<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi Javier,</div>
<div> </div>
<div>I just tested your advised given below, seems it's working fine for now. I'm able to authenticate using AD without having account registered locally on Opennebula frontend.</div>
<div> </div>
<div> Thanks for your advised again. Really appreciate it.</div>
<div> </div>
<div>Best regards,</div>
<div>.fahmie</div>
<div> </div>
<div>-----Original Message-----<br>
From: Javier Fontan [<a href="mailto:jfontan@opennebula.org">mailto:jfontan@opennebula.org</a>]
<br>
Sent: Wednesday, September 04, 2013 4:58 PM<br>
To: Shek Mohd Fahmi Abdul Latip<br>
Cc: users@lists.opennebula.org; Hadi Noira Omar<br>
Subject: Re: [one-users] Opennebula - Active Directory authentication intergration</div>
<div> </div>
<div>It should not have any problem with a underscore. The error you are getting is caused because you DN is being incorrectly transformed to xml. It most probably is some character that is breaking that serialization. As I don't have the DN I can not reproduce
it.</div>
<div> </div>
<div>Fortunately the DN in ldap is stored only as extra information and this can be disabled. Change the file /var/lib/one/remotes/auth/default/authenticate, line 88, from:</div>
<div> </div>
<div><span style="background-color:yellow;">puts "ldap #{escaped_user} #{escaped_secret}"</span></div>
<div> </div>
<div>to</div>
<div> </div>
<div><span style="background-color:lime;">puts "ldap #{escaped_user} -"</span></div>
<div> </div>
<div>This should fix the problem.</div>
<div> </div>
<div> </div>
<div>On Wed, Sep 4, 2013 at 2:39 AM, Shek Mohd Fahmi Abdul Latip <<a href="mailto:fahmi.latip@mimos.my">fahmi.latip@mimos.my</a>> wrote:</div>
<div>> Hi Javier,</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Yes, I got “_” (normal underscore symbol) inside one of my DN entry as </div>
<div>> in the OU name. Is there any problem with that? If yes, any workaround </div>
<div>> to make it works? Kindly advised.</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Best regards,</div>
<div>></div>
<div>> .fahmie</div>
<div>></div>
<div>></div>
<div>></div>
<div>> From: Javier Fontan [<a href="mailto:jfontan@opennebula.org">mailto:jfontan@opennebula.org</a>]</div>
<div>> Sent: Wednesday, September 04, 2013 3:58 AM</div>
<div>></div>
<div>></div>
<div>> To: Shek Mohd Fahmi Abdul Latip</div>
<div>> Cc: <a href="mailto:users@lists.opennebula.org">users@lists.opennebula.org</a>; Hadi Noira Omar</div>
<div>> Subject: Re: [one-users] Opennebula - Active Directory authentication </div>
<div>> intergration</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Do you have any non word characters in the DN? Like <, >, [, ] and such.</div>
<div>></div>
<div>></div>
<div>></div>
<div>> On Tue, Sep 3, 2013 at 4:36 AM, Shek Mohd Fahmi Abdul Latip </div>
<div>> <<a href="mailto:fahmi.latip@mimos.my">fahmi.latip@mimos.my</a>> wrote:</div>
<div>></div>
<div>> Hi,</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Here is my one/auth/ldap_auth.conf settings:</div>
<div>></div>
<div>></div>
<div>></div>
<div>> server 1:</div>
<div>></div>
<div>> :user: 'one***@*****.****'</div>
<div>></div>
<div>> :password: '********'</div>
<div>></div>
<div>> :auth_method: :simple</div>
<div>></div>
<div>> :host: 10.*.*.*</div>
<div>></div>
<div>> :port: 389</div>
<div>></div>
<div>> :base: 'OU=******,DC=****,DC=******'</div>
<div>></div>
<div>> :user_field: 'sAMAccountName'</div>
<div>></div>
<div>></div>
<div>></div>
<div>> :order:</div>
<div>></div>
<div>> - server 1</div>
<div>></div>
<div>></div>
<div>></div>
<div>> And this is my oned.conf looks like:</div>
<div>></div>
<div>></div>
<div>></div>
<div>> LOG = [</div>
<div>></div>
<div>> system = "file",</div>
<div>></div>
<div>> debug_level = 3</div>
<div>></div>
