<div dir="ltr"><div>Thanks Itamar for the suggestion - however the `-action=edit` fails since the currently configured user account is inactive within the active directory - it looks as if there is an initial authentication that needs to validate before the edit can proceed ... :(</div>
<div> </div><div>Hence my query about being able to reset the underlying username that engine-manage-domains uses?</div><div> </div><div>Thanks</div><div>Trevor</div><div> </div><div> </div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On 26 July 2013 12:01, Itamar Heim <span dir="ltr"><<a href="mailto:iheim@redhat.com" target="_blank">iheim@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 07/26/2013 01:55 PM, Trevor Galloway wrote:<br>
<blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid" class="gmail_quote">
Thanks Yair,<br>
I made the changes to the engine-manage-domains script as suggested in<br>
the gerrit link - that now works just fine, and also confirms what I<br>
thought the problem was all along - namely that the configured username<br>
returned on a `engine-manage-domains --action=list` is that of the<br>
previous admin.<br>
The problem being that their account is no longer valid within the<br>
active directory, hence validation fails.<br>
I've trawled the various ovirt config directories but can't find a<br>
resource that holds the username to use on the LDAP query. Presumably<br>
this is something that gets setup at install time?<br>
Is there a way to re-configure the underlying username?<br>
</blockquote>
<br></div>
engine-manage-domains should allow you to set the user used in the ldap query via -action=list.<br>
then you can use -action=edit to update it<br>
<br>
<blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid" class="gmail_quote"><div class="im">
Many thanks,<br>
Trevor<br>
<br>
<br>
On 25 July 2013 22:29, Yair Zaslavsky <<a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a><br></div><div class="im">
<mailto:<a href="mailto:yzaslavs@redhat.com" target="_blank">yzaslavs@redhat.com</a>>> wrote:<br>
<br>
<br>
<br>
----- Original Message -----<br>
> From: "Trevor Galloway" <<a href="mailto:trevgall@googlemail.com" target="_blank">trevgall@googlemail.com</a><br></div><div><div class="h5">
<mailto:<a href="mailto:trevgall@googlemail.com" target="_blank">trevgall@googlemail.<u></u>com</a>>><br>
> To: <a href="mailto:users@ovirt.org" target="_blank">users@ovirt.org</a> <mailto:<a href="mailto:users@ovirt.org" target="_blank">users@ovirt.org</a>><br>
> Sent: Thursday, July 25, 2013 7:51:56 PM<br>
> Subject: [Users] Problem running engine-manage-domain on oVirt<br>
3.1.0-4<br>
><br>
> Hello oVirt Users,<br>
><br>
><br>
><br>
> Just signed up to the user mailing list and have a question<br>
regarding an<br>
> error being reported to stdout when running engine-manage-domains.<br>
><br>
><br>
><br>
> When running the `engine-manage-domains` utility from the command<br>
line I<br>
> see the following error reported:<br>
><br>
><br>
><br>
> *[root@hive ovirt-engine]# engine-manage-domains -action=list*<br>
><br>
> *Failed reading current configuration. Details: Error "Key for add<br>
> operation must be defined!" while reading configuration value<br>
AdUserName.*<br>
><br>
><br>
><br>
> A quick Google on this leads directly to Bugzilla – Bug 883846 –<br>
which<br>
> looks like it’s fixed in the 3.2 version. Can anyone confirm<br>
that? I’ve<br>
> inherited a DL580 running oVirt Manager and a bunch of VM’s, and<br>
don’t<br>
> really want to undertake an upgrade just now if I don’t have to.<br>
<br>
This is indeed the issue.<br>
<br>
><br>
><br>
><br>
><br>
><br>
> The real problem seems to be that I can’t assign a user with any<br>
roles<br>
> since the ldap lookup to the active server fails – due, I think,<br>
to the<br>
> fact that the query is configured to authenticate with the<br>
previous admins<br>
> credentials – they left and the account is now disabled. J<br>
><br>
><br>
><br>
> From the /var/log/ovirt-engine/engine.<u></u>log<br>
><br>
> *2013-07-25 11:32:15,574 ERROR<br>
><br>
[org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>GSSAPIDirContextAuthentication<u></u>Strategy]<br>
> (ajp--0.0.0.0-8009-1) Authentication failed. The user is either<br>
locked or<br>
> disabled*<br>
><br>
> *2013-07-25 11:32:15,575 ERROR<br>
> [org.ovirt.engine.core.bll.<u></u>adbroker.DirectorySearcher]<br>
> (ajp--0.0.0.0-8009-1) Failed ldap search server<br>
> LDAP://<my_active_directory>:<u></u>389 due to<br>
><br>
org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>EngineDirectoryServiceExceptio<u></u>n. We<br>
> should not try the next server:<br>
> org.ovirt.engine.core.bll.<u></u>adbroker.<u></u>EngineDirectoryServiceExceptio<u></u>n*<br>
><br>
> * *<br>
><br>
> The above gets written out as soon as I hit the Go button in the<br>
Add System<br>
> Permission to User dialogue window.<br>
<br>
engine-manage-domains uses engine-config and provides its a<br>
configuration (after the above bug fix) with keys in form of "key=".<br>
If you really don't want to upgrade, maybe you should consider<br>
editing the engine-manage-domains script, as in<br>
<br>
<a href="http://gerrit.ovirt.org/#/c/9743/3/backend/manager/conf/kerberos/engine-manage-domains" target="_blank">http://gerrit.ovirt.org/#/c/<u></u>9743/3/backend/manager/conf/<u></u>kerberos/engine-manage-domains</a><br>
?<br>
<br>
You will have to do that for any altering operations on domains and<br>
their associated users.<br>
<br>
Please let us know if it worked for you<br>
<br>
Many thanks,<br>
Yair<br>
<br>
<br>
><br>
><br>
><br>
> Thanks in advance for any advice!<br>
><br>
> ______________________________<u></u>_________________<br>
> Users mailing list<br></div></div>
> <a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a> <mailto:<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a>><br>
> <a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/<u></u>mailman/listinfo/users</a><div class="im"><br>
><br>
<br>
<br>
<br>
<br>
______________________________<u></u>_________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/<u></u>mailman/listinfo/users</a><br>
<br>
</div></blockquote>
<br>
</blockquote></div><br></div>