Bug 1476980 - AAA LDAP setup does not add baseDN to *-authn.properties
AAA LDAP setup does not add baseDN to *-authn.properties
Status: CLOSED CURRENTRELEASE
Product: ovirt-engine-extension-aaa-ldap
Classification: oVirt
Component: General (Show other bugs)
1.3.2
x86_64 Linux
unspecified Severity high (vote)
: ovirt-4.1.6
: 1.3.4
Assigned To: Ondra Machacek
Gonza
: ZStream
Depends On: 1482940
Blocks: 1485875
  Show dependency treegraph
 
Reported: 2017-07-31 21:07 EDT by Richard Chan
Modified: 2017-09-19 06:01 EDT (History)
6 users (show)

See Also:
Fixed In Version: ovirt-engine-extension-aaa-ldap-1.3.4
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1485875 (view as bug list)
Environment:
Last Closed: 2017-09-19 06:01:43 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: Infra
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
rule-engine: ovirt‑4.1+
lsvaty: testing_ack+


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
oVirt gerrit 80100 None None None 2017-08-02 07:28 EDT

  None (edit)
Description Richard Chan 2017-07-31 21:07:19 EDT
Description of problem:
When you run ovirt-engine-extension-aaa-ldap-setup and set baseDN (dc=example,dc=com)  it does not add the line

config.globals.baseDN.simple_baseDN = dc=example,dc=com

to the -authn.properties file.

Login  test fails.


Version-Release number of selected component (if applicable):
ovirt-engine-extension-aaa-ldap-setup-1.3.2-1.el7.centos.noarch

How reproducible:
Always 

Steps to Reproduce:
1. Run AAA LDAP setup with non-default baseDN
2. Try Search: PASS
3. Try Login: FAIL!

Actual results:
Search test passes
Login test always fails


Expected results:
Search test passes
Login test passes


Additional info:

The line config.globals.baseDN.simple_baseDN = dc=example,dc=com
is added to extensions.d/*-authz.properties but not extensions.d/*-authn.properties
Comment 1 Richard Chan 2017-07-31 21:18:26 EDT
This is a from a system upgrade 3.6->4.0-4.1.

For some reason, the LDAP configuration for 3.6 didn't work (the simple_baseDN was set by using var_set in the aaa/ profile), so LDAP setup was run anew.

## this didn't work in 4.0/4.1 any more :-(
## 3.6 working config
## ran LDAP setup anew...
sequence-init.init.100-my-basedn-init-vars = my-basedn-init-vars
sequence.my-basedn-init-vars.010.description = set baseDN
sequence.my-basedn-init-vars.010.type = var-set
sequence.my-basedn-init-vars.010.var-set.variable = simple_baseDN
sequence.my-basedn-init-vars.010.var-set.value = dc=example,dc=com
Comment 2 Martin Perina 2017-08-01 03:45:46 EDT
There's no reason why AAA configuration from 3.6 stops working on 4.x, could you please provide logs with the issue?
Comment 3 Richard Chan 2017-08-01 03:55:56 EDT
When I delete the lines

config.globals.baseDN.simple_baseDN = dc=example,dc=com

from extensions.d/example-authn.properties extensions.d/example-authz.properties and restore

in aaa/example.properties

sequence-init.init.100-my-basedn-init-vars = my-basedn-init-vars
sequence.my-basedn-init-vars.010.description = set baseDN
sequence.my-basedn-init-vars.010.type = var-set
sequence.my-basedn-init-vars.010.var-set.variable = simple_baseDN
sequence.my-basedn-init-vars.010.var-set.value = dc=example,dc=com

my configuration now works. Can't reproduce 3.6->4.1 issue now.

This is a false alarm. 

The original issue with a fresh 4.1 omitting 

config.globals.baseDN.simple_baseDN = dc=example,dc=com

from extensions.d/example-authn.properties  remains.

Running the setup I cannot get the Login test to pass.
Comment 4 Ondra Machacek 2017-08-01 06:34:29 EDT
Can you please share log?
Comment 5 Richard Chan 2017-08-01 09:44:03 EDT
Log from Login test during setup

[root@ovirt extensions.d]# cat /tmp/tmpH3Ijdg/extensions.d/example.com-authn.properties 
ovirt.engine.extension.name = example.com-authn
ovirt.engine.extension.bindings.method = jbossmodule
ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.ldap
ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.ldap.AuthnExtension
ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn
ovirt.engine.aaa.authn.profile.name = example.com
ovirt.engine.aaa.authn.authz.plugin = example.com
config.profile.file.1 = ../aaa/example.com.properties

