Linux - RHV 整合 IdM 身份驗證

1
2
3

1. 具有 IdM 或是 Windows AD
2. 創建可以查詢的使用者為 rhvm ，密碼為 redhat123
3. 完整 bindDN 為 : uid=rhvm,cn=users,cn=accounts,dc=lab,dc=example,dc=com

1

ssh rhvm.lab.example.com

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

[root@rhvm ~]# ovirt-engine-extension-aaa-ldap-setup
...output omitted...
          Available LDAP implementations:
           1 - 389ds
           2 - 389ds RFC-2307 Schema
           3 - Active Directory
           4 - IBM Security Directory Server
           5 - IBM Security Directory Server RFC-2307 Schema
           6 - IPA
           7 - Novell eDirectory RFC-2307 Schema
           8 - OpenLDAP RFC-2307 Schema
           9 - OpenLDAP Standard Schema
          10 - Oracle Unified Directory RFC-2307 Schema
          11 - RFC-2307 Schema (Generic)
          12 - RHDS
          13 - RHDS RFC-2307 Schema
          14 - iPlanet
          Please select: 6
...output omitted...
          Use DNS (Yes, No) [Yes]:
          Available policy method:
           1 - Single server
           2 - DNS domain LDAP SRV record
           3 - Round-robin between multiple hosts
           4 - Failover between multiple hosts
          Please select: 1
          Please enter host address: utility.lab.example.com
[ INFO  ] Trying to resolve host 'utility.lab.example.com'
...output omitted...
          Please select protocol to use (startTLS, ldaps, plain) [startTLS]: URL
          URL: http://utility.lab.example.com/ipa/config/ca.crt
[ INFO  ] Connecting to LDAP using 'ldap://utility.lab.example.com:389'
[ INFO  ] Executing startTLS
[ INFO  ] Connection succeeded
          Enter search user DN (for example uid=username,dc=example,dc=com or leave empty for anonymous): uid=rhvm,cn=users,cn=accounts,dc=lab,dc=example,dc=com
          Enter search user password:
[ INFO  ] Attempting to bind using 'uid=rhvm,cn=users,cn=accounts,dc=lab,dc=example,dc=com'
          Please enter base DN (dc=lab,dc=example,dc=com) [dc=lab,dc=example,dc=com]:
          Are you going to use Single Sign-On for Virtual Machines (Yes, No) [Yes]: NO
          Please specify profile name that will be visible to users [utility.lab.example.com ]:
[ INFO  ] Stage: Setup validation
...output omitted...
          Please provide credentials to test login flow:
          Enter user name: rhvm
          Enter user password:
[ INFO  ] Executing login sequence...
          Login output:
...output omitted...
[ INFO  ] Login sequence executed successfully
          Please make sure that user details are correct and group membership meets expectations (search for PrincipalRecord and GroupRecord titles).
          Abort if output is incorrect.
          Select test sequence to execute (Done, Abort, Login, Search) [Done]:
...output omitted...
[ INFO  ] Stage: Pre-termination
[ INFO  ] Stage: Termination

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

1. 選擇 LDAP 認證方式 。
2. 選擇 DNS 是否使用 。
3. 選擇總類 。
4. 輸入 FQDN 使其查詢 。
5. 認證方式選擇 startTLS 。
6. 選擇透過 URL 驗證 。
7. CA URL http://utility.lab.example.com/ipa/config/ca.crt ，請注意不要添加到 https 會因為沒有添加過導致驗證不過。
8. bindDN 使用 :  uid=rhvm,cn=users,cn=accounts,dc=lab,dc=example,dc=com 來查詢，密碼為 `redhat123` 。
9. baseDN 使用預設值即可 。
10. 不開啟單點SSO登入 。
11. profile name 使用預設值即可 。
12. 使用 rhvm 使用者測試登入 。

1

systemctl restart ovirt-engine.service

1
2
3

帳號 : admin
密碼 : redhat
Profile : internal