0

我正在尝试让 Active Directory 身份验证与 Eucalyptus 一起使用,但我无法使用配置的凭据登录控制台。我的 .lic 文件中有以下内容:

PROPERTY        authentication.ldap_integration_configuration   {
  "ldap-service":{
    "server-url":"ldap://<ldap-server-ip>:389",
    "auth-method":"simple",
    "user-auth-method":"simple",
    "auth-principal":"eucalyptus@mydomain",
    "auth-credentials":"{RSA/ECB/PKCS1Padding}oRv4cHzkJqBxqnT3S/w9tXAOAkrblaw/iGZtuXw4GWipcGbfthrthrDCt8U6P5G4re6eLd9hzcNYxPIdoNqEDeiWF9hfJB8Ndf1kEDV0xGXnzTHhI14F1DcaaasYMkvrqUqcefKrSmsGyg4JtcHF96kEtj3bhsdfsdfw3IpuRn0o4y2+iMoq+JkxOFogHuhGhtdMa7fsdfsdf232m0vOrFUeln5uI619yEFmoVtIsOZbF6tEJsM64GzSbtl0dOaSCdnHmOYeQ6ksfFcdmxz0/1QMOakHC+ntdGTZrO+83UQYGWue9IjKXP0dWTCpXNnp6+P6un+jY2cM25bR3uw==",
    "use-ssl":"false",
    "ignore-ssl-cert-validation":"true",
    "krb5-conf":"/etc/krb5.conf",
  },

  "sync":{
    "enable":"true",
    "auto":"true",
    "interval":"6000",
    "clean-deletion":"true",
  },

  "accounting-groups":{
    "base-dn":"OU=Eucalyptus,OU=Groups,MY_BASE_DN",
    "id-attribute":"cn",
    "member-attribute":"member",
    "member-item-type":"cn",
    "selection":{
        "filter":"(&(objectClass=group)(!(memberOf=*)))"
    }
  },

  "groups":{
    "base-dn":" OU=Sec Groups,MY_BASE_DN",
    "id-attribute":"cn",
    "member-attribute":"member",
    "member-item-type":"cn",
    "selection":{
        "filter":"(&(objectClass=group)(memberOf=*))",
    }
  },

  "users":{
    "base-dn":"MY_BASE_DN”,
    "id-attribute":"cn",
    "user-info-attributes":{
        "displayname":"Full name"
    },
    "selection":{
        "filter":"(&(objectClass=organizationalPerson)(objectClass=user))"
    }
  },
}

以及 LDAP 同步状态:

# euare-getldapsyncstatus
EUARE_URL environment variable is deprecated; use AWS_IAM_URL instead
SyncEnabled     true
InSync  false

在日志文件中,我看到以下内容:

Mon Dec 29 11:31:14 2014 ERROR [LdapSync:LDAP sync] User admin is reserved for Eucalyptus only. Sync will skip this user from LDAP.

我在accounting-groups base dn中添加了一个会计组,当我运行list命令时我看到了这个组:

# euare-accountlist
EUARE_URL environment variable is deprecated; use AWS_IAM_URL instead
(eucalyptus)blockstorage        886472098984
eucalyptus      144711845746
mygroup     752874470188

但是,没有出现该会计组的成员:

# euare-grouplistbypath
EUARE_URL environment variable is deprecated; use AWS_IAM_URL instead
Groups
# euare-userlistbypath
EUARE_URL environment variable is deprecated; use AWS_IAM_URL instead
arn:aws:iam::144711845746:user/admin

我已经尝试了所有我能想到的用户名、域\用户名、用户名@域的组合,但我仍然无法登录到 Eucalyptus 控制台。有什么建议么?

谢谢,丹

4

1 回答 1

0

好的,所以在回答我自己的问题时,它似乎正在工作。使用安装/配置期间创建的管理员登录凭据登录控制台后,我能够看到用户创建正确。我对 .lic 文件做了一个小调整,即我将 id-attribute 设置为使用 sAMAccountName 而不是 cn 来满足用户对其登录的期望。

"users":{
  "base-dn":"MY_BASE_DN”,
  "id-attribute":"sAMAccountName",
  "user-info-attributes":{
      "displayname":"Full name"
  },
  "selection":{
      "filter":"(&(objectClass=organizationalPerson)(objectClass=user))"
  }

另外,我在运行 euare-userlistbypath 时没有传入帐户名,即:

euare-userlistbypath --as-account mygroup

使用该帐户运行会按预期检索用户列表。

于 2014-12-30T13:30:11.660 回答