="ltr"><<a href="mailto:cesare.rossi@terradue.com" target="_blank">cesare.rossi@terradue.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word">Dear Daniel,<div><br></div><div>thank you for your support. We found that the problem was the encryption made on the client side. Now it works perfectly.</div>
<div><br></div><div>Thank you again</div><div><br></div><div>Cheers</div><div><br></div><div><div><br><div>
<div>Cesare Rossi</div><div>Terradue</div><div>Rome, Italy | Oxford, UK</div><div><a href="http://www.terradue.com/" target="_blank">http://www.terradue.com</a></div><div><br></div><br>
</div>
<br></div><div><div><div>On 29 Jul 2014, at 12:23, Daniel Molina <<a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a>> wrote:</div><br></div><blockquote type="cite"><div>
<div dir="ltr">Could you check the password you are using to encrypt (password+sha1) is the same that oned uses to decrypt (oneuser show) <div><br></div><div><div>[oneadmin@node1 ~]$ oneuser show serveradmin | grep PASS</div>
<div>PASSWORD : 3412...</div><div>[oneadmin@node1 ~]$ cat .one/sunstone_auth</div><div>serveradmin:7f9f...</div><div>[oneadmin@node1 ~]$ echo -n "7f9f..." | sha1sum</div><div>3412... -</div></div><div><br>
</div><div>Also the problem could be that the token is (base64) encoded after being encrypted:</div><div><a href="https://github.com/OpenNebula/one/blob/master/src/authm_mad/remotes/server_cipher/server_cipher_auth.rb#L90" target="_blank">https://github.com/OpenNebula/one/blob/master/src/authm_mad/remotes/server_cipher/server_cipher_auth.rb#L90</a><br>
</div><div><br></div><div>and before being decrypted it's decoded:</div><div><a href="https://github.com/OpenNebula/one/blob/master/src/authm_mad/remotes/server_cipher/server_cipher_auth.rb#L142" target="_blank">https://github.com/OpenNebula/one/blob/master/src/authm_mad/remotes/server_cipher/server_cipher_auth.rb#L142</a><br>
</div><div><br></div><div>Cheers</div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote"><div>On 29 July 2014 12:01, Emmanuel Mathot <span dir="ltr"><<a href="mailto:emmanuel.mathot@terradue.com" target="_blank">emmanuel.mathot@terradue.com</a>></span> wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>Here is the log output:<div><br></div><div><div>Mon Jul 28 16:37:48 2014 [AuM][D]: Message received: LOG I 5 Command execution fail: /var/lib/one/remotes/auth/server_cipher/authenticate serveradmin [secret] ****</div>
<div><br></div><div>Mon Jul 28 16:37:48 2014 [AuM][I]: Command execution fail: /var/lib/one/remotes/auth/server_cipher/authenticate serveradmin [secret] ****</div><div>Mon Jul 28 16:37:48 2014 [AuM][D]: Message received: LOG D 5 authenticate: Authenticating serveradmin, with password [secret] (4zj727qqns0xXEHWPBq4tJ2nRSyqom1KtWx5QBueF54I33c1y0fIuymmkn84TMP9)</div>
<div><br></div><div>Mon Jul 28 16:37:48 2014 [AuM][I]: authenticate: Authenticating serveradmin, with password [secret] (4zj727qqns0xXEHWPBq4tJ2nRSyqom1KtWx5QBueF54I33c1y0fIuymmkn84TMP9)</div><div>Mon Jul 28 16:37:48 2014 [AuM][D]: Message received: LOG E 5 bad decrypt</div>
<div><br></div><div>Mon Jul 28 16:37:48 2014 [AuM][I]: bad decrypt</div><div>Mon Jul 28 16:37:48 2014 [AuM][D]: Message received: LOG I 5 ExitCode: 255</div></div><div><br></div></div><div><br><div>
<span style="border-collapse:separate;border-spacing:0px"><div style="word-wrap:break-word"><span style="border-collapse:separate;font-family:Helvetica;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;border-spacing:0px"><div style="font-family:Helvetica;font-size:12px;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word">
<font face="Calibri"><span style="font-family:Helvetica"><font face="Calibri" size="3"><span style="font-size:13px">Emmanuel Mathot</span></font></span><span style="font-family:Helvetica"><span style="font-family:Times"><br>
