<br><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Nov 21, 2012 at 8:10 AM, Itamar Heim <span dir="ltr"><<a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class=""><div class="h5">On 11/21/2012 08:09 AM, Oved Ourfalli wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
<br>
----- Original Message -----<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
From: "Cristian Falcas" <<a href="mailto:cristi.falcas@gmail.com" target="_blank">cristi.falcas@gmail.com</a>><br>
To: "Yair Zaslavsky" <<a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a>><br>
Cc: <a href="mailto:users@ovirt.org" target="_blank">users@ovirt.org</a><br>
Sent: Wednesday, November 21, 2012 6:40:34 AM<br>
Subject: Re: [Users] I don't know how to add AD users<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
On Wed, Nov 21, 2012 at 5:05 AM, Yair Zaslavsky < <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a><br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
wrote:<br>
</blockquote>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
From: "Cristian Falcas" < <a href="mailto:cristi.falcas@gmail.com" target="_blank">cristi.falcas@gmail.com</a> ><br>
To: "Itamar Heim" < <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> ><br>
Cc: "Yair Zaslavsky" < <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> >, <a href="mailto:users@ovirt.org" target="_blank">users@ovirt.org</a><br>
Sent: Tuesday, November 20, 2012 7:33:39 PM<br>
<br>
Subject: Re: [Users] I don't know how to add AD users<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
On Tue, Nov 20, 2012 at 3:08 PM, Itamar Heim < <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> ><br>
wrote:<br>
<br>
<br>
<br>
On 11/20/2012 03:00 PM, Cristian Falcas wrote:<br>
<br>
<br>
Hi,<br>
<br>
So there is no way to use the domain I have at work, right?<br>
<br>
I will need to make a freeipa installation in order to add new users.<br>
<br>
there is no reason this shouldn't work with active directory 2003<br>
(assuming its forest level isn't still in AD 2000 compatibility<br>
mode?).<br>
tcpdump for the traffic during engine-manage-domains should help<br>
diagnosing why.<br>
<br>
<br>
<br>
<br>
<br>
Cristian<br>
<br>
<br>
On Tue, Nov 20, 2012 at 10:11 AM, Cristian Falcas<br>
<br>
< <a href="mailto:cristi.falcas@gmail.com" target="_blank">cristi.falcas@gmail.com</a> <mailto: cristi.falcas@gmail. com >> wrote:<br>
<br>
<br>
<br>
<br>
On Tue, Nov 20, 2012 at 9:58 AM, Itamar Heim < <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a><br>
<br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> >> wrote:<br>
<br>
On 11/20/2012 09:56 AM, Cristian Falcas wrote:<br>
<br>
<br>
<br>
<br>
On Tue, Nov 20, 2012 at 9:42 AM, Yair Zaslavsky<br>
< <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> <mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> ><br>
<br>
<br>
<mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> <mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> >>><br>
wrote:<br>
<br>
<br>
<br>
On 11/20/2012 09:05 AM, Cristian Falcas wrote:<br>
<br>
<br>
<br>
<br>
On Tue, Nov 20, 2012 at 8:36 AM, Yair Zaslavsky<br>
< <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> <mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> ><br>
<mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> <mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> >><br>
<mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a><br>
<mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> > <mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a><br>
<mailto: <a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a> >>> > wrote:<br>
<br>
<br>
<br>
On 11/20/2012 12:39 AM, Cristian Falcas wrote:<br>
<br>
<br>
<br>
On Mon, Nov 19, 2012 at 10:53 PM, Itamar Heim<br>
< <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> <mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> ><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> <mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> >><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> > <mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> >>><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> > <mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> >><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> <mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> ><br>
<mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> <mailto: <a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a> >>>>> wrote:<br>
<br>
On 11/19/2012 11:29 AM, Vinzenz<br>
Feenstra wrote:<br>
<br>
On 11/19/2012 10:01 AM, Cristian<br>
Falcas wrote:<br>
<br>
Hi,<br>
<br>
I'm trying to add some users<br>
to ovirt<br>
using an AD.<br>
<br>
This is the configuration I<br>
used for a<br>
mediawiki<br>
site, which is<br>
working correctly:<br>
$wgAuth = new<br>
LdapAuthenticationPlugin();<br>
$wgLDAPUseLocal = true;<br>
$wgLDAPDomainNames = array(<br>
"a_domain");<br>
$wgLDAPServerNames = array(<br>
"a_domain"=>" <a href="http://site.example.com" target="_blank">site.example.com</a><br>
< <a href="http://site.example.com" target="_blank">http://site.example.com</a> > < <a href="http://site.example.com" target="_blank">http://site.example.com</a> ><br>
< <a href="http://site.example.com" target="_blank">http://site.example.com</a> ><br>
< <a href="http://site.example.com" target="_blank">http://site.example.com</a> ><br>
< <a href="http://site.example.com" target="_blank">http://site.example.com</a> >");<br>
<br>
$wgLDAPEncryptionType = array(<br>
"a_domain"=>"clear");<br>
$wgLDAPSearchStrings = array(<br>
<br>
"a_domain"=>"rom_domain\\USER- ________NAME");<br>
$wgLDAPBaseDNs = array(<br>
"a_domain"=>"dc=company,dc=___ _____com");<br>
<br>
<br>
<br>
<br>
<br>
<br>
Those are the commands I<br>
tried using:<br>
engine-manage-domains -action=add<br>
-domain= <a href="http://site.example.com" target="_blank">site.example.com</a><br>
< <a href="http://site.example.com" target="_blank">http://site.example.com</a> > < <a href="http://site.example.com" target="_blank">http://site.example.com</a> ><br>
< <a href="http://site.example.com" target="_blank">http://site.example.com</a> ><br>
< <a href="http://site.example.com" target="_blank">http://site.example.com</a> ><br>
< <a href="http://site.example.com" target="_blank">http://site.example.com</a> ><br>
-provider=ActiveDirectory<br>
-user= <a href="http://user.name" target="_blank">user.name</a><br>
< <a href="http://user.name" target="_blank">http://user.name</a> > < <a href="http://user.name" target="_blank">http://user.name</a> ><br>
< <a href="http://user.name" target="_blank">http://user.name</a> > < <a href="http://user.name" target="_blank">http://user.name</a> ><br>
< <a href="http://user.name" target="_blank">http://user.name</a> > -interactive<br>
<br>
<br>
engine-manage-domains -action=add<br>
-domain=a_domain<br>
-provider=ActiveDirectory<br>
-user= <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> > ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> <mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> > >__><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> > ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> > >__>__><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> > ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> > >__><br>
<br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> > ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> ><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a><br>
<mailto: <a href="mailto:user.name@company.com" target="_blank">user.name@company.com</a> > >__>__>__> -interactive<br>
<br>
<br>
engine-manage-domains -action=add<br>
-domain=a_domain<br>
-provider=ActiveDirectory<br>
-user=user.name@site.example._ _______com<br>
<br>
<br>
<mailto: user.name@site<br>
<mailto: user.name@site >.<br>
<mailto: user.name@site<br>
<mailto: user.name@site >.>__ exa <a href="http://m__p__le.com" target="_blank">m__p__le.com</a><br>
< <a href="http://examp__le.com" target="_blank">http://examp__le.com</a> > < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
<mailto: user.name@site .<br>
<mailto: user.name@site .>__ exam <a href="http://p__le.com" target="_blank">p__le.com</a> < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
<mailto: user.name@site. __ examp <a href="http://le.com" target="_blank">le.com</a><br>
<mailto: user.name@site. <a href="http://example.com" target="_blank">example.com</a> >>>><br>
<mailto: user.name@site<br>
<mailto: user.name@site ><br>
<br>
<mailto: user.name@site <mailto: user.name@site >>.<br>
<mailto: user.name@site <mailto: user.name@site ><br>
<mailto: user.name@site<br>
<mailto: user.name@site >>.>__ ex <a href="http://a__m__p__le.com" target="_blank">a__m__p__le.com</a><br>
< <a href="http://exam__p__le.com" target="_blank">http://exam__p__le.com</a> ><br>
<br>
<br>
< <a href="http://examp__le.com" target="_blank">http://examp__le.com</a> > < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
<br>
<br>
<br>
<mailto: user.name@site<br>
