<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Andre,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">For OnDemand a requirement is that each authenticated user has their own separate system account. This is because web servers run as the user and assume they are running as the user (and acting on behalf of
the user). To implement this mapping, see <a href="https://osc.github.io/ood-documentation/master/authentication/overview.html">
https://osc.github.io/ood-documentation/master/authentication/overview.html</a> and in particular
<a href="https://osc.github.io/ood-documentation/master/authentication/overview/map-user.html">
https://osc.github.io/ood-documentation/master/authentication/overview/map-user.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">And <a href="https://osc.github.io/ood-documentation/master/infrastructure/ood-portal-generator/configuration.html#ood-portal-generator-configuration">
https://osc.github.io/ood-documentation/master/infrastructure/ood-portal-generator/configuration.html#ood-portal-generator-configuration</a> the user_map_cmd and user_env (which refers to the Apache named variable that will contain the information in that request
necessary for the user_map_cmd to produce a corresponding system user). If you modify the ood-portal-generator config you will need to run the ood-portal-generator script that re-generates the corresponding Apache config.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Note that user_map_cmd could be any shell script you deploy on the web node, so if you can’t use a regular expression and instead need to look up the corresponding system user for the given AD user in a database
or gridmap file this is an option: /opt/ood/ood_auth_map/bin/ood_auth_map.mapfile<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Here is a description of the grid-mapfile file:
<a href="http://toolkit.globus.org/toolkit/docs/2.4/gsi/grid-mapfile_v11.html">http://toolkit.globus.org/toolkit/docs/2.4/gsi/grid-mapfile_v11.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">></span> <span style="font-size:11.0pt">
The grid-mapfile file is plain text file, containing a quoted GSI Credential Name (the subject of an X509 certificate) and an unquoted local user name.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">For example, you could do use this script and having a map file have a line like:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">"john.smith" jsmith<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Assuming that jsmith was the system user corresponding to john.smith AD user.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Eric<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">---<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Eric Franz, Senior Web & Interface App Engineer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Ohio Supercomputer Center<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">An Ohio Technology Consortium (OH-TECH) Member<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">1224 Kinnear Road<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Columbus, OH 43212<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">email: efranz@osc.edu</span><span style="font-size:11.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">Andre Torres <andre.torres@ibmc.up.pt><br>
<b>Date: </b>Wednesday, October 10, 2018 at 11:49 AM<br>
<b>To: </b>"Franz, Eric" <efranz@osc.edu><br>
<b>Subject: </b>Re: [OOD-users] Dashboard not available for active directory accounts<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">I don’t have a system account named john.smith. Is it necessary to have a system account ? I think I can’t create a system account with the same name from an existing AD user.
</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">How can I map an AD user to a system account ?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Andre</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:9.0pt;font-family:Helvetica"><br>
<br>
<br>
</span></b><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">"Franz, Eric" <efranz@osc.edu><br>
<b>Date: </b>Wednesday, 10 October 2018 at 15:36<br>
<b>To: </b>Andre Torres <andre.torres@ibmc.up.pt>, User support mailing list for Open OnDemand <ood-users@lists.osc.edu><br>
<b>Subject: </b>Re: [OOD-users] Dashboard not available for active directory accounts</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">Andre,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Looks like that error is occurring here:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><a href="https://github.com/OSC/nginx_stage/blob/17a315d32849c77f038747ab8b2effae57a71d99/lib/nginx_stage/user.rb#L36">https://github.com/OSC/nginx_stage/blob/17a315d32849c77f038747ab8b2effae57a71d99/lib/nginx_stage/user.rb#L36</a></span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">The system user it is looking for is "john.smith" and Etc.getpwnam is likely raising an ArgumentError. Do you have a system account "john.smith" or is the logged in user "john.smith" meant to bew mapped to
a different system user like jsmith or john_smith etc.?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Eric</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">---</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Eric Franz, Senior Web & Interface App Engineer</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Ohio Supercomputer Center</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">An Ohio Technology Consortium (OH-TECH) Member</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">1224 Kinnear Road</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Columbus, OH 43212</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">email: efranz@osc.edu</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">OOD-users <ood-users-bounces+efranz=osc.edu@lists.osc.edu> on behalf of Andre Torres via OOD-users <ood-users@lists.osc.edu><br>
<b>Reply-To: </b>Andre Torres <andre.torres@ibmc.up.pt>, User support mailing list for Open OnDemand <ood-users@lists.osc.edu><br>
<b>Date: </b>Wednesday, October 10, 2018 at 7:36 AM<br>
<b>To: </b>"ood-users@lists.osc.edu" <ood-users@lists.osc.edu><br>
<b>Subject: </b>[OOD-users] Dashboard not available for active directory accounts</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">Hi,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have configured Active Directory authentication for ood, but when I login I receive the following message:</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Error -- user doesn't exist: john.smith</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">Run 'nginx_stage --help' to see a full list of available command line options.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I have the home dirs in an NFS share. Does anyone can help me ?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thanks in advance,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Andre</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</body>
</html>