</span></span><span style="font-family:Helvetica"><span style="font-family:Times"><a href="http://www.terradue.com/" target="_blank"><span style="font-family:Calibri;color:rgb(0,58,161);text-decoration:none">www.terradue.com</span></a></span></span><span style="font-family:Helvetica"><span style="font-family:Times"><br>
</span></span><br></font></div><br><span><span><PastedGraphic-1.tiff></span></span>
</span></div>
</span></div><div><br><div><div><div>On 29 Jul 2014, at 11:06, Daniel Molina <<a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a>> wrote:</div><br></div><blockquote type="cite">
<div dir="ltr">
<div>Hi Enguerran,<div><br></div><div>What error message are you getting in oned.log after trying to connect?</div><div><br></div><div>Cheers</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
<div>
On 28 July 2014 17:16, Enguerran Boissier <span dir="ltr"><<a href="mailto:enguerran.boissier@terradue.com" target="_blank">enguerran.boissier@terradue.com</a>></span> wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div>Hello Daniel,</div><div>Thanks for your answer, unfortunately we still don't manage to connect with a server_* user on the behalf of another normal user.</div>
<div>This is basically what we do, let us know if we do something wrong:</div><div><br></div><div>{ </div><div> string expires = DateTime.Now.Subtract(new DateTime(1970,1,1,0,0,0, DateTimeKind.Utc)).TotalSeconds + 3600 + "";</div>
<div> string token_encrypted = Encrypt(this.AdminUsername + ":" + this.TargetUsername + ":" + expires, this.AdminPassword);</div><div> //this.AdminUsername = server_* user name</div><div> //this.TargetUsername = normal user name (target user)</div>
<div> //this.AdminPassword = server_* user password (SHA1 encrypted)</div><div> //Encrypt do the equivalent of the AES 256 CBC openssl encryption (cf <a href="https://gist.github.com/scottlowe/1411917" target="_blank">https://gist.github.com/scottlowe/1411917</a>, we just removed the salt part)</div>
<div> session_SHA = this.AdminUsername + ":" + this.TargetUsername + ":" + token_encrypted;</div><div> //session_SHA is the token used to authenticate on a request</div><div>}</div><div><br></div><div>
Thanks</div><div>Best regards</div><div><br></div><div><br></div><div><br></div><div><br></div></div><div>
<span style="border-collapse:separate;border-spacing:0px"><span style="border-collapse:separate;font-variant:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><font face="Verdana" color="#a2a2a2"><div>
Enguerran Boissier</div><div><a href="http://www.terradue.com/" target="_blank">www.terradue.com</a></div></font></span><br><span></span><span></span><span></span><span style="font-family:Helvetica;font-weight:normal;font-style:normal"></span><span><span><t2uk.png></span></span>
</span></div><div>
<br><div><div>On 28 Jul 2014, at 10:45, Daniel Molina <<a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a>> wrote:</div><br><blockquote type="cite"><div dir="ltr">Hi Cesare,<br><br>The server_* authentication is a special method where a user can authenticate on behalf of other user. This method was included in OpenNebula for scenarios such as an Apache server configured to use x509 certificates, Apache has already authenticated the user and we just encrypt a token with the serveradmin credentials and OpenNebula will decrypt the token and will perform all the actions as the target_username.<br>
<br>Users using the server_* auth method are special users and should not have any resource.<br><br>You can see an example on how Sunstone uses this method:<br>A user logs in:<br><a href="https://github.com/OpenNebula/one/blob/master/src/sunstone/sunstone-server.rb#L169" target="_blank">https://github.com/OpenNebula/one/blob/master/src/sunstone/sunstone-server.rb#L169</a><div>
do_auth is called to authenticate the user:<br><a href="https://github.com/OpenNebula/one/blob/master/src/cloud/common/CloudAuth/SunstoneCloudAuth.rb#L18" target="_blank">https://github.com/OpenNebula/one/blob/master/src/cloud/common/CloudAuth/SunstoneCloudAuth.rb#L18</a></div>