<mailto: user.name@site >.<br>
<mailto: user.name@site<br>
<mailto: user.name@site >.>__ exa <a href="http://m__p__le.com" target="_blank">m__p__le.com</a><br>
< <a href="http://examp__le.com" target="_blank">http://examp__le.com</a> > < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
<mailto: user.name@site .<br>
<mailto: user.name@site .>__ exam <a href="http://p__le.com" target="_blank">p__le.com</a> < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
<mailto: user.name@site. __ examp <a href="http://le.com" target="_blank">le.com</a><br>
<mailto: user.name@site. <a href="http://example.com" target="_blank">example.com</a> >>>>> -interactive<br>
<br>
<br>
You don't add an user this way.<br>
You add the<br>
domain. You<br>
have to<br>
pass the<br>
domain admin user and the domain<br>
admin password.<br>
<br>
<br>
any domain user will do, doesn't have<br>
to be an admin.<br>
what does the log say?<br>
<br>
<br>
Then you can use the domain<br>
within the engine.<br>
e.g. search<br>
users, add<br>
access rights for vms etc.<br>
Even login to the engine and<br>
assigning rights<br>
within<br>
the engine<br>
you can<br>
handle from the engine itself.<br>
<br>
Regards,<br>
<br>
And the output on all tries:<br>
Enter password:<br>
<br>
Error: Authentication Failed.<br>
Please<br>
verify the fully<br>
qualified domain<br>
name that is used for<br>
authentication is<br>
correct..<br>
Problematic domain<br>
is: domain_used_in_command<br>
Failure while applying Kerberos<br>
configuration. Details:<br>
Authentication<br>
Failed. Please verify the<br>
fully qualified<br>
domain<br>
name that<br>
is used for<br>
authentication is correct.<br>
<br>
Can someone help me with the<br>
correct<br>
parameters?<br>
<br>
<br>
Best regards,<br>
Cristian Falcas<br>
<br>
<br>
<br>
<br>
______________________________ _________________________<br>
<br>
<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >>><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> > <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >>>><br>
<a href="http://lists.ovirt.org/_______" target="_blank">http://lists.ovirt.org/_______</a> _mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users ><br>
<br>
<br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users >><br>
<br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users >>><br>
<br>
<br>
<br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users >><br>
<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/" target="_blank">http://lists.ovirt.org/</a> mailman/listinfo/users >>>><br>
<br>
<br>
<br>
--<br>
Regards,<br>
<br>
Vinzenz Feenstra | Senior<br>
Software Engineer<br>
RedHat Engineering Virtualization<br>
R & D<br>
Phone: <a href="tel:%2B420%20532%20294%20625" value="+420532294625" target="_blank">+420 532 294 625</a><br>
<tel:%2B420%20532%20294%20625><br>
<tel:%2B420%20532%20294%20625><br>
<tel:%2B420%20532%20294%20625><br>
<tel:%2B420%20532%20294%20625><br>
<br>
IRC: vfeenstr or evilissimo<br>
<br>
Better technology. Faster<br>
innovation. Powered<br>
by community<br>
collaboration.<br>
See how it works at <a href="http://redhat.com" target="_blank">redhat.com</a><br>
< <a href="http://redhat.com" target="_blank">http://redhat.com</a> ><br>
< <a href="http://redhat.com" target="_blank">http://redhat.com</a> > < <a href="http://redhat.com" target="_blank">http://redhat.com</a> ><br>
< <a href="http://redhat.com" target="_blank">http://redhat.com</a> ><br>
<br>
<br>
<br>
<br>
<br>
______________________________ _________________________<br>
<br>
<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >>><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> > <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >>>><br>
<a href="http://lists.ovirt.org/_______" target="_blank">http://lists.ovirt.org/_______</a> _mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users ><br>
<br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users >><br>
<br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users >>><br>
<br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users >><br>
<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/" target="_blank">http://lists.ovirt.org/</a> mailman/listinfo/users >>>><br>
<br>
<br>
<br>
<br>
______________________________ _________________________<br>
<br>
<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >>><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> > <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >>>><br>
