Bug 1327041 - [RFE] [z-stream clone - 3.6.7] AAA - Make Kerberos work with Java Authentication Framework
Summary: [RFE] [z-stream clone - 3.6.7] AAA - Make Kerberos work with Java Authenticat...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Virtualization Manager
Classification: Red Hat
Component: ovirt-engine
Version: 3.5.0
Hardware: Unspecified
OS: Unspecified
high
medium
Target Milestone: ovirt-3.6.7
: 3.6.7
Assignee: Ondra Machacek
QA Contact: Gonza
URL:
Whiteboard:
Depends On: 1322940
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-04-14 07:19 UTC by rhev-integ
Modified: 2019-10-10 11:54 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
To provide a way to configure gssapi using ticket cache for authz pool, a new security domain called 'oVirtKerbAAA' was added to JBoss configuration, which can be customized by using the following variables: AAA_KRB5_CONF_FILE=path_to_krb5_conf Specify the custom krb5.conf file. The default is /etc/ovirt-engine/krb5.conf Java supports only one krb5 configuration, if the user changes this property, then manage-domains will stop working because its configuration is managed in /etc/ovirt-engine/krb5.conf. AAA_JAAS_USE_TICKET_CACHE=true/false Enable or disable using the ticket cache file for authentication. AAA_JAAS_TICKET_CACHE_FILE=path_to_ticket_cache Specify the custom ticket cache file. The default is /tmp/krb5cc_${UID}, where UID is the ID of the ovirt user. AAA_JAAS_USE_KEYTAB=false/true Enable or disable using the keytab file for authentication. AAA_JAAS_KEYTAB_FILE=path_to_keytab_file Specify the custom keytab file. The default is ${OVIRT_HOME}/krb5.keytab where OVIRT_HOME is home directory of ovirt user. To use one of the features, the user has to create a new configuration file and specify the correct values for those variables, for example: /etc/ovirt-engine/engine.conf.d/99-jaas.conf. To use the new security domain configuration from aaa-ldap, the user has to specify the correct JAASClientName (default is oVirtKerb). Therefore, to use this new configuration for authz pool, the user has to add following line to aaa-ldap authz configuration: pool.authz.auth.gssapi.jAASClientName = oVirtKerbAAA To use it for both authn and authz, the user has to add the following line to aaa-ldap configuration: pool.default.auth.gssapi.jAASClientName = oVirtKerbAAA
Clone Of: 1322940
Environment:
Last Closed: 2016-06-29 16:19:49 UTC
oVirt Team: Infra
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:1364 0 normal SHIPPED_LIVE Red Hat Enterprise Virtualization Manager (rhevm) bug fix 3.6.7 2016-06-29 20:18:44 UTC
oVirt gerrit 55791 0 master MERGED aaa: add new kerberos configuration to jaas 2016-04-14 07:19:45 UTC
oVirt gerrit 56076 0 master MERGED aaa: exttool: use JBoss JAAS configuration by default 2016-04-14 07:19:45 UTC
oVirt gerrit 56120 0 ovirt-engine-3.6 MERGED aaa: add new kerberos configuration to jaas 2016-05-05 10:02:58 UTC
oVirt gerrit 56121 0 ovirt-engine-3.6 MERGED aaa: exttool: use JBoss JAAS configuration by default 2016-05-05 08:51:46 UTC
oVirt gerrit 57358 0 ovirt-engine-3.6 MERGED aaa: kerbldap: send special path to krb5.conf 2016-05-14 20:02:44 UTC

Comment 1 Martin Perina 2016-04-14 07:20:37 UTC 
Correcting Target milestone
Comment 2 Ondra Machacek 2016-05-11 15:55:28 UTC 
One of the patches would introduce regression to manage domains, adding back to POST, until fixed.
Comment 3 Martin Perina 2016-05-23 12:54:10 UTC 
Changes were done only on engine side, so moving to ovirt-engine component
Comment 4 Gonza 2016-06-13 18:21:26 UTC 
Verified with:
rhevm-3.6.7.2-0.1.el6.noarch
ovirt-engine-extension-aaa-ldap-1.1.4-1.el6ev.noarch

# ovirt-engine-extensions-tool aaa search --entity-name=vdcadmin --extension-name=ipa-authz
2016-06-13 18:33:09 INFO    ========================================================================
2016-06-13 18:33:09 INFO    ============================ Initialization ============================
2016-06-13 18:33:09 INFO    ========================================================================
2016-06-13 18:33:09 INFO    Loading extension 'ipa-authz'
2016-06-13 18:33:09 INFO    Extension 'ipa-authz' loaded
2016-06-13 18:33:09 INFO    Loading extension 'ipa-authn'
2016-06-13 18:33:10 INFO    Extension 'ipa-authn' loaded
2016-06-13 18:33:10 INFO    Initializing extension 'ipa-authz'
2016-06-13 18:33:10 INFO    [ovirt-engine-extension-aaa-ldap.authz::ipa-authz] Creating LDAP pool 'authz'
2016-06-13 18:33:10 INFO    [ovirt-engine-extension-aaa-ldap.authz::ipa-authz] LDAP pool 'authz' information: vendor='389 Project' version='389-Directory/1.2.11.15 B2013.289.33'