<div>a token is generated using the server_* method<br><a href="https://github.com/OpenNebula/one/blob/master/src/authm_mad/remotes/server_cipher/server_cipher_auth.rb#L85" target="_blank">https://github.com/OpenNebula/one/blob/master/src/authm_mad/remotes/server_cipher/server_cipher_auth.rb#L85</a></div>
<div>this info is sent to one and then checked by the auth driver:<br><a href="https://github.com/OpenNebula/one/blob/master/src/authm_mad/remotes/server_cipher/server_cipher_auth.rb#L110" target="_blank">https://github.com/OpenNebula/one/blob/master/src/authm_mad/remotes/server_cipher/server_cipher_auth.rb#L110</a></div>
<div><br>Hope this helps<br><br><a href="http://docs.opennebula.org/4.6/administration/sunstone_gui/cloud_auth.html" target="_blank">http://docs.opennebula.org/4.6/administration/sunstone_gui/cloud_auth.html</a><div><br>
</div><div><br></div>
<div class="gmail_extra"><br><br><div class="gmail_quote">On 25 July 2014 12:39, Cesare Rossi <span dir="ltr"><<a href="mailto:cesare.rossi@terradue.com" target="_blank">cesare.rossi@terradue.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>Dear All,</div><div><br></div><div>we are interacting with the XML-RPC API. We are trying to perform the special authentication method available with the users' drivers <i>server_cipher</i> or <i>server_x509 </i>(i.e. using username:target_username:secret), but it seems not working.</div>
<div><br></div><div>The question is: is it possible to use with that API such kind of users ? If yes, how ?</div><div><br></div><div>Thanks in advance,</div><div><br></div><div>Cheers</div><span><font color="#888888"><br>
<div>
<div>Cesare Rossi</div><div>Terradue</div><div>Rome, Italy | Oxford, UK</div><div><a href="http://www.terradue.com/" target="_blank">http://www.terradue.com</a></div><div><br></div><br>
</div>
<br>
</font></span></div><br>_______________________________________________<br>
Dev mailing list<br>
<a href="mailto:Dev@lists.opennebula.org" target="_blank">Dev@lists.opennebula.org</a><br>
<a href="http://lists.opennebula.org/listinfo.cgi/dev-opennebula.org" target="_blank">http://lists.opennebula.org/listinfo.cgi/dev-opennebula.org</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div>--<br></div>Daniel Molina<br>Project Engineer<br>OpenNebula - Flexible Enterprise Cloud Made Simple<br><a href="http://www.opennebula.org/" target="_blank">www.OpenNebula.org</a> | <a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a> | @OpenNebula</div>
</div></div></div>
</blockquote></div><br></div></div></blockquote></div><div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div>--<br></div>Daniel Molina<br>Project Engineer<br>OpenNebula - Flexible Enterprise Cloud Made Simple<br>
<a href="http://www.opennebula.org/" target="_blank">www.OpenNebula.org</a> | <a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a> | @OpenNebula</div>
</div></div></div>
</blockquote></div><br></div></div></div></blockquote></div><div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div>--<br></div>Daniel Molina<br>Project Engineer<br>OpenNebula - Flexible Enterprise Cloud Made Simple<br>
<a href="http://www.opennebula.org/" target="_blank">www.OpenNebula.org</a> | <a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a> | @OpenNebula</div>
</div></div>
</blockquote></div><br></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div>--<br></div>Daniel Molina<br>Project Engineer<br>OpenNebula - Flexible Enterprise Cloud Made Simple<br><a href="http://www.opennebula.org/" target="_blank">www.OpenNebula.org</a> | <a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a> | @OpenNebula</div>
</div>
</blockquote></div><br></div></div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr"><div>--<br></div>Daniel Molina<br>Project Engineer<br>OpenNebula - Flexible Enterprise Cloud Made Simple<br>
<a href="http://www.opennebula.org/" target="_blank">www.OpenNebula.org</a> | <a href="mailto:dmolina@opennebula.org" target="_blank">dmolina@opennebula.org</a> | @OpenNebula</div>
</div>
</blockquote></div><br></body></html>