<div>> ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>> MANAGER_TIMER = 5</div>
<div>></div>
<div>></div>
<div>></div>
<div>> MONITORING_INTERVAL = 10</div>
<div>></div>
<div>></div>
<div>></div>
<div>> SCRIPTS_REMOTE_DIR=/var/tmp/one</div>
<div>></div>
<div>></div>
<div>></div>
<div>> PORT = 2633</div>
<div>></div>
<div>></div>
<div>></div>
<div>> DB = [ backend = "mysql",</div>
<div>></div>
<div>> server = "localhost",</div>
<div>></div>
<div>> port = 0,</div>
<div>></div>
<div>> user = "*******",</div>
<div>></div>
<div>> passwd = "********",</div>
<div>></div>
<div>> db_name = "opennebula" ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>> VNC_BASE_PORT = 5900</div>
<div>></div>
<div>></div>
<div>></div>
<div>> NETWORK_SIZE = 254</div>
<div>></div>
<div>></div>
<div>></div>
<div>> MAC_PREFIX = "02:00"</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> DATASTORE_CAPACITY_CHECK = "yes"</div>
<div>></div>
<div>></div>
<div>></div>
<div>> DEFAULT_IMAGE_TYPE = "OS"</div>
<div>></div>
<div>> DEFAULT_DEVICE_PREFIX = "hd"</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> IM_MAD = [</div>
<div>></div>
<div>> name = "kvm",</div>
<div>></div>
<div>> executable = "one_im_ssh",</div>
<div>></div>
<div>> arguments = "-r 0 -t 15 kvm" ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> VM_MAD = [</div>
<div>></div>
<div>> name = "kvm",</div>
<div>></div>
<div>> executable = "one_vmm_exec",</div>
<div>></div>
<div>> arguments = "-t 15 -r 0 kvm",</div>
<div>></div>
<div>> default = "vmm_exec/vmm_exec_kvm.conf",</div>
<div>></div>
<div>> type = "kvm" ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>> TM_MAD = [</div>
<div>></div>
<div>> executable = "one_tm",</div>
<div>></div>
<div>> arguments = "-t 15 -d dummy,lvm,shared,qcow2,ssh,vmfs,iscsi,ceph" </div>
<div>> ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> DATASTORE_MAD = [</div>
<div>></div>
<div>> executable = "one_datastore",</div>
<div>></div>
<div>> arguments = "-t 15 -d dummy,fs,vmfs,iscsi,lvm,ceph"</div>
<div>></div>
<div>> ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>> HM_MAD = [</div>
<div>></div>
<div>> executable = "one_hm" ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>> HOST_HOOK = [</div>
<div>></div>
<div>> name = "error",</div>
<div>></div>
<div>> on = "ERROR",</div>
<div>></div>
<div>> command = "ft/host_error.rb",</div>
<div>></div>
<div>> arguments = "$ID -r",</div>
<div>></div>
<div>> remote = "no" ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>> VM_HOOK = [</div>
<div>></div>
<div>> name = "on_failure_recreate",</div>
<div>></div>
<div>> on = "FAILED",</div>
<div>></div>
<div>> command = "/usr/bin/env onevm delete --recreate",</div>
<div>></div>
<div>> arguments = "$ID" ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>> AUTH_MAD = [</div>
<div>></div>
<div>> executable = "one_auth_mad",</div>
<div>></div>
<div>> authn = "ssh,x509,ldap,server_cipher,server_x509,default"</div>
<div>></div>
<div>> ]</div>
<div>></div>
<div>></div>
<div>></div>
<div>> SESSION_EXPIRATION_TIME = 900</div>
<div>></div>
<div>></div>
<div>></div>
<div>> DEFAULT_UMASK = 177</div>
<div>></div>
<div>></div>
<div>></div>
<div>> VM_RESTRICTED_ATTR = "CONTEXT/FILES"</div>
<div>></div>
<div>> VM_RESTRICTED_ATTR = "NIC/MAC"</div>
<div>></div>
<div>> VM_RESTRICTED_ATTR = "NIC/VLAN_ID"</div>
<div>></div>
<div>></div>
<div>></div>
<div>> IMAGE_RESTRICTED_ATTR = "SOURCE"</div>
<div>></div>
<div>></div>
<div>></div>
<div>> ONEGATE_ENDPOINT = "<a href="http://1**.******:5030">http://1**.******:5030</a>"</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> Best regards,</div>
<div>></div>
<div>> .fahmie</div>
<div>></div>
<div>></div>
<div>></div>
<div>> From: Jonathan Chen [<a href="mailto:simon8233@gmail.com">mailto:simon8233@gmail.com</a>]</div>
<div>> Sent: Monday, September 02, 2013 10:08 PM</div>
