<br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Nov 20, 2012 at 8:36 AM, Yair Zaslavsky <span dir="ltr"><<a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="im"><br>
<br>
On 11/20/2012 12:39 AM, Cristian Falcas wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="im">
<br>
<br>
On Mon, Nov 19, 2012 at 10:53 PM, Itamar Heim <<a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a><br></div><div class="im">
<mailto:<a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a>>> wrote:<br>
<br>
On 11/19/2012 11:29 AM, Vinzenz Feenstra wrote:<br>
<br>
On 11/19/2012 10:01 AM, Cristian Falcas wrote:<br>
<br>
Hi,<br>
<br>
I'm trying to add some users to ovirt using an AD.<br>
<br>
This is the configuration I used for a mediawiki site, which is<br>
working correctly:<br>
$wgAuth = new LdapAuthenticationPlugin();<br>
$wgLDAPUseLocal = true;<br>
$wgLDAPDomainNames = array( "a_domain");<br>
$wgLDAPServerNames = array( "a_domain"=>"<a href="http://site.example.com" target="_blank">site.example.com</a><br>
<<a href="http://site.example.com" target="_blank">http://site.example.com</a>><br>
<<a href="http://site.example.com" target="_blank">http://site.example.com</a>>");<br>
<br>
$wgLDAPEncryptionType = array( "a_domain"=>"clear");<br>
$wgLDAPSearchStrings = array(<br></div>
"a_domain"=>"rom_domain\\USER-<u></u>__NAME");<br>
$wgLDAPBaseDNs = array( "a_domain"=>"dc=company,dc=__<u></u>com");<div class="im"><br>
<br>
Those are the commands I tried using:<br>
engine-manage-domains -action=add -domain=<a href="http://site.example.com" target="_blank">site.example.com</a><br>
<<a href="http://site.example.com" target="_blank">http://site.example.com</a>><br>
<<a href="http://site.example.com" target="_blank">http://site.example.com</a>> -provider=ActiveDirectory<br>
-user=<a href="http://user.name" target="_blank">user.name</a> <<a href="http://user.name" target="_blank">http://user.name</a>><br>
<<a href="http://user.name" target="_blank">http://user.name</a>> -interactive<br>
<br>
<br>
engine-manage-domains -action=add -domain=a_domain<br>
-provider=ActiveDirectory -user=<a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto:<a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a>><br></div>
<mailto:<a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><div class="im"><br>
<mailto:<a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a>><u></u>> -interactive<br>
<br>
<br>
engine-manage-domains -action=add -domain=a_domain<br></div>
-provider=ActiveDirectory -user=user.name@site.example._<u></u>_com<br>
<mailto:<a href="mailto:user.name@site.example.com" target="_blank">user.name@site.<u></u>example.com</a>><br>
<mailto:<a href="mailto:user.name@site." target="_blank">user.name@site.</a>__<a href="http://example.com" target="_blank">examp<u></u>le.com</a><div><div class="h5"><br>
<mailto:<a href="mailto:user.name@site.example.com" target="_blank">user.name@site.<u></u>example.com</a>>> -interactive<br>
<br>
<br>
You don't add an user this way. You add the domain. You have to<br>
pass the<br>
domain admin user and the domain admin password.<br>
<br>
<br>
any domain user will do, doesn't have to be an admin.<br>
what does the log say?<br>
<br>
<br>
Then you can use the domain within the engine. e.g. search<br>
users, add<br>
access rights for vms etc.<br>
Even login to the engine and assigning rights within the engine<br>
you can<br>
handle from the engine itself.<br>
<br>
Regards,<br>
<br>
And the output on all tries:<br>
Enter password:<br>
<br>
Error: Authentication Failed. Please verify the fully<br>
qualified domain<br>
name that is used for authentication is correct..<br>
Problematic domain<br>
is: domain_used_in_command<br>
Failure while applying Kerberos configuration. Details:<br>
Authentication<br>
Failed. Please verify the fully qualified domain name that<br>
is used for<br>
authentication is correct.<br>
<br>
Can someone help me with the correct parameters?<br>
<br>
<br>
Best regards,<br>
Cristian Falcas<br>
<br>
<br></div></div>
______________________________<u></u>___________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto:<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a>><br>
<a href="http://lists.ovirt.org/__mailman/listinfo/users" target="_blank">http://lists.ovirt.org/__<u></u>mailman/listinfo/users</a><div class="im"><br>
<<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/<u></u>mailman/listinfo/users</a>><br>