<a href="http://lists.ovirt.org/_______" target="_blank">http://lists.ovirt.org/_______</a> _mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users ><br>
<br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users >><br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users >>><br>
<br>
<br>
<br>
<br>
< <a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users >><br>
<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/" target="_blank">http://lists.ovirt.org/</a> mailman/listinfo/users >>>><br>
<br>
<br>
<br>
<br>
Hi,<br>
<br>
This is the command I used (the same error<br>
is with<br>
-interactive<br>
parameter):<br>
<br>
engine-manage-domains -action=add<br>
-domain= <a href="http://example.com" target="_blank">example.com</a> < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> > -provider=ActiveDirectory<br>
-user=user.name@a_domain<br>
<br>
-passwordFile=/tmp/pass<br>
<br>
[root@localhost ~]# cat /tmp/pass<br>
qwerty[root@localhost ~]#<br>
<br>
This is the log:<br>
<br>
2012-11-20 00:30:40,443 INFO<br>
<br>
<br>
[org.ovirt.engine.core.utils._ _____kerberos.ManageDomains]<br>
<br>
Creating<br>
<br>
<br>
kerberos<br>
configuration for domain(s): <a href="http://example.com" target="_blank">example.com</a><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> > < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
<br>
2012-11-20 00:30:40,525 INFO<br>
<br>
<br>
[org.ovirt.engine.core.utils._ _____kerberos.ManageDomains]<br>
<br>
<br>
Successfully<br>
<br>
created kerberos configuration for domain(s):<br>
<a href="http://example.com" target="_blank">example.com</a> < <a href="http://example.com" target="_blank">http://example.com</a> > < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
<br>
2012-11-20 00:30:40,526 INFO<br>
<br>
<br>
[org.ovirt.engine.core.utils._ _____kerberos.ManageDomains]<br>
<br>
Testing<br>
<br>
<br>
kerberos<br>
configuration for domain: <a href="http://example.com" target="_blank">example.com</a><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> > < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
<br>
2012-11-20 00:30:40,830 ERROR<br>
<br>
<br>
[org.ovirt.engine.core.utils._ _____kerberos.__ KerberosConfigCheck]<br>
<br>
<br>
Error:<br>
<br>
exception message: Cannot locate KDC<br>
2012-11-20 00:30:40,851 ERROR<br>
<br>
<br>
[org.ovirt.engine.core.utils._ _____kerberos.ManageDomains]<br>
<br>
<br>
Failure<br>
<br>
while<br>
<br>
testing domain <a href="http://example.com" target="_blank">example.com</a><br>
< <a href="http://example.com" target="_blank">http://example.com</a> > < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> >. Details: Kerberos<br>
<br>
error. Please check log for further details.<br>
<br>
<br>
Hi, the error indicates you don't have<br>
kerberos configured.<br>
manage-domains validates by default using<br>
GSSAPI/Kerberos (if I<br>
understand correctly, this is equivalent to<br>
run ldapsearch<br>
with -Y<br>
gssapi option).<br>
I wonder if -x (simple authentication) will<br>
work for you as<br>
well (as<br>
manage-domains contains code for simple<br>
authentication as<br>
well).<br>
<br>
<br>
<br>
This is the ldapsearch command that works<br>
(it retrieves<br>
users)<br>
from the<br>
same machine:<br>
<br>
<br>
<br>
ldapsearch -H ldap:// <a href="http://example.com" target="_blank">example.com</a><br>
< <a href="http://example.com" target="_blank">http://example.com</a> > < <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> ><br>
< <a href="http://example.com" target="_blank">http://example.com</a> > -b<br>
<br>
dc=example,dc=com -D user.name@a_domain -w<br>
qwerty<br>
<br>
<br>
Best regards,<br>
Cristian Falcas<br>
<br>
<br>
<br>
<br>
<br>
______________________________ _______________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> ><br>
<mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto: <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> >>><br>
<a href="http://lists.ovirt.org/______" target="_blank">http://lists.ovirt.org/______</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users >><br>
<br>
< <a href="http://lists.ovirt.org/____" target="_blank">http://lists.ovirt.org/____</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users ><br>
< <a href="http://lists.ovirt.org/__" target="_blank">http://lists.ovirt.org/__</a> mailman/listinfo/users<br>
< <a href="http://lists.ovirt.org/" target="_blank">http://lists.ovirt.org/</a> mailman/listinfo/users >>><br>
<br>
<br>
<br>
<br>
Hi,<br>
<br>
<br>
I used "-x" for ldapsearch and the result is the<br>
same: list<br>
retrieved.<br>
Is there any equivalent for engine-manage-domains?<br>
<br>
Cristian<br>
<br>
Hi Christian, there is no code allowing to add<br>
simple-authentication<br>
domains to Manage-Domains.<br>
In the past we did have the ability to do that, but<br>
there are<br>
several problematic issues.<br>
What ldap server are you working against? Maybe I<br>
missed that<br>
<br>
<br>
<br>
<br>
Hi,<br>
<br>
The server is a Microfost AD 2003.<br>
<br>
Best regards,<br>
Cristian Falcas<br>
<br>
<br>
this should work, is the AD also the DNS server for the ovirt<br>
engine machine?<br>
<br>
<br>
<br>
yes<br>
<br>
<br>
<br>
<br>
<br>
Could you take a look at the tcp dump? There are only 2 messages<br>
relevant to this (let me know if you want the full dump):<br>
<br>
- 2091 12.423634 10.0.0.xx 10.0.0.yyy DNS 87 Standard query SRV<br>
_kerberos._ <a href="http://tcp.EXAMPLE.COM" target="_blank">tcp.EXAMPLE.COM</a><br>
- 2092 12.424357 10.0.0.yyy 10.0.0.xx DNS 245 Standard query response<br>
SRV 0 100 88 <a href="http://site1.example.com" target="_blank">site1.example.com</a> SRV 0 100 88 <a href="http://site2.example.com" target="_blank">site2.example.com</a> SRV 0<br>
100 88 <a href="http://site3.example.com" target="_blank">site3.example.com</a><br>
<br>
Also, I tries to run ldapsearch with -Y gssapi:<br>
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)<br>
additional info: SASL(-4): no mechanism available: No worthy mechs<br>
found<br>
<br>
Best regards,<br>
Cristian Falcas<br>
The SRV records look fine.<br>
If I remember correctly, your DNS should have a reverse-resolve PTR<br>
record to your engine machine. Does it exists?<br>
<br>
<br>
<br>
I don't think so (10.0.0.xx is engine machine, 10.0.0.yyy is dns):<br>
<br>
[root@localhost ~]# nslookup 10.0.0.xx<br>
Server: 10.0.0.yyy<br>
Address: 10.0.0.yyy#53<br>
<br>
** server can't find xx.0.0.10.in-addr.arpa.: NXDOMAIN<br>
<br>
[root@localhost ~]# host 10.0.0.xx<br>
Host xx.0.0.10.in-addr.arpa. not found: 3(NXDOMAIN)<br>
<br>
I will ask them to add a DNS record for the machine.<br>
<br>
</blockquote>
Indeed do that.<br>
In the engine we require both reverse-resolve PTR record, Kerberos SRV record and LDAP SRV record.<br>
Make sure you have all three in the DNS.<br>
The PTR + Kerberos records are used for the kerberos authentication (and constructing the krb5.conf file in the engine-manage-domains utility).<br>
The LDAP SRV record is used for the directory queries (it is used in the utility + the ovirt engine, to look for LDAP servers).<br>
</blockquote>
<br>
<br></div></div>
Yair - sounds like we need a how to troubleshoot AD issues?<br>
<br>
<br>
</blockquote></div><br><br>Hi,<br><br>So, after all, I was using the wrong domain. In my company we use everywhere (web, email, etc) as the domain "a_domain" instead of the usual <a href="http://company.com">company.com</a>. So it worked with:<br>
<br>engine-manage-domains -action=add -domain=<a href="http://company.com">company.com</a> -provider=ActiveDirectory -user=<a href="http://user.name">user.name</a> -passwordFile=/tmp/pass<br><br>Some steps I did for my investigation:<br>
<br>1. test if the domain has a kerberos service:<br><br>host -t srv _kerberos._<a href="http://tcp.company.com">tcp.company.com</a><br><br>2. use kinit instead of engine-manage-domains (mush faster)<br>cp /etc/ovirt-engine/krb5.conf /etc/<br>
<br>3. test with: <br>kinit <a href="mailto:user.name@company.com">user.name@company.com</a> -V<br><br><br>Just to let others know what errors I had and how I fixed them:<br><br>1. Client not found in Kerberos database while getting initial credentials: wrong user name<br>
<br>2. Cannot find KDC for requested realm: the realm you are using in the command line is not define in krb5.conf file. <br><br>- at the beginning I was using kinit user.name@a_domain -V, but there was no a_domain realm defined. <br>
- check the file and try to update it or correct your kinit command in order to use the correct realm <br><br>[realms]<br> <a href="http://COMPANY.COM">COMPANY.COM</a> = {<br> kdc = site1.company.com.:88<br>
kdc = site2.company.com.:88<br> kdc = site3.company.com.:88<br> }<br><br><br><br>3. KDC reply did not match expectations while getting initial credentials: you may have the same realm in your command line and in the krb5.conf file, but the server thinks this is not correct.<br>
- use wireshark to see what realm the server has: protocol KRB5, messages AS-REQ and AS-REP<br><br>Thank you for all your help.<br><br>Cristian<br></div>