Re: [ovirt-users] oVirt 3.6 AAA LDAP cannot not log in when end of UPN is different from domain base

--_000_DC6968B979404A68B4986B61460DEDD9sluse_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable On 26 Mar 2016, at 13:49, Karli Sj=F6berg <Karli.Sjoberg@slu.se<mailto:Karl= i.Sjoberg(a)slu.se&gt;&gt; wrote: On 26 Mar 2016, at 11:35, Ondra Machacek <omachace@redhat.com<mailto:omacha= ce(a)redhat.com&gt;&gt; wrote: For me it's working completelly fine: ... config.mapUser.type =3D regex config.mapUser.regex.pattern =3D ^(?<user>[^@]*)$ config.mapUser.regex.replacement =3D ${user}@DOMAINX.com<http://domainx.com= /config.mapUser.regex.mustMatch =3D false ... $ ovirt-engine-extensions-tool aaa login-user --password=3Dpass:password --= user-name=3Duser@DOMAINY --profile=3Dad INFO API: -->Mapping.InvokeCommands.MAP_USER profile=3D'ad' user=3D'user= @DOMAINY' INFO API: <--Mapping.InvokeCommands.MAP_USER profile=3D'ad' user=3D'user= @DOMAINY' $ ovirt-engine-extensions-tool aaa login-user --password=3Dpass:password --= user-name=3Duser --profile=3Dad INFO API: -->Mapping.InvokeCommands.MAP_USER profile=3D'ad' user=3D'user= ' INFO API: <--Mapping.InvokeCommands.MAP_USER profile=3D'ad' user=3D'user= @DOMAINX.com<mailto:user=3D'user@DOMAINX.com>' As you can see it's correctly mapped. Please check once again the regex is correct, if it still won't work, pleas= e send log output again. /etc/ovirt-engine/extensions.d/mapping-suffix.properties: ovirt.engine.extension.name =3D mapping-suffix ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D org.ovirt.engine-exte= nsions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class =3D org.ovