LDAP Authentication 3.2
The LDAP Authentication addon permits users to have the same credentials as in LDAP, so effectively centralizing authentication. Enabling it will let any correctly authenticated LDAP user to use OpenNebula.
This Addon uses the 'net/ldap' ruby library provided by the 'net-ldap' gem.
This Addon will not install any Ldap server or configure it in any way. It will not create, delete or modify any entry in the Ldap server it connects to. The only requirement is the ability to connect to an already running Ldap server and being able to perform a successful ldapbind operation and have a user able to perform searches of users, therefore no special attributes or values are required in the LDIF entry of the user authenticating.
Configuration file for auth module is located at
$ONE_LOCATION/etc/auth/ldap_auth.conf. This is the default configuration:
Name of the user that can query ldap. Do not set it if you can perform queries anonymously
Password for the user defined in
Can be set to
Host name of the ldap server
Port of the ldap server
Base leaf where to perform user searches
If set the users need to belong to this group
Field in ldap that holds the user name
ldap authentication the described parameters should be configured. OpenNebula must be also configured to enable external authentication. Uncomment these lines in
$ONE_LOCATION/etc/oned.conf and add
default (more on this later) as an enabled authentication method.
To be able to use this driver for users that are still not in the user database you must set it to the
default driver. To do this go to the auth drivers directory and symlink the directory
default. In system-wide installation you can do this using this command:
Using LDAP authentication module the administrator doesn't need to create users with
oneuser command as this will be automatically done. The user should add its credentials to
$ONE_AUTH file (usually
$HOME/.one/one_auth) in this fashion: