<div dir="ltr">Hi Juan,<br><br><div class="gmail_extra"><div class="gmail_quote">On Sat, Nov 23, 2013 at 3:03 PM, Juan Hernandez <span dir="ltr"><<a href="mailto:jhernand@redhat.com" target="_blank">jhernand@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Did you change it while the server was running? If so during stop the<br>
server will probably overwrite the file. Try to change it after stopping<br>
the server:<br></blockquote><div><br>Yes, it was absolutely because the server was running and was writing out its configuration upon being stopped.<br><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
In fact modifying the file is not good practice, you may prefer to do it<br>
using LDAP:<br></blockquote><div><br></div><div>I guess this method would not have suffered from the clobbered config file :D. Thanks for the additional tip, I'm quite new to LDAP.<br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
I have just tested this in my local environment and with minssf=1 it<br>
works correctly, including the ability to search for users in the LDAP<br>
directory from the administration GUI and using those users to log in to<br>
both the administration GUI and to the user portal.<br></blockquote><div><br></div><div>I can definitely now confirm that changing minssf to 1 worked around the issue.<br><br></div><div>However, I'm faced with either an issue or a misunderstanding of how things work in oVirt. I was able to add a couple of users to IPA (user A and user B) and then import them with UserRole into oVirt. What is puzzling is that both are able to see(!!) and power on/off(!!!!!) all the machines which were created by and for user admin@internal. Some of these machines are based on the Blank template and some on a different template (if that matters). Thankfully, at least the new users are unable to attach to the console of those machines.<br>
<br>When I created a new virtual machine and in the permissions added user A as UserRole, user A now has access to the console of that VM. However, what was again puzzling is that user B can see and power on/off the new virtual machine, but at least cannot attach to the console (consistent with my previous findings).<br>
<br></div><div>I would have thought that users would "see" and be able to power on/off only their own VMs, and something tells me that this is the way it was intended. So what do you think is broken in my test rig?<br>
</div><div><br>Thank you very much!<br></div><div>iordan<br clear="all"></div></div><br>-- <br>The conscious mind has only one thread of execution.
</div></div>