<div dir="ltr"><div><div>SSO configuration looks good. <br><br></div>Can you please share any additional httpd configuration in /etc/httpd/conf.d. Anything to do with LocationMatch for ovirt-engine urls.<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 14, 2016 at 12:52 PM, Yaniv Kaul <span dir="ltr">&lt;<a href="mailto:ykaul@redhat.com" target="_blank">ykaul@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote"><span class="">On Fri, Oct 14, 2016 at 3:50 PM, Ravi Nori <span dir="ltr">&lt;<a href="mailto:rnori@redhat.com" target="_blank">rnori@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><div><div>Hi Yaniv,<br><br></div>Can you check the output of https:://&lt;engine&gt;/ovirt-engine<wbr>/sso/status in your browser and see if the SSO service is active.<br><br></div>If SSO is deployed, you should see an output similar to the one below. Also are you able to login to webadmin using the browser? <br></div></div></div></blockquote><div><br></div></span><div>I am able to login using the webui.</div><span class=""><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><br>{&quot;status_description&quot;:&quot;SSO Webapp Deployed&quot;,&quot;version&quot;:&quot;0&quot;,&quot;statu<wbr>s&quot;:&quot;active&quot;}<br></div></div></div></blockquote><div><br></div></span><div>Indeed:</div><span class=""><div>{&quot;status_description&quot;:&quot;SSO Webapp Deployed&quot;,&quot;version&quot;:&quot;0&quot;,&quot;<wbr>status&quot;:&quot;active&quot;}</div><div><br></div></span><div>(not sure what &#39;version 0&#39; means?)</div><span class=""><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div><br></div><div>Please share the content of /etc/ovirt-engine/engine.conf.<wbr>d/11-setup-sso.conf<br></div></div></div></blockquote><div><br></div></span><div><div>[root@lago-basic-suite-master-<wbr>engine ~]# cat /etc/ovirt-engine/engine.conf.<wbr>d/11-setup-sso.conf</div><div>ENGINE_SSO_CLIENT_ID=&quot;ovirt-<wbr>engine-core&quot;</div><div>ENGINE_SSO_CLIENT_SECRET=&quot;<wbr>bsOabtD7gE2McwLe80P109UV800XLx<wbr>4O&quot;</div><div>ENGINE_SSO_AUTH_URL=&quot;https://$<wbr>{ENGINE_FQDN}:443/ovirt-<wbr>engine/sso&quot;</div><div>ENGINE_SSO_SERVICE_URL=&quot;<a href="https://localhost:443/ovirt-engine/sso" target="_blank">https:<wbr>//localhost:443/ovirt-engine/<wbr>sso</a>&quot;</div><div>ENGINE_SSO_SERVICE_SSL_VERIFY_<wbr>HOST=false</div><div>ENGINE_SSO_SERVICE_SSL_VERIFY_<wbr>CHAIN=true</div><div>SSO_ALTERNATE_ENGINE_FQDNS=&quot;&quot;</div><div>SSO_ENGINE_URL=&quot;https://${<wbr>ENGINE_FQDN}:443/ovirt-engine/<wbr>&quot;</div></div><div><br></div><div><br></div><div>Thanks,</div><div>Y.