2016-06-13 18:33:10 INFO    [ovirt-engine-extension-aaa-ldap.authz::ipa-authz] Available Namespaces: [dc=brq-ipa,dc=rhev,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com]
2016-06-13 18:33:10 INFO    Extension 'ipa-authz' initialized
2016-06-13 18:33:20 INFO    Initializing extension 'ipa-authn'
2016-06-13 18:33:20 INFO    [ovirt-engine-extension-aaa-ldap.authn::ipa-authn] Creating LDAP pool 'authz'
2016-06-13 18:33:20 INFO    [ovirt-engine-extension-aaa-ldap.authn::ipa-authn] LDAP pool 'authz' information: vendor='389 Project' version='389-Directory/1.2.11.15 B2013.289.33'
2016-06-13 18:33:20 INFO    [ovirt-engine-extension-aaa-ldap.authn::ipa-authn] Creating LDAP pool 'authn'
2016-06-13 18:33:20 INFO    [ovirt-engine-extension-aaa-ldap.authn::ipa-authn] LDAP pool 'authn' information: vendor='389 Project' version='389-Directory/1.2.11.15 B2013.289.33'
2016-06-13 18:33:20 INFO    Extension 'ipa-authn' initialized
2016-06-13 18:33:20 INFO    Start of enabled extensions list
2016-06-13 18:33:20 INFO    Instance name: 'ipa-authn', Extension name: 'ovirt-engine-extension-aaa-ldap.authn', Version: '1.1.4', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.1.4-1.el6ev', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0',  File: '/etc/ovirt-engine/extensions.d/ipa-authn.properties', Initialized: 'true'
2016-06-13 18:33:20 INFO    Instance name: 'ipa-authz', Extension name: 'ovirt-engine-extension-aaa-ldap.authz', Version: '1.1.4', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.1.4-1.el6ev', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0',  File: '/etc/ovirt-engine/extensions.d/ipa-authz.properties', Initialized: 'true'
2016-06-13 18:33:20 INFO    End of enabled extensions list
2016-06-13 18:33:20 INFO    ========================================================================
2016-06-13 18:33:20 INFO    ============================== Execution ===============================
2016-06-13 18:33:20 INFO    ========================================================================
2016-06-13 18:33:20 INFO    --- Begin QueryFilterRecord ---
2016-06-13 18:33:20 INFO    AAA_AUTHZ_QUERY_ENTITY: AAA_AUTHZ_QUERY_ENTITY_PRINCIPAL[1695cd36-4656-474f-b7bc-4466e12634e4]
2016-06-13 18:33:20 INFO    AAA_AUTHZ_QUERY_FILTER_OPERATOR: 102
2016-06-13 18:33:20 INFO      --- Begin QueryFilterRecord ---
2016-06-13 18:33:20 INFO      AAA_AUTHZ_PRINCIPAL_NAME: vdcadmin
2016-06-13 18:33:20 INFO      AAA_AUTHZ_QUERY_FILTER_KEY: Extkey[name=AAA_AUTHZ_PRINCIPAL_NAME;type=class java.lang.String;uuid=AAA_AUTHZ_PRINCIPAL_NAME[a0df5bcc-6ead-40a2-8565-2f5cc8773bdd];]
2016-06-13 18:33:20 INFO      AAA_AUTHZ_QUERY_FILTER_OPERATOR: 0
2016-06-13 18:33:20 INFO      --- End QueryFilterRecord ---
2016-06-13 18:33:20 INFO    --- End QueryFilterRecord ---
2016-06-13 18:33:20 INFO    API: -->Authz.InvokeCommands.QUERY_OPEN namespace='dc=brq-ipa,dc=rhev,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com'
2016-06-13 18:33:20 INFO    API: <--Authz.InvokeCommands.QUERY_OPEN
2016-06-13 18:33:20 INFO    API: -->Authz.InvokeCommands.QUERY_EXECUTE
2016-06-13 18:33:20 INFO    API: <--Authz.InvokeCommands.QUERY_EXECUTE count=1
2016-06-13 18:33:20 INFO    --- Begin PrincipalRecord ---
2016-06-13 18:33:20 INFO    AAA_AUTHZ_PRINCIPAL_DISPLAY_NAME: nas ucet
2016-06-13 18:33:20 INFO    AAA_AUTHZ_PRINCIPAL_EMAIL: xxx
2016-06-13 18:33:20 INFO    AAA_AUTHZ_PRINCIPAL_LAST_NAME: ucet
2016-06-13 18:33:20 INFO    AAA_AUTHZ_PRINCIPAL_PRINCIPAL: vdcadmin
2016-06-13 18:33:20 INFO    AAA_LDAP_UNBOUNDID_DN: uid=vdcadmin,cn=users,cn=accounts,dc=brq-ipa,dc=rhev,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com
2016-06-13 18:33:20 INFO    AAA_AUTHZ_PRINCIPAL_ID: e32a2998-e85b-11e0-ade4-001a4a013f11
2016-06-13 18:33:20 INFO    AAA_AUTHZ_PRINCIPAL_NAME: vdcadmin
2016-06-13 18:33:20 INFO    AAA_AUTHZ_PRINCIPAL_FIRST_NAME: nas
2016-06-13 18:33:20 INFO    AAA_AUTHZ_PRINCIPAL_NAMESPACE: dc=brq-ipa,dc=rhev,dc=lab,dc=eng,dc=brq,dc=redhat,dc=com
2016-06-13 18:33:20 INFO    --- End   PrincipalRecord ---
2016-06-13 18:33:20 INFO    API: -->Authz.InvokeCommands.QUERY_EXECUTE
2016-06-13 18:33:20 INFO    API: <--Authz.InvokeCommands.QUERY_EXECUTE count=END
2016-06-13 18:33:20 INFO    API: -->Authz.InvokeCommands.QUERY_CLOSE
2016-06-13 18:33:20 INFO    API: <--Authz.InvokeCommands.QUERY_CLOSE
Comment 6 errata-xmlrpc 2016-06-29 16:19:49 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2016:1364
Note You need to log in before you can comment on or make changes to this bug.