我正在尝试让 Active Directory 身份验证与 Eucalyptus 一起使用,但我无法使用配置的凭据登录控制台。我的 .lic 文件中有以下内容:
PROPERTY authentication.ldap_integration_configuration {
"ldap-service":{
"server-url":"ldap://<ldap-server-ip>:389",
"auth-method":"simple",
"user-auth-method":"simple",
"auth-principal":"eucalyptus@mydomain",
"auth-credentials":"{RSA/ECB/PKCS1Padding}oRv4cHzkJqBxqnT3S/w9tXAOAkrblaw/iGZtuXw4GWipcGbfthrthrDCt8U6P5G4re6eLd9hzcNYxPIdoNqEDeiWF9hfJB8Ndf1kEDV0xGXnzTHhI14F1DcaaasYMkvrqUqcefKrSmsGyg4JtcHF96kEtj3bhsdfsdfw3IpuRn0o4y2+iMoq+JkxOFogHuhGhtdMa7fsdfsdf232m0vOrFUeln5uI619yEFmoVtIsOZbF6tEJsM64GzSbtl0dOaSCdnHmOYeQ6ksfFcdmxz0/1QMOakHC+ntdGTZrO+83UQYGWue9IjKXP0dWTCpXNnp6+P6un+jY2cM25bR3uw==",
"use-ssl":"false",
"ignore-ssl-cert-validation":"true",
"krb5-conf":"/etc/krb5.conf",
},
"sync":{
"enable":"true",
"auto":"true",
"interval":"6000",
"clean-deletion":"true",
},
"accounting-groups":{
"base-dn":"OU=Eucalyptus,OU=Groups,MY_BASE_DN",
"id-attribute":"cn",
"member-attribute":"member",
"member-item-type":"cn",
"selection":{
"filter":"(&(objectClass=group)(!(memberOf=*)))"
}
},
"groups":{
"base-dn":" OU=Sec Groups,MY_BASE_DN",
"id-attribute":"cn",
"member-attribute":"member",
"member-item-type":"cn",
"selection":{
"filter":"(&(objectClass=group)(memberOf=*))",
}
},
"users":{
"base-dn":"MY_BASE_DN”,
"id-attribute":"cn",
"user-info-attributes":{
"displayname":"Full name"
},
"selection":{
"filter":"(&(objectClass=organizationalPerson)(objectClass=user))"
}
},
}
以及 LDAP 同步状态:
# euare-getldapsyncstatus
EUARE_URL environment variable is deprecated; use AWS_IAM_URL instead
SyncEnabled true
InSync false
在日志文件中,我看到以下内容:
Mon Dec 29 11:31:14 2014 ERROR [LdapSync:LDAP sync] User admin is reserved for Eucalyptus only. Sync will skip this user from LDAP.
我在accounting-groups base dn中添加了一个会计组,当我运行list命令时我看到了这个组:
# euare-accountlist
EUARE_URL environment variable is deprecated; use AWS_IAM_URL instead
(eucalyptus)blockstorage 886472098984
eucalyptus 144711845746
mygroup 752874470188
但是,没有出现该会计组的成员:
# euare-grouplistbypath
EUARE_URL environment variable is deprecated; use AWS_IAM_URL instead
Groups
# euare-userlistbypath
EUARE_URL environment variable is deprecated; use AWS_IAM_URL instead
arn:aws:iam::144711845746:user/admin
我已经尝试了所有我能想到的用户名、域\用户名、用户名@域的组合,但我仍然无法登录到 Eucalyptus 控制台。有什么建议么?
谢谢,丹