</div><div><div class="h5"><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div><div></div><div><br></div>Thanks<span class="m_6323900716440045668gmail-HOEnZb"><font color="#888888"><br><br></font></span></div><span class="m_6323900716440045668gmail-HOEnZb"><font color="#888888">Ravi<br><div><div><pre><br><br></pre><br></div></div></font></span></div><div class="m_6323900716440045668gmail-HOEnZb"><div class="m_6323900716440045668gmail-h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Oct 14, 2016 at 7:57 AM, Juan Hernández <span dir="ltr">&lt;<a href="mailto:jhernand@redhat.com" target="_blank">jhernand@redhat.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span>On 10/14/2016 01:45 PM, Yaniv Kaul wrote:<br>
&gt;<br>
&gt;<br>
&gt; On Thu, Oct 13, 2016 at 11:13 AM, Juan Hernández &lt;<a href="mailto:jhernand@redhat.com" target="_blank">jhernand@redhat.com</a><br>
</span><span>&gt; &lt;mailto:<a href="mailto:jhernand@redhat.com" target="_blank">jhernand@redhat.com</a>&gt;&gt; wrote:<br>
&gt;<br>
&gt;     On 10/13/2016 12:04 AM, Yaniv Kaul wrote:<br>
&gt;     &gt; On Fri, Oct 7, 2016 at 10:44 PM, Yaniv Kaul &lt;<a href="mailto:ykaul@redhat.com" target="_blank">ykaul@redhat.com</a> &lt;mailto:<a href="mailto:ykaul@redhat.com" target="_blank">ykaul@redhat.com</a>&gt;<br>
</span><div><div class="m_6323900716440045668gmail-m_5133641475417152862h5">&gt;     &gt; &lt;mailto:<a href="mailto:ykaul@redhat.com" target="_blank">ykaul@redhat.com</a> &lt;mailto:<a href="mailto:ykaul@redhat.com" target="_blank">ykaul@redhat.com</a>&gt;&gt;&gt; wrote:<br>
&gt;     &gt;<br>
&gt;     &gt;     I&#39;m trying on FC24, using<br>
&gt;     &gt;<br>
&gt;      python-ovirt-engine-sdk4-4.1.0<wbr>-0.0.20161003git056315d.fc24.x<wbr>86_64 to<br>
&gt;     &gt;     add a DC, and failing - against master. The client is unhappy:<br>
&gt;     &gt;     File<br>
&gt;     &gt;<br>
&gt;      &quot;/home/ykaul/ovirt-system-test<wbr>s/basic-suite-master/test-scen<wbr>arios/002_bootstrap.py&quot;,<br>
&gt;     &gt;     line 98, in add_dc4<br>
&gt;     &gt;         version=sdk4.types.Version(ma<wbr>jor=DC_VER_MAJ,minor=DC_VER_MI<wbr>N),<br>
&gt;     &gt;       File &quot;/usr/lib64/python2.7/site-pac<wbr>kages/ovirtsdk4/services.py&quot;,<br>
&gt;     &gt;     line 4347, in add<br>
&gt;     &gt;         response = self._connection.send(request)<br>
&gt;     &gt;       File &quot;/usr/lib64/python2.7/site-pac<wbr>kages/ovirtsdk4/__init__.py&quot;,<br>
&gt;     &gt;     line 276, in send<br>
&gt;     &gt;         return self.__send(request)<br>
&gt;     &gt;       File &quot;/usr/lib64/python2.7/site-pac<wbr>kages/ovirtsdk4/__init__.py&quot;,<br>
&gt;     &gt;     line 298, in __send<br>
&gt;     &gt;         self._sso_token = self._get_access_token()<br>
&gt;     &gt;       File &quot;/usr/lib64/python2.7/site-pac<wbr>kages/ovirtsdk4/__init__.py&quot;,<br>
&gt;     &gt;     line 460, in _get_access_token<br>
&gt;     &gt;         sso_response = self._get_sso_response(self._s<wbr>so_url,<br>
&gt;     post_data)<br>
&gt;     &gt;       File &quot;/usr/lib64/python2.7/site-pac<wbr>kages/ovirtsdk4/__init__.py&quot;,<br>