Executing login sequence...
Login output:
2017-08-01 21:35:40,842+08 INFO    ========================================================================
2017-08-01 21:35:40,856+08 INFO    ============================ Initialization ============================
2017-08-01 21:35:40,856+08 INFO    ========================================================================
2017-08-01 21:35:40,867+08 INFO    Loading extension 'example.com-authn'
2017-08-01 21:35:40,912+08 INFO    Extension 'example.com-authn' loaded
2017-08-01 21:35:40,915+08 INFO    Loading extension 'example.com'
2017-08-01 21:35:40,921+08 INFO    Extension 'example.com' loaded
2017-08-01 21:35:40,922+08 INFO    Initializing extension 'example.com-authn'
2017-08-01 21:35:40,923+08 INFO    [ovirt-engine-extension-aaa-ldap.authn::example.com-authn] Creating LDAP pool 'authz'
2017-08-01 21:35:41,365+08 INFO    [ovirt-engine-extension-aaa-ldap.authn::example.com-authn] LDAP pool 'authz' information: vendor='null' version='null'
2017-08-01 21:35:41,366+08 INFO    [ovirt-engine-extension-aaa-ldap.authn::example.com-authn] Creating LDAP pool 'authn'
2017-08-01 21:35:41,626+08 INFO    [ovirt-engine-extension-aaa-ldap.authn::example.com-authn] LDAP pool 'authn' information: vendor='null' version='null'
2017-08-01 21:35:41,640+08 INFO    Extension 'example.com-authn' initialized
2017-08-01 21:35:41,641+08 INFO    Initializing extension 'example.com'
2017-08-01 21:35:41,641+08 INFO    [ovirt-engine-extension-aaa-ldap.authz::example.com] Creating LDAP pool 'authz'
2017-08-01 21:35:41,864+08 INFO    [ovirt-engine-extension-aaa-ldap.authz::example.com] LDAP pool 'authz' information: vendor='null' version='null'
2017-08-01 21:35:41,868+08 INFO    [ovirt-engine-extension-aaa-ldap.authz::example.com] Available Namespaces: [dc=example,dc=com]
2017-08-01 21:35:41,869+08 INFO    Extension 'example.com' initialized
2017-08-01 21:35:41,869+08 INFO    Start of enabled extensions list
2017-08-01 21:35:41,869+08 INFO    Instance name: 'example.com-authn', Extension name: 'ovirt-engine-extension-aaa-ldap.authn', Version: '1.3.2', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.2-1.el7.centos', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0',  File: '/tmp/tmpH3Ijdg/extensions.d/example.com-authn.properties', Initialized: 'true'
2017-08-01 21:35:41,869+08 INFO    Instance name: 'example.com', Extension name: 'ovirt-engine-extension-aaa-ldap.authz', Version: '1.3.2', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.2-1.el7.centos', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0',  File: '/tmp/tmpH3Ijdg/extensions.d/example.com-authz.properties', Initialized: 'true'
2017-08-01 21:35:41,870+08 INFO    End of enabled extensions list
2017-08-01 21:35:41,870+08 INFO    ========================================================================
2017-08-01 21:35:41,870+08 INFO    ============================== Execution ===============================
2017-08-01 21:35:41,870+08 INFO    ========================================================================
2017-08-01 21:35:41,870+08 INFO    Iteration: 0
2017-08-01 21:35:41,871+08 INFO    Profile='example.com' authn='example.com-authn' authz='example.com' mapping='null'
2017-08-01 21:35:41,871+08 INFO    API: -->Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='example.com' user='testuser'
2017-08-01 21:35:41,875+08 INFO    API: <--Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='example.com' result=CREDENTIALS_INVALID
2017-08-01 21:35:41,876+08 SEVERE  Authn.Result code is: CREDENTIALS_INVALID
Login sequence failed
          Please investigate details of the failure (search for lines containing SEVERE log level).


On OpenLDAP

'dc=my-domain,dc=com' is another root DN on the same OpenLDAP server used as a testing ground

Aug 01 21:35:41 piston.tbs slapd[3779]: conn=20555 op=2 SRCH base="dc=my-domain,dc=com" scope=2 deref=0 filter="(&(objectClass=uidObject)(uid=*)(uid=testuser))"
Comment 6 Richard Chan 2017-08-01 09:55:33 EDT
This OpenLDAP server has two root DNs, which setup detects and offers during: 

Please enter base DN (dc=my-domain,dc=com,dc=example,dc=com) [dc=my-domain,dc=com]: dc=example,dc=com

It saves the correct baseDN in -authz but not in -authn
Comment 7 Richard Chan 2017-08-01 09:58:01 EDT
Before the Login test, if I manually edit 

/tmp/tmpHzr1iT/extensions.d/example.com-authn.properties to add
config.globals.baseDN.simple_baseDN = o=TreeBox,c=SG

then the Login test works.
Comment 8 Richard Chan 2017-08-01 10:21:31 EDT
Sorry - the testing baseDN should be dc=example,dc=com, sent the logs from the wrong system
Comment 9 Ondra Machacek 2017-08-02 07:15:08 EDT
Right, I've just reproduced it, thanks a lot, I will send a fix.
Comment 10 Richard Chan 2017-08-02 08:10:38 EDT
Karma +1: I have tested the patch in https://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git;a=commit;h=860a2add012370b660afc40b3409641f829cb7c5 and can confirm that it fixes my issue.

Thank you.
Comment 11 Martin Perina 2017-08-03 03:46:43 EDT
Fix is contained is going to be delivered in ovirt-engine-extension-aaa-ldap-1.3.3
Comment 12 Martin Perina 2017-08-18 11:00:23 EDT
Retargeting to ovirt-4.1.6
Comment 13 Martin Perina 2017-08-28 06:43:16 EDT
Fix is included in ovirt-engine-extension-aaa-ldap-1.3.4
Comment 16 Gonza 2017-09-04 08:02:13 EDT
Verified with:
ovirt-engine-extension-aaa-ldap-setup-1.3.5-0.0.master.git7230cd9.el7.centos.noarch

# cat /etc/ovirt-engine/extensions.d/brq-openldap.com-authn.properties
...
config.globals.baseDN.simple_baseDN = dc=brq-openldap,dc=com

Note You need to log in before you can comment on or make changes to this bug.