Skip navigation
VMware
Up to Discussions in VI: VMware ESX™ 3.5

This Question is Answered

1 "correct" answer available (10 pts)
488 Views 8 Replies Last post: Aug 28, 2007 1:47 PM by sbeaver RSS
TheBigQ Novice
TheBigQ
18 posts since
Aug 28, 2007
Currently Being Moderated

Aug 28, 2007 12:39 PM

VIClient cannot access ESX 3.0.2 box using AD credenitals.

Hey all,

 

Using this guide:

 

http://www.vmware.com/vmtn/resources/582

 

I've got my ESX box to auth users against AD. The problem is, when I try to logon with the VI Client I get "Error Connecting - Permission to perform this operation was denied.". If I enter the wrong password, it says "login failed due to a bad username or password." so it seems able to work out who I am.

 

If I pick a user who I've not run "useradd" for I just got the "login failed" message again.

 

In the server messages I get:

 

Aug 28 15:37:48 server vmware-authd(pam_unix)\[1842]: authentication failure; logname= uid=0 euid=0 tty= ruser= rhost=  user=myaccount

Aug 28 15:37:49 server vmware-hostd\[1842]: pam_krb5: authentication succeeds for `myaccount

Aug 28 15:37:49 server vmware-hostd\[1842]: Accepted password for user myaccount from 1.2.3.4

 

Any ideas what else I need to do? NTP is running so the time is sync'd.

 

I tried adding the user account to the root group, but it still didn't work. I've seen other posts talk about adding it to the administrators/manager group but I know how as they don't seem to exist. Am I missing something?

 

Thanks!

cemetric Enthusiast
cemetric
63 posts since
Apr 16, 2007
Currently Being Moderated
1. Aug 28, 2007 12:49 PM in response to: TheBigQ
Re: VIClient cannot access ESX 3.0.2 box using AD credenitals.

You need to create a corresponding user with useradd apparently ...

 

Quote resource:

 

For every user that you want to enable access through authentication to

Active Directory, you must also create a corresponding user on the ESX Server system using the useradd command.

 

/Quote

 

 

That to me sounds like you need to create the user locally on ESX and on AD.

 

Haven't played with it yet though ...

 

C.

hicksj Master
hicksj
1,311 posts since
May 6, 2005
Currently Being Moderated
2. Aug 28, 2007 12:52 PM in response to: TheBigQ
Re: VIClient cannot access ESX 3.0.2 box using AD credenitals.

That will setup access for SSH sessions, but doesn't authorize the user to access the host via the VIC.

 

I used to have this setup so I could access the MUI in ESX2.5 using AD credentials.  The pam setup in ESX3 is different, and I've not had reason to provide this capability in ESX3, so haven't investigated further.  There's probably a small change that needs to be applied to /etc/pam.d/vmware-authd

TheBigQ Novice
TheBigQ
18 posts since
Aug 28, 2007
Currently Being Moderated
3. Aug 28, 2007 12:54 PM in response to: hicksj
Re: VIClient cannot access ESX 3.0.2 box using AD credenitals.

Ah, you are right. I had used "useradd" to add the user - whilst the VIClient still doesn't work, SSH access does.

 

I'll take a look at that file now.

hicksj Master
hicksj
1,311 posts since
May 6, 2005
Currently Being Moderated
4. Aug 28, 2007 1:03 PM in response to: TheBigQ
Re: VIClient cannot access ESX 3.0.2 box using AD credenitals.

Check out the posting here:

 

http://www.vmware.com/community/thread.jspa?messageID=635376&#635376

 

This provides pam changes that appear to work.  Note: I've not tested them, so cannot verify whether it works or possibly compromises security.

 

Message was edited by:

        hicksj

    Followup note:  Those are legacy settings, similar to what I did in ESX 2.5.  They may work, but there is probably a better way.

TheBigQ Novice
TheBigQ
18 posts since
Aug 28, 2007
Currently Being Moderated
5. Aug 28, 2007 1:05 PM in response to: hicksj
Re: VIClient cannot access ESX 3.0.2 box using AD credenitals.

Ok, got it! Using this link:

 

http://blog.baeke.info/blog/_archives/2006/10/13/2414173.html

 

If I go into the "permissions" tab in the VIClient, add my AD account as an administrator then it works.

 

Thanks for the amazingly quick responses though.

TheBigQ Novice
TheBigQ
18 posts since
Aug 28, 2007
Currently Being Moderated
6. Aug 28, 2007 1:06 PM in response to: TheBigQ
Re: VIClient cannot access ESX 3.0.2 box using AD credenitals.

As per my previous post - I can add my AD user in VIClient as an admin under the permissions tab and then it works.

hicksj Master
hicksj
1,311 posts since
May 6, 2005
Currently Being Moderated
7. Aug 28, 2007 1:07 PM in response to: TheBigQ
Re: VIClient cannot access ESX 3.0.2 box using AD credenitals.

Super!

 

Good to know.  Thanks.

sbeaver Guru User Moderators vExpert
sbeaver
7,830 posts since
Nov 1, 2004
Currently Being Moderated
8. Aug 28, 2007 1:47 PM in response to: hicksj
Re: VIClient cannot access ESX 3.0.2 box using AD credenitals.

The file in question is the authorization.xml which has the users that the VIclient will use to connect.  This list of users is different then the ones used for ssh

Steve Beaver VMware Communities User Moderator VMware vExpert 2009, 2010 and 2011 ==== Co-Author of "VMware ESX Essentials in the Virtual Data Center" (ISBN:1420070274) from Auerbach Come check out my blog: [www.virtualizationpractice.com/blog|http://www.virtualizationpractice.com/blog/] Come follow me on twitter http://www.twitter.com/sbeaver **Virtualization is a journey, not a project.**

Bookmarked By (0)

Share This Page

Communities