<div>> To: Shek Mohd Fahmi Abdul Latip</div>
<div>> Cc: <a href="mailto:users@lists.opennebula.org">users@lists.opennebula.org</a>; Hadi Noira Omar</div>
<div>> Subject: Re: [one-users] Opennebula - Active Directory authentication </div>
<div>> intergration</div>
<div>></div>
<div>></div>
<div>></div>
<div>> maybe you can show your configuration file.</div>
<div>></div>
<div>></div>
<div>></div>
<div>> like ldap_conf , oned.conf ... etc</div>
<div>></div>
<div>></div>
<div>></div>
<div>> hidden your ip , account and passwd.</div>
<div>></div>
<div>></div>
<div>></div>
<div>> will be help them to solve your problem.</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Jonathan</div>
<div>></div>
<div>></div>
<div>></div>
<div>> 2013/9/2 Shek Mohd Fahmi Abdul Latip <<a href="mailto:fahmi.latip@mimos.my">fahmi.latip@mimos.my</a>></div>
<div>></div>
<div>> Hi experts,</div>
<div>></div>
<div>></div>
<div>></div>
<div>> I’m using the latest Opennebula 4.2 on CentOS 6.4. Right now in the </div>
<div>> middle of integrating the authentication system with MS-AD through LDAP protocol.</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Based on the documentation:</div>
<div>></div>
<div>></div>
<div>></div>
<div>> To be able to use this driver for users that are still not in the user </div>
<div>> database you must set it to the default driver. To do this go to the </div>
<div>> auth drivers directory and copy the directory ldap to default. In </div>
<div>> system-wide installations you can do this using this command:</div>
<div>></div>
<div>> $ cp -R /var/lib/one/remotes/auth/ldap </div>
<div>> /var/lib/one/remotes/auth/default</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> What I can understand, if the user account is not exist on the </div>
<div>> opennebula database, it will still be able to retrieve and </div>
<div>> authenticate via LDAP/AD. I did this configuration and somehow I got the error as mention below.</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> I’ve followed the documentation provided on </div>
<div>> <a href="http://opennebula.org/documentation:rel4.2:ldap#active_directory">http://opennebula.org/documentation:rel4.2:ldap#active_directory</a> </div>
<div>> somehow, it works partially with error that I can’t really understand.</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Here is the error message that can be found in the oned.log:</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Mon Sep 2 11:24:05 2013 [AuM][D]: Message received: AUTHENTICATE </div>
<div>> SUCCESS 16 ldap fahmi.latip</div>
<div>> CN=******,OU=******,OU=*****,OU=Users,OU=*****,DC=******,DC=*******</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Mon Sep 2 11:24:05 2013 [AuM][E]: Can't create user: Error </div>
<div>> transforming the User to XML.. Driver response: ldap fahmi.latip</div>
<div>> CN=******,OU=******,OU=*****,OU=Users,OU=*****,DC=******,DC=*******</div>
<div>></div>
<div>> Mon Sep 2 11:24:05 2013 [ReM][D]: Req:9744 UID:- UserInfo invoked, -1</div>
<div>></div>
<div>> Mon Sep 2 11:24:05 2013 [ReM][E]: Req:9744 UID:- UserInfo result </div>
<div>> FAILURE [UserInfo] User couldn't be authenticated, aborting call.</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Anyone facing the similar issue before? Any clue what action need to </div>
<div>> be taken to solve this problem? Or is this method some kind of impossible?</div>
<div>></div>
<div>></div>
<div>></div>
<div>> Best regards,</div>
<div>></div>
<div>> .fahmie</div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> ------------------------------------------------------------------</div>
<div>> -</div>
<div>> -</div>
<div>> DISCLAIMER:</div>
<div>></div>
<div>> This e-mail (including any attachments) is for the addressee(s) only </div>
<div>> and may contain confidential information. If you are not the intended </div>
<div>> recipient, please note that any dealing, review, distribution, </div>
<div>> printing, copying or use of this e-mail is strictly prohibited. If you </div>
<div>> have received this email in error, please notify the sender </div>
<div>> immediately and delete the original message.</div>
<div>> MIMOS Berhad is a research and development institution under the </div>
<div>> purview of the Malaysian Ministry of Science, Technology and </div>
<div>> Innovation. Opinions, conclusions and other information in this e- </div>
<div>> mail that do not relate to the official business of MIMOS Berhad </div>
<div>> and/or its subsidiaries shall be understood as neither given nor </div>
<div>> endorsed by MIMOS Berhad and/or its subsidiaries and neither MIMOS </div>
<div>> Berhad nor its subsidiaries accepts responsibility for the same. All </div>
<div>> liability arising from or in connection with computer viruses and/or </div>
<div>> corrupted e-mails is excluded to the fullest extent permitted by law.</div>
<div>></div>
<div>></div>
<div>> _______________________________________________</div>
<div>> Users mailing list</div>
<div>> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a></div>
<div>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> _______________________________________________</div>
<div>> Users mailing list</div>
<div>> <a href="mailto:Users@lists.opennebula.org">Users@lists.opennebula.org</a></div>
<div>> <a href="http://lists.opennebula.org/listinfo.cgi/users-opennebula.org">http://lists.opennebula.org/listinfo.cgi/users-opennebula.org</a></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>></div>
<div>> --</div>
<div>> Join us at OpenNebulaConf2013 in Berlin from the 24th to the 26th of </div>
<div>> September 2013!</div>
<div>></div>
<div>> Javier Fontán Muiños</div>
<div>> Developer</div>
<div>> OpenNebula - The Open Source Toolkit for Data Center Virtualization </div>
<div>> <a href="http://www.OpenNebula.org">www.OpenNebula.org</a> | @OpenNebula | github.com/jfontan</div>
<div>></div>
<div>> ------------------------------------------------------------------</div>
<div>> -</div>
<div>> -</div>
<div>> DISCLAIMER:</div>
<div>></div>
<div>> This e-mail (including any attachments) is for the addressee(s) only </div>
<div>> and may contain confidential information. If you are not the intended </div>
<div>> recipient, please note that any dealing, review, distribution, </div>
<div>> printing, copying or use of this e-mail is strictly prohibited. If you </div>
<div>> have received this email in error, please notify the sender </div>
<div>> immediately and delete the original message.</div>
<div>> MIMOS Berhad is a research and development institution under the </div>
<div>> purview of the Malaysian Ministry of Science, Technology and </div>
<div>> Innovation. Opinions, conclusions and other information in this e- </div>
<div>> mail that do not relate to the official business of MIMOS Berhad </div>
<div>> and/or its subsidiaries shall be understood as neither given nor </div>
<div>> endorsed by MIMOS Berhad and/or its subsidiaries and neither MIMOS </div>
<div>> Berhad nor its subsidiaries accepts responsibility for the same. All </div>
<div>> liability arising from or in connection with computer viruses and/or </div>
<div>> corrupted e-mails is excluded to the fullest extent permitted by law.</div>
<div>></div>
<div>></div>
<div> </div>
<div> </div>
<div> </div>
<div>--</div>
<div>Join us at OpenNebulaConf2013 in Berlin from the 24th to the 26th of September 2013!</div>
<div> </div>
<div>Javier Fontán Muiños</div>
<div>Developer</div>
<div>OpenNebula - The Open Source Toolkit for Data Center Virtualization <a href="http://www.OpenNebula.org">www.OpenNebula.org</a> | @OpenNebula | github.com/jfontan</div>
<div> </div>
</span></font>
</body>
</html>