{"action":"created","issue":{"url":"https://api.github.com/repos/Metalnx/metalnx-web/issues/2","repository_url":"https://api.github.com/repos/Metalnx/metalnx-web","labels_url":"https://api.github.com/repos/Metalnx/metalnx-web/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/Metalnx/metalnx-web/issues/2/comments","events_url":"https://api.github.com/repos/Metalnx/metalnx-web/issues/2/events","html_url":"https://github.com/Metalnx/metalnx-web/issues/2","id":187677004,"number":2,"title":"Metalnx Authentication Error ","user":{"login":"ajguerra","id":19800995,"avatar_url":"https://avatars.githubusercontent.com/u/19800995?v=3","gravatar_id":"","url":"https://api.github.com/users/ajguerra","html_url":"https://github.com/ajguerra","followers_url":"https://api.github.com/users/ajguerra/followers","following_url":"https://api.github.com/users/ajguerra/following{/other_user}","gists_url":"https://api.github.com/users/ajguerra/gists{/gist_id}","starred_url":"https://api.github.com/users/ajguerra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajguerra/subscriptions","organizations_url":"https://api.github.com/users/ajguerra/orgs","repos_url":"https://api.github.com/users/ajguerra/repos","events_url":"https://api.github.com/users/ajguerra/events{/privacy}","received_events_url":"https://api.github.com/users/ajguerra/received_events","type":"User","site_admin":false},"labels":[{"id":388643681,"url":"https://api.github.com/repos/Metalnx/metalnx-web/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":{"login":"ajguerra","id":19800995,"avatar_url":"https://avatars.githubusercontent.com/u/19800995?v=3","gravatar_id":"","url":"https://api.github.com/users/ajguerra","html_url":"https://github.com/ajguerra","followers_url":"https://api.github.com/users/ajguerra/followers","following_url":"https://api.github.com/users/ajguerra/following{/other_user}","gists_url":"https://api.github.com/users/ajguerra/gists{/gist_id}","starred_url":"https://api.github.com/users/ajguerra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajguerra/subscriptions","organizations_url":"https://api.github.com/users/ajguerra/orgs","repos_url":"https://api.github.com/users/ajguerra/repos","events_url":"https://api.github.com/users/ajguerra/events{/privacy}","received_events_url":"https://api.github.com/users/ajguerra/received_events","type":"User","site_admin":false},"assignees":[{"login":"ajguerra","id":19800995,"avatar_url":"https://avatars.githubusercontent.com/u/19800995?v=3","gravatar_id":"","url":"https://api.github.com/users/ajguerra","html_url":"https://github.com/ajguerra","followers_url":"https://api.github.com/users/ajguerra/followers","following_url":"https://api.github.com/users/ajguerra/following{/other_user}","gists_url":"https://api.github.com/users/ajguerra/gists{/gist_id}","starred_url":"https://api.github.com/users/ajguerra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajguerra/subscriptions","organizations_url":"https://api.github.com/users/ajguerra/orgs","repos_url":"https://api.github.com/users/ajguerra/repos","events_url":"https://api.github.com/users/ajguerra/events{/privacy}","received_events_url":"https://api.github.com/users/ajguerra/received_events","type":"User","site_admin":false},{"login":"ngmenyen","id":22937391,"avatar_url":"https://avatars.githubusercontent.com/u/22937391?v=3","gravatar_id":"","url":"https://api.github.com/users/ngmenyen","html_url":"https://github.com/ngmenyen","followers_url":"https://api.github.com/users/ngmenyen/followers","following_url":"https://api.github.com/users/ngmenyen/following{/other_user}","gists_url":"https://api.github.com/users/ngmenyen/gists{/gist_id}","starred_url":"https://api.github.com/users/ngmenyen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ngmenyen/subscriptions","organizations_url":"https://api.github.com/users/ngmenyen/orgs","repos_url":"https://api.github.com/users/ngmenyen/repos","events_url":"https://api.github.com/users/ngmenyen/events{/privacy}","received_events_url":"https://api.github.com/users/ngmenyen/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/Metalnx/metalnx-web/milestones/1","html_url":"https://github.com/Metalnx/metalnx-web/milestone/1","labels_url":"https://api.github.com/repos/Metalnx/metalnx-web/milestones/1/labels","id":2118501,"number":1,"title":"1.1","description":null,"creator":{"login":"ajguerra","id":19800995,"avatar_url":"https://avatars.githubusercontent.com/u/19800995?v=3","gravatar_id":"","url":"https://api.github.com/users/ajguerra","html_url":"https://github.com/ajguerra","followers_url":"https://api.github.com/users/ajguerra/followers","following_url":"https://api.github.com/users/ajguerra/following{/other_user