&gt;     &gt;     line 498, in _get_sso_response<br>
&gt;     &gt;         return json.loads(body_buf.getvalue()<wbr>.decode(&#39;utf-8&#39;))<br>
&gt;     &gt;       File &quot;/usr/lib64/python2.7/json/__i<wbr>nit__.py&quot;, line 339, in loads<br>
&gt;     &gt;         return _default_decoder.decode(s)<br>
&gt;     &gt;       File &quot;/usr/lib64/python2.7/json/dec<wbr>oder.py&quot;, line 364, in decode<br>
&gt;     &gt;         obj, end = self.raw_decode(s, idx=_w(s, 0).end())<br>
&gt;     &gt;       File &quot;/usr/lib64/python2.7/json/dec<wbr>oder.py&quot;, line 382, in<br>
&gt;     raw_decode<br>
&gt;     &gt;         raise ValueError(&quot;No JSON object could be decoded&quot;)<br>
&gt;     &gt;     ValueError: No JSON object could be decoded<br>
&gt;     &gt;<br>
&gt;     &gt;<br>
&gt;     &gt;     Surprisingly, I now can&#39;t find that RPM of this SDK in<br>
&gt;     &gt;     <a href="http://resources.ovirt.org" rel="noreferrer" target="_blank">resources.ovirt.org</a> &lt;<a href="http://resources.ovirt.org" rel="noreferrer" target="_blank">http://resources.ovirt.org</a>&gt;<br>
&gt;     &lt;<a href="http://resources.ovirt.org" rel="noreferrer" target="_blank">http://resources.ovirt.org</a>&gt; now.<br>
&gt;     &gt;<br>
&gt;     &gt;     I&#39;ve tried<br>
&gt;     &gt;     with<br>
&gt;     <a href="http://resources.ovirt.org/pub/ovirt-master-snapshot/rpm/fc24/x86_64/python-ovirt-engine-sdk4-4.0.0-0.1.20161004gitf94eeb5.fc24.x86_64.rpm" rel="noreferrer" target="_blank">http://resources.ovirt.org/pu<wbr>b/ovirt-master-snapshot/rpm/fc<wbr>24/x86_64/python-ovirt-engine-<wbr>sdk4-4.0.0-0.1.20161004gitf94e<wbr>eb5.fc24.x86_64.rpm</a><br>
&gt;     &lt;<a href="http://resources.ovirt.org/pub/ovirt-master-snapshot/rpm/fc24/x86_64/python-ovirt-engine-sdk4-4.0.0-0.1.20161004gitf94eeb5.fc24.x86_64.rpm" rel="noreferrer" target="_blank">http://resources.ovirt.org/p<wbr>ub/ovirt-master-snapshot/rpm/f<wbr>c24/x86_64/python-ovirt-engine<wbr>-sdk4-4.0.0-0.1.20161004gitf94<wbr>eeb5.fc24.x86_64.rpm</a>&gt;<br>
&gt;     &gt;<br>
&gt;      &lt;<a href="http://resources.ovirt.org/pub/ovirt-master-snapshot/rpm/fc24/x86_64/python-ovirt-engine-sdk4-4.0.0-0.1.20161004gitf94eeb5.fc24.x86_64.rpm" rel="noreferrer" target="_blank">http://resources.ovirt.org/pu<wbr>b/ovirt-master-snapshot/rpm/fc<wbr>24/x86_64/python-ovirt-engine-<wbr>sdk4-4.0.0-0.1.20161004gitf94e<wbr>eb5.fc24.x86_64.rpm</a><br>
&gt;     &lt;<a href="http://resources.ovirt.org/pub/ovirt-master-snapshot/rpm/fc24/x86_64/python-ovirt-engine-sdk4-4.0.0-0.1.20161004gitf94eeb5.fc24.x86_64.rpm" rel="noreferrer" target="_blank">http://resources.ovirt.org/p<wbr>ub/ovirt-master-snapshot/rpm/f<wbr>c24/x86_64/python-ovirt-engine<wbr>-sdk4-4.0.0-0.1.20161004gitf94<wbr>eeb5.fc24.x86_64.rpm</a>&gt;&gt;<br>
&gt;     &gt;<br>
&gt;     &gt;     - same result.<br>
&gt;     &gt;<br>
&gt;     &gt;     Did not see anything obvious on server or engine logs.<br>
&gt;     &gt;     The code:<br>
&gt;     &gt;     def add_dc4(api):<br>
&gt;     &gt;         nt.assert_true(api != None)<br>
&gt;     &gt;         dcs_service = api.system_service().data_cent<wbr>ers_service()<br>
&gt;     &gt;         nt.assert_true(<br>
&gt;     &gt;             dc = dcs_service.add(<br>
&gt;     &gt;                 sdk4.types.DataCenter(<br>
&gt;     &gt;                     name=DC_NAME4,<br>
&gt;     &gt;                     description=&#39;APIv4 DC&#39;,<br>
&gt;     &gt;                     local=False,<br>
&gt;     &gt;<br>
&gt;     &gt;     version=sdk4.types.Version(ma<wbr>jor=DC_VER_MAJ,minor=DC_VER_MI<wbr>N),<br>
&gt;     &gt;                 ),<br>
&gt;     &gt;             )<br>
&gt;     &gt;         )<br>
&gt;     &gt;<br>
&gt;     &gt;<br>
&gt;     &gt;     And the api object is from:<br>
&gt;     &gt;                 return sdk4.Connection(<br>
&gt;     &gt;                     url=url,<br>
&gt;     &gt;                     username=constants.ENGINE_USE<wbr>R,<br>
&gt;     &gt;<br>
&gt;      password=str(self.metadata[&#39;ov<wbr>irt-engine-password&#39;]),<br>
&gt;     &gt;                     insecure=True,<br>
&gt;     &gt;                     debug=True,<br>
&gt;     &gt;                 )<br>
&gt;     &gt;<br>
&gt;     &gt;<br>
&gt;     &gt; The clue is actually on the HTTPd logs:<br>
&gt;     &gt; 192.168.203.1 - - [12/Oct/2016:17:56:27 -0400] &quot;POST<br>
&gt;     &gt; /ovirt-engine/sso/oauth/token HTTP/1.1&quot; 404 74<br>
&gt;     &gt;<br>
&gt;     &gt; And indeed, from the deubg log:<br>
&gt;     &gt; begin captured logging &lt;&lt; --------------------\n<br>
&gt;     &gt; root: DEBUG: Trying 192.168.203.3...\n<br>
&gt;     &gt; root: DEBUG: Connected to 192.168.203.3 (192.168.203.3) port 443<br>
&gt;     (#0)\n<br>
&gt;     &gt; root: DEBUG: Initializing NSS with certpath: sql:/etc/pki/nssdb\n<br>
&gt;     &gt; root: DEBUG: skipping SSL peer certificate verification\n<br>
&gt;     &gt; root: DEBUG: ALPN/NPN, server did not agree to a protocol\n<br>
&gt;     &gt; root: DEBUG: SSL connection using<br>
&gt;     TLS_ECDHE_RSA_WITH_AES_128_GC<wbr>M_SHA256\n<br>
&gt;     &gt; root: DEBUG: Server certificate:\n<br>
&gt;     &gt; root: DEBUG: subject: CN=engine,O=Test,C=US\n<br>
&gt;     &gt; root: DEBUG: start date: Oct 11 21:55:29 2016 GMT\n<br>
&gt;     &gt; root: DEBUG: expire date: Sep 16 21:55:29 2021 GMT\n<br>
&gt;     &gt; root: DEBUG: common name: engine\nroot: DEBUG: issuer:<br>
&gt;     &gt; CN=engine.38998,O=Test,C=US\n<br>
&gt;     &gt; *root: DEBUG: POST /ovirt-engine/sso/oauth/token HTTP/1.1\n*<br>
&gt;     &gt; *root: DEBUG: Host: 192.168.203.3\n*<br>
&gt;     &gt; *root: DEBUG: User-Agent: PythonSDK/4.1.0a0\n*<br>
&gt;     &gt; *root: DEBUG: Accept: application/json\n*<br>
&gt;     &gt; *root: DEBUG: Content-Length: 78\n*<br>
