<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 26, 2016 at 10:11 AM, Alexis HAUSER <span dir="ltr"><<a href="mailto:alexis.hauser@telecom-bretagne.eu" target="_blank">alexis.hauser@telecom-bretagne.eu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">>You use 389 with SSL? I guess you wrongly specified it.<br>
>But, if you want to use SSL and you have it on 636, then you should<br>
>create new SRV dns<br>
>records for example: _ldaps._<a href="http://tcp.university.mydomain.com" rel="noreferrer" target="_blank">tcp.university.mydomain.com</a> ... 636<br>
<br>
Where should I add this ? in /etc/hosts ? Somewhere in the ovirt config ? On the DNS server I'm using ?<br>
<br>
>and then change:<br>
> pool.default.serverset.srvrecord.service=ldaps<br>
>But I guess you wanted to use startTLS with 389, which you can enable by<br>
>adding:<br>
> pool.default.ssl.startTLS=true<br>
>and remove line:<br>
> pool.default.ssl.enable=true<br>
>Does it solve your issue?<br>
<br>
Actually, it's using ldaps yes. It doesnt solve my issue but I don't know where this DNS server comes from, I think it doesn't exist...<br>
<br>
I tried to configure it by adding vars.dns = dns://<a href="http://one_of_the_adservers.com" rel="noreferrer" target="_blank">one_of_the_adservers.com</a> and the same with ":636" at the end, but none of them works, it's still trying to reach this weird address with underlines : _ldaps._<a href="http://tcp.university.mydomain.com" rel="noreferrer" target="_blank">tcp.university.mydomain.com</a><br>
<br>
"2016-05-26 09:54:52,872 WARN [org.ovirt.engineextensions.aaa.ldap.AuthnExtension] (ajp-/127.0.0.1:8702-7) [] [ovirt-engine-extension-aaa-ldap.authn::AD-authn] Cannot initialize LDAP framework, deferring initialization. Error: An error occurred while attempting to query DNS in order to retrieve SRV records with name '_ldaps._<a href="http://tcp.university.mydomain.com" rel="noreferrer" target="_blank">tcp.university.mydomain.com</a>': javax.naming.NameNotFoundException: DNS name not found [response code 3]; remaining name '_ldaps._<a href="http://tcp.campus.enst-bretagne.fr" rel="noreferrer" target="_blank">tcp.campus.enst-bretagne.fr</a>'"<br>
<br>
>> I meant I had to disable the LDAP (openLDAP) profile, renaming the file with .save so ovirt doesn't detect them. If both profiles are activated, ovirt-web interface propose >>me the DN of the LDAP into AD (in namespace field)... Is that a bug or normal behavior ?<br>
>><br>
>Hmm, that's strange, because only files with *.properties suffix should<br>
>be detected and used. So yes please open bz that also other suffixes are<br>
>loaded.<br>
<br>
Actually that's what I said : only .properties file are detected. The problem is about the namespaces : when LDAP.properties file and AD.properties file are activated, the namespace suggested in the web interface in the user tab, when choosing AD, is the DN of the LDAP...Which seems to be a bug....Namespaces of everything are mixed...And if I select internal and then select again AD, a new namespace appears : * (from internal).<br>
This a weird behavior, right ?<br></blockquote><div><br><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;display:inline">If I understand correctly, you have only one AD server/domain, right?</div> <div class="gmail_default" style="font-family:arial,helvetica,sans-serif;display:inline">If so, what do you want to use profile LDAP.properties for?<br><br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@ovirt.org">Users@ovirt.org</a><br>
<a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br>
</blockquote></div><br></div></div>