<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: Times New Roman; font-size: 12pt; color: #000000'>Hello,<div><br></div><div>I've recently configured a new virtual machine host running Ubuntu 12.04 server with libvirt and KVM. I am configuring WebVirtMgr (<a href="https://github.com/retspen/webvirtmgr/">https://github.com/retspen/webvirtmgr/</a>) for users to manage machines via a web interface. This requires access to the host using qemu+tcp, which I have configured as follows:<br><div><br></div><div><div>/etc/default/libvirt-bin:</div><div>start_libvirtd="yes"</div><div>libvirtd_opts="-d -l"</div></div><div><br></div><div><div>/etc/libvirt/libvirtd.conf:</div><div>listen_tls = 0</div><div>listen_tcp = 1</div><div>unix_sock_group = "libvirtd"</div><div>unix_sock_rw_perms = "0770"</div><div>auth_unix_ro = "none"</div><div>auth_unix_rw = "none"</div><div>auth_tcp = "sasl"</div></div><div><br></div></div><div>The libvirt documentation (<a href="http://libvirt.org/auth.html" style="font-size: 12pt; ">http://libvirt.org/auth.html</a>) does not specify if it is possible to use SASL with a different authentication method other than DIGEST-MD5. I would like to authenticate users via LDAP - is this possible? I configured LDAP authentication via SASL as follows:</div><div><div>/etc/sasl2/libvirt.conf </div><div>pwcheck_method: saslauthd</div><div>mech_list: PLAIN LOGIN</div><div>log_level: 5</div><div>saslauthd_path: /var/run/saslauthd/mux</div><div>auxprop_plugin: ldap</div></div><div><br></div><div><div>/etc/saslauthd.conf </div><div>ldap_servers: ldap://ldap_ip_addr:389/</div><div>ldap_search_base: ou=People,dc=x-es,dc=com</div><div>ldap_auth_method: none</div><div>ldap_filter: uid=%u</div><div>ldap_version: 3</div></div><div><br></div><div><div>/etc/default/saslauthd </div><div>START=yes</div><div>DESC="SASL Authentication Daemon"</div><div>NAME="saslauthd"</div><div>MECHANISMS="ldap"</div><div>MECH_OPTIONS=""</div><div>THREADS=5</div><div>OPTIONS="-O /etc/saslauthd.conf -c -m /var/run/saslauthd -r"</div></div><div><br></div><div>Testing the configuration works:</div><div><div># testsaslauthd -u myuser -p mypass</div><div>0: OK "Success."</div></div><div><br></div><div>However, if I attempt to connect over the libvirt TCP connection I am denied:</div><div><div>virsh -c qemu+tcp://my_vm_host/system nodeinfo</div><div>error: authentication failed: Failed to start SASL negotiation: -4 (SASL(-4): no mechanism available: )</div><div>error: failed to connect to the hypervisor</div></div><div><br></div><div>Do you know what is incorrect in my libvirt config, or is it not possible to authenticate libvirt via SASL+LDAP? If not, is there somewhere that documents all of the supported mechanisms?</div><div><br></div><div>Thanks,</div><div><br></div><div>Andrew Martin</div><div><br></div><div><br></div><div><br></div></div></body></html>