<br>
<br>
<br>
--<br>
Regards,<br>
<br>
Vinzenz Feenstra | Senior Software Engineer<br>
RedHat Engineering Virtualization R & D<br></div>
Phone: <a href="tel:%2B420%20532%20294%20625" value="+420532294625" target="_blank">+420 532 294 625</a> <tel:%2B420%20532%20294%20625><div class="im"><br>
IRC: vfeenstr or evilissimo<br>
<br>
Better technology. Faster innovation. Powered by community<br>
collaboration.<br></div>
See how it works at <a href="http://redhat.com" target="_blank">redhat.com</a> <<a href="http://redhat.com" target="_blank">http://redhat.com</a>><br>
<br>
<br>
<br>
______________________________<u></u>___________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto:<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a>><br>
<a href="http://lists.ovirt.org/__mailman/listinfo/users" target="_blank">http://lists.ovirt.org/__<u></u>mailman/listinfo/users</a><br>
<<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/<u></u>mailman/listinfo/users</a>><br>
<br>
<br>
<br>
______________________________<u></u>___________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto:<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a>><br>
<a href="http://lists.ovirt.org/__mailman/listinfo/users" target="_blank">http://lists.ovirt.org/__<u></u>mailman/listinfo/users</a><div class="im"><br>
<<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/<u></u>mailman/listinfo/users</a>><br>
<br>
<br>
<br>
<br>
Hi,<br>
<br>
This is the command I used (the same error is with -interactive parameter):<br>
<br>
engine-manage-domains -action=add -domain=<a href="http://example.com" target="_blank">example.com</a><br></div>
<<a href="http://example.com" target="_blank">http://example.com</a>> -provider=ActiveDirectory -user=user.name@a_domain<div class="im"><br>
-passwordFile=/tmp/pass<br>
<br>
[root@localhost ~]# cat /tmp/pass<br>
qwerty[root@localhost ~]#<br>
<br>
This is the log:<br>
<br>
2012-11-20 00:30:40,443 INFO<br>
[org.ovirt.engine.core.utils.<u></u>kerberos.ManageDomains] Creating kerberos<br></div>
configuration for domain(s): <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>><div class="im"><br>
2012-11-20 00:30:40,525 INFO<br>
[org.ovirt.engine.core.utils.<u></u>kerberos.ManageDomains] Successfully<br>
created kerberos configuration for domain(s): <a href="http://example.com" target="_blank">example.com</a><br></div>
<<a href="http://example.com" target="_blank">http://example.com</a>><div class="im"><br>
2012-11-20 00:30:40,526 INFO<br>
[org.ovirt.engine.core.utils.<u></u>kerberos.ManageDomains] Testing kerberos<br></div>
configuration for domain: <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>><div class="im"><br>
2012-11-20 00:30:40,830 ERROR<br>
[org.ovirt.engine.core.utils.<u></u>kerberos.KerberosConfigCheck] Error:<br>
exception message: Cannot locate KDC<br>
2012-11-20 00:30:40,851 ERROR<br>
[org.ovirt.engine.core.utils.<u></u>kerberos.ManageDomains] Failure while<br></div>
testing domain <a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>>. Details: Kerberos<div class="im"><br>
error. Please check log for further details.<br>
<br>
</div></blockquote>
<br>
Hi, the error indicates you don't have kerberos configured.<br>
manage-domains validates by default using GSSAPI/Kerberos (if I understand correctly, this is equivalent to run ldapsearch with -Y gssapi option).<br>
I wonder if -x (simple authentication) will work for you as well (as manage-domains contains code for simple authentication as well).<div class="im"><br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
This is the ldapsearch command that works (it retrieves users) from the<br>
same machine:<br>
</blockquote>
<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
ldapsearch -H ldap://<a href="http://example.com" target="_blank">example.com</a> <<a href="http://example.com" target="_blank">http://example.com</a>> -b<div class="im"><br>
dc=example,dc=com -D user.name@a_domain -w qwerty<br>
<br>
<br>
Best regards,<br>
Cristian Falcas<br>
<br>
<br>
<br></div><div class="im">
______________________________<u></u>_________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/<u></u>mailman/listinfo/users</a><br>
<br>
</div></blockquote>
</blockquote></div><br><br><br>Hi,<br><br>I used "-x" for ldapsearch and the result is the same: list retrieved. Is there any equivalent for engine-manage-domains?<br><br>Cristian.<br></div>