&gt;     &gt; *root: DEBUG: Content-Type: application/x-www-form-urlenco<wbr>ded\nroot:<br>
&gt;     &gt; DEBUG:<br>
&gt;     &gt;<br>
&gt;     username=admin%40internal&amp;sco<wbr>pe=ovirt-app-api&amp;password=123&amp;<wbr>grant_type=password\n*<br>
&gt;     &gt; *root: DEBUG: upload completely sent off: 78 out of 78 bytes\n*<br>
&gt;     &gt; *root: DEBUG: HTTP/1.1 404 Not Found\n*<br>
&gt;     &gt; *root: DEBUG: Date: Wed, 12 Oct 2016 21:56:27 GMT\n*<br>
&gt;     &gt; *root: DEBUG: Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips\n*<br>
&gt;     &gt; *root: DEBUG: Content-Length: 74\n*<br>
&gt;     &gt; *root: DEBUG: Content-Type: text/html; charset=UTF-8\n*<br>
&gt;     &gt; *root: DEBUG: \n*<br>
&gt;     &gt; *root: DEBUG: &lt;html&gt;&lt;head&gt;&lt;title&gt;Error&lt;/titl<wbr>e&gt;&lt;/head&gt;&lt;body&gt;404 - Not<br>
&gt;     &gt; Found&lt;/body&gt;&lt;/html&gt;\n*<br>
&gt;     &gt; root: DEBUG: Connection #0 to host 192.168.203.3 left intact\n<br>
&gt;     &gt; --------------------- &gt;&gt; end captured logging<br>
&gt;     &gt;<br>
&gt;<br>
&gt;     That definitively looks like version 3 of the engine. Either that or<br>
&gt;     version 4 of the engine with web server configuration modified so that<br>
&gt;     the SSO doesn&#39;t work as expected.<br>
&gt;<br>
&gt;     What do you get if you run this against that server?<br>
&gt;<br>
&gt;<br>
&gt; Attached.<br>
&gt; Y.<br>
&gt;<br>
<br>
</div></div>OK, that is version 4.1 of the engine, so next question is why the SSO<br>
service is not responding. Do you see any message in<br>
/var/log/ovirt-engine/server.l<wbr>og about &quot;enginesso.war&quot; not being<br>
deployed? Did you do any modification to the<br>
/etc/httpd/conf.d/z-ovirt-engi<wbr>ne.conf file?<br>
<br>
Ravi, Martin, any idea of why the SSO service may not be working?<br>
<div class="m_6323900716440045668gmail-m_5133641475417152862HOEnZb"><div class="m_6323900716440045668gmail-m_5133641475417152862h5"><br>
&gt;<br>
&gt;<br>
&gt;       curl \<br>
&gt;       --verbose \<br>
&gt;       --insecure \<br>
&gt;       --request GET \<br>
&gt;       --user &quot;admin@internal:yourpassword&quot; \<br>
&gt;       --header &quot;Version: 4&quot; \<br>
&gt;       --header &quot;Accept: application/xml&quot; \<br>
&gt;       &quot;<a href="https://thatserver/ovirt-engine/api" rel="noreferrer" target="_blank">https://thatserver/ovirt-eng<wbr>ine/api</a><br>
&gt;     &lt;<a href="https://thatserver/ovirt-engine/api" rel="noreferrer" target="_blank">https://thatserver/ovirt-eng<wbr>ine/api</a>&gt;&quot;<br>
&gt;<br>
<br>
<br>
--<br>
Dirección Comercial: C/Jose Bardasano Baos, 9, Edif. Gorbea 3, planta<br>
3ºD, 28016 Madrid, Spain<br>
Inscrita en el Reg. Mercantil de Madrid – C.I.F. B82657941 - Red Hat S.L.<br>
</div></div></blockquote></div><br></div>
</div></div></blockquote></div></div></div><br></div></div>
</blockquote></div><br></div>