}","gists_url":"https://api.github.com/users/ajguerra/gists{/gist_id}","starred_url":"https://api.github.com/users/ajguerra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajguerra/subscriptions","organizations_url":"https://api.github.com/users/ajguerra/orgs","repos_url":"https://api.github.com/users/ajguerra/repos","events_url":"https://api.github.com/users/ajguerra/events{/privacy}","received_events_url":"https://api.github.com/users/ajguerra/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":0,"state":"open","created_at":"2016-11-07T10:07:09Z","updated_at":"2016-11-24T11:35:07Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2016-11-07T10:37:28Z","updated_at":"2016-12-14T18:22:50Z","closed_at":null,"body":"When you start up Metalnx for the first time, you see an authentication error like this:\r\n\r\n![metalnx-web-ui-invalid-username](https://cloud.githubusercontent.com/assets/19800995/20054174/d6a64a02-a4c2-11e6-80ae-db2a78497ad5.jpg)\r\n\r\nFirst, double check your *username* and *password*. You might have a typo in one of those two fields that is causing the error.\r\n\r\nIf your credentials seem to be correct, there is also a change that your database is not accessible by the Metalnx UI. Either the firewall is blocking access, you typed the wrong database credentials when you run the setup script or even the database itself is not allowing Metalnx to open up a connection.\r\n\r\nIf you have a similiar problem, please check our document on [How to Configure the Metalnx Database](https://github.com/Metalnx/metalnx-web/blob/revision1/docs/INSTALL.md#config_metalnx_database). We have updated it to explain in more details what has to be done to configure the DB properly. Also, check the [Accessing Metalnx](https://github.com/Metalnx/metalnx-web/blob/revision1/docs/INSTALL.md#accessing_metalnx) section for other important details about DB credentials."},"comment":{"url":"https://api.github.com/repos/Metalnx/metalnx-web/issues/comments/267113186","html_url":"https://github.com/Metalnx/metalnx-web/issues/2#issuecomment-267113186","issue_url":"https://api.github.com/repos/Metalnx/metalnx-web/issues/2","id":267113186,"user":{"login":"ajguerra","id":19800995,"avatar_url":"https://avatars.githubusercontent.com/u/19800995?v=3","gravatar_id":"","url":"https://api.github.com/users/ajguerra","html_url":"https://github.com/ajguerra","followers_url":"https://api.github.com/users/ajguerra/followers","following_url":"https://api.github.com/users/ajguerra/following{/other_user}","gists_url":"https://api.github.com/users/ajguerra/gists{/gist_id}","starred_url":"https://api.github.com/users/ajguerra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ajguerra/subscriptions","organizations_url":"https://api.github.com/users/ajguerra/orgs","repos_url":"https://api.github.com/users/ajguerra/repos","events_url":"https://api.github.com/users/ajguerra/events{/privacy}","received_events_url":"https://api.github.com/users/ajguerra/received_events","type":"User","site_admin":false},"created_at":"2016-12-14T18:22:50Z","updated_at":"2016-12-14T18:22:50Z","body":"@felipegutierrez I managed to authenticate myself to iRODS using the test connection `jar` file. \r\n\r\nIt is not very straightforward to set up PAM authentication in iRODS. So, make sure you have it really operational. There are some greate resources you can check out:\r\n\r\n[SSL and PAM - UGM 2016](http://slides.com/irods/ugm2016-ssl-and-pam#/)\r\n[Setting up iRODS - PAM Authentication](http://slides.com/irods/irods-pam#/)\r\n[iRODS Pam Documentation](https://docs.irods.org/4.1.8/manual/authentication/#pam)\r\n\r\nI'll write down all I had to do to make it work and how my config files look like.\r\n\r\nFirst, I created a unix user *arthur* with password *arthur* by running:\r\n\r\n       $ sudo useradd arthur\r\n       $ sudo passwd arthur\r\n\r\n*arthur* will be the user I will use to authenticate in iRODS.\r\n\r\n## iRODS configuration\r\n\r\nThis user still needs to be added to the iRODS database. I did that by running\r\n\r\n        $ iadmin mkuser arthur rodsuser\r\n\r\nI also changed the `irods_environment.json` file. I added the following line:\r\n\r\n       \"irods_authentication_scheme\": \"PAM\"\r\n\r\niRODS comes with a tool used for testing basic PAM authentication. You can run it to check if you are able to authenticate:\r\n\r\n       iRODS/server/bin/PamAuthCheck arthur\r\n\r\n*Note that this program waits for you to type the password without any prompt. So, after running the command above ensure that you type your password correctly*. This tool returns `Authenticated` or `Not Authenticated`.\r\n\r\n### iRODS PAM file\r\n\r\nNext, I had to configure the iRODS PAM file. To do that, I created a file in **/etc/pam.d/** named **irods**. \r\n\r\n       sudo su - root -c 'echo \"auth sufficient pam_unix.so\" > /etc/pam.d/irods' \r\n\r\nIn this case, I used the `pam_unix.so` module for traditional password authentication.\r\n\r\nDouble checking...\r\n\r\n       $ cat /etc/pam.d/irods\r\n\t   auth sufficient pam_unix.so\r\n\r\n### Certificates\r\n\r\nAfter setting up the PAM file. It is time to work with certificates. I placed both my certifcate and secret key in **/etc/irods/ssl**.\r\n        \r\n       $ mkdir /etc/irods/ssl\r\n       $ cd /etc/irods/ssl\r\n       $ openssl genrsa -out server.key                                     # generate an RSA key\r\n       $ openssl req -new -x509 -key server.key -out server.crt -days 365   # Generate self-signed certificate\r\n\r\nThe steps above were used to create the private key and a self-signed certificate. The iRODS documentation recommends the creation of a chain file, but since we I did not have my certificate issued by a CA, I just renamed my `crt` file to `chain.pem` only for consistency.\r\n       \r\nThen, I generated Diffie-Hellman parameters:\r\n\r\n      $ openssl dhparam -2 -out dhparams.pem 2048\r\n\r\n*/etc/irods/ssl* shoud be:\r\n\r\n```\r\n$ ls -l /etc/irods/ssl\r\ntotal 12\r\n-rw-rw-r-- 1 irods irods 1277 Dec 13 01:48 chain.pem\r\n-rw-rw-r-- 1 irods irods  424 Dec 13 01:50 dhparams.pem\r\n-rw-rw-r-- 1 irods irods 1675 Dec 13 01:46 server.key\r\n```\r\n\r\n## irods_environment.json\r\n\r\nWith my certificate and private key ready, I modified the `irods_environment.json` file\r\n\r\n```\r\n{\r\n    \"irods_host\": \"tpa-eld6020\",\r\n    \"irods_port\": 1247,\r\n    \"irods_default_resource\": \"demoResc\",\r\n    \"irods_home\": \"/pamZone/home/arthur\",\r\n    \"irods_cwd\": \"/pamZone/home/arthur\",\r\n    \"irods_user_name\": \"arthur\",\r\n    \"irods_zone_name\": \"pamZone\",\r\n    \"irods_authentication_scheme\": \"PAM\",\r\n    \"irods_client_server_negotiation\": \"request_server_negotiation\",\r\n    \"irods_client_server_policy\": \"CS_NEG_REQUIRE\",\r\n    \"irods_encryption_key_size\": 32,\r\n    \"irods_encryption_salt_size\": 8,\r\n    \"irods_encryption_num_hash_rounds\": 16,\r\n    \"irods_encryption_algorithm\": \"AES-256-CBC\",\r\n    \"irods_default_hash_scheme\": \"SHA256\",\r\n    \"irods_match_hash_policy\": \"compatible\",\r\n    \"irods_server_control_plane_port\": 1248,\r\n    \"irods_server_control_plane_key\": \"TEMPORARY__32byte_ctrl_plane_key\",\r\n    \"irods_server_control_plane_encryption_num_hash_rounds\": 16,\r\n    \"irods_server_control_plane_encryption_algorithm\": \"AES-256-CBC\",\r\n    \"irods_maximum_size_for_single_buffer_in_megabytes\": 32,\r\n    \"irods_default_number_of_transfer_threads\": 4,\r\n    \"irods_transfer_buffer_size_for_parallel_transfer_in_megabytes\": 4,\r\n    \"irods_ssl_certificate_chain_file\": \"/etc/irods/ssl/chain.pem\",\r\n    \"irods_ssl_certificate_key_file\": \"/etc/irods/ssl/server.key\",\r\n    \"irods_ssl_dh_params_file\": \"/etc/irods/ssl/dhparams.pem\",\r\n    \"irods_ssl_ca_certificate_file\": \"/etc/irods/ssl/chain.pem\"\r\n}\r\n```\r\n\r\nRestart the iRODS service:\r\n\r\n    ./iRODS/irodsctl restart\r\n\r\n## Log in iRODS\r\n\r\nAfter all that configuration, I tried to iinit a new session in iRODS as *arthur*:\r\n\r\n\t$ iinit \r\n\tEnter your current PAM password:\r\n\t$ ils\r\n\t/pamZone/home/arthur\r\n\t\r\nIf you are able to log in, that's great.\r\n\r\n## Java\r\n\r\nNow, you need to make the Metalnx test connection `jar` work with PAM. Since Metalnx test connection is developed in Java, we need to tell the JVM to trust our certifcate. ***I think that is the part you are missing***.\r\n\r\nI did that by running the following command:\r\n\r\n\tkeytool -import -alias irodscertificate -file /etc/irods/ssl/chain.pem -keystore irodskeystore\r\n\r\nThe command above will create a keystore called *irodskeystore*. This keystore is trusted by Java. From now on, we just need to specify where this keystore in order for the Metalnx test connection work.\r\n\r\nYou can do that by running `java -jar` command with the `-Djavax.net.ssl.trustStore` parameter.\r\n\r\n\tjava -Djavax.net.ssl.trustStore=path/to/irodskeystore -jar metalnx-test-connection.jar tpa-eld6020 1247 arthur arthur pamZone PAM\r\n\r\n![pam_metalnx-test-connection](https://cloud.githubusercontent.com/assets/19800995/21193933/30bba4aa-c215-11e6-9cc3-02a95a5c13d4.jpg)\r\n![pam_metalnx-test-connection2](https://cloud.githubusercontent.com/assets/19800995/21193935/3273d024-c215-11e6-99c8-53786ebe472a.jpg)\r\n\r\n"}}
{"actor":{"display_login":"ajguerra"}}