Hi Natxo, On Fri, 2012-11-30 at 13:06 +0100, Natxo Asenjo wrote: > hi, > > I'm following the howto on > http://freeipa.org/page/Libvirt_with_VNC_Consoles to authenticate > users voor virsh with ipa. > > I have it mostly working :-) except for the fact that libvirtd is not > respecting the sasl_allowed_username_list parameter. > > If I do not set it, and I have a realm ticket, then I may login virsh > or virtual manager and I get tickets for libvirt/vnc services. > > If I do set it, then it tells me the client is not in the whitelist, > so I cannot log in :-)

> 2012-11-30 12:00:53.403+0000: 7786: error : > virNetSASLContextCheckIdentity:146 : SASL client admin not allowed in > whitelist > 2012-11-30 12:00:53.403+0000: 7786: error : > virNetSASLContextCheckIdentity:150 : Client's username is not on the > list of allowed clients > 2012-11-30 12:00:53.403+0000: 7786: error : > remoteDispatchAuthSaslStep:2447 : authentication failed: > authentication failed > 2012-11-30 12:00:53.415+0000: 7781: error : virNetSocketReadWire:999 : > End of file while reading data: Input/output error > > Is this a question for the libvirt folks or is it ok to post it here? Seem more like a libvirt or maybe even a cyrus-sasl question but I would be interested in knowing what is going on. Have you used a full principal name including the realm in the list, or just the bare user names ?

hi, sasl_allowed_username_list = ["admin(a)IPA.EXAMPLE.COM" ] if I leave this field commented out (default setting), everybody can manage the kvm host.

>> > 2012-11-30 12:00:53.403+0000: 7786: error : >> > virNetSASLContextCheckIdentity:146 : SASL client admin not allowed in

On Fri, Nov 30, 2012 at 4:04 PM, Daniel P. Berrange <berrange(a)redhat.com&gt; wrote: > On Fri, Nov 30, 2012 at 03:56:14PM +0100, Natxo Asenjo wrote: >> hi, >> >> sasl_allowed_username_list = [&quot;admin(a)IPA.EXAMPLE.COM&quot; ] >> >> if I leave this field commented out (default setting), everybody can >> manage the kvm host. > > Oh it isn't very obvious, but in this log message: > >> >> > 2012-11-30 12:00:53.403+0000: 7786: error : >> >> > virNetSASLContextCheckIdentity:146 : SASL client admin not allowed in > > 'admin' is the identity being matched against. > > We ought to quote that string int he log message to make it more > obvious. > > So I guess SASL/GSSAPI is not giving us back the REALM, just > the username > > So you need to change your whitelist to leave out the realm. Bingo! Thanks. If I may just hijack this thread: is it possible to whitelist groups instead of individual users to use virsh/virtual manager? I know sasl only deals with the authentication stuff, buy here you are also authorizing in the whitelist. If this authorization could go further to allow ipa groups, that would be ideal from an admin point of view ;-)

On 11/30/2012 10:20 AM, Daniel P. Berrange wrote: > On Fri, Nov 30, 2012 at 04:16:56PM +0100, Natxo Asenjo wrote: >> On Fri, Nov 30, 2012 at 4:04 PM, Daniel P. Berrange <berrange(a)redhat.com&gt; wrote: >>> On Fri, Nov 30, 2012 at 03:56:14PM +0100, Natxo Asenjo wrote: >>>> hi, >>>> >>>> sasl_allowed_username_list = [&quot;admin(a)IPA.EXAMPLE.COM&quot; ] >>>> >>>> if I leave this field commented out (default setting), everybody can >>>> manage the kvm host. >>> Oh it isn't very obvious, but in this log message: >>> >>>>>>> 2012-11-30 12:00:53.403+0000: 7786: error : >>>>>>> virNetSASLContextCheckIdentity:146 : SASL client admin not allowed in >>> 'admin' is the identity being matched against. >>> >>> We ought to quote that string int he log message to make it more >>> obvious. >>> >>> So I guess SASL/GSSAPI is not giving us back the REALM, just >>> the username >>> >>> So you need to change your whitelist to leave out the realm. >> Bingo! >> >> Thanks. If I may just hijack this thread: is it possible to whitelist >> groups instead of individual users to use virsh/virtual manager? >> >> I know sasl only deals with the authentication stuff, buy here you are >> also authorizing in the whitelist. If this authorization could go >> further to allow ipa groups, that would be ideal from an admin point >> of view ;-) > It is desirable, but we don't have any way to find out information about > groups. The authorization problem is something we've yet to really get > a good pluggable solution for, though perhaps policykit would help here. > > Daniel Policy kit is local escalation to admin privileges. The policy kit policies are not centrally managed, they are preinstalled. Are you sure it is the right mechanism? Should there be some more centrally managed mechanism for access control rules like HBAC or SUDO?

On Fri, Nov 30, 2012 at 4:20 PM, Daniel P. Berrange <berrange(a)redhat.com&gt; wrote: > On Fri, Nov 30, 2012 at 04:16:56PM +0100, Natxo Asenjo wrote: >> Thanks. If I may just hijack this thread: is it possible to whitelist >> groups instead of individual users to use virsh/virtual manager? >> >> I know sasl only deals with the authentication stuff, buy here you are >> also authorizing in the whitelist. If this authorization could go >> further to allow ipa groups, that would be ideal from an admin point >> of view ;-) > > It is desirable, but we don't have any way to find out information about > groups. The authorization problem is something we've yet to really get > a good pluggable solution for, though perhaps policykit would help here. well, if I create a policykit policy like this: /etc/polkit-1/localauthority/50-local.d/50-libvirt-remote-access.pkla [libvirt Management Access] Identity=unix-group:libvirt Action=org.libvirt.unix.manage ResultAny=yes ResultInactive=yes ResultActive=yes and I create an ipa group, I can achieve in fact what I want. Members of the group may use virsh and if you have a kerberos ticket it is truly sso (I get a ticket from ssh, libvirt and vnc) with the original configuration (so no sasl, just using ssh).

Natxo it sounds odd that you are getting back a non fully qualified principal name, are you sure your configuration is using SASL/GSSAPI ? What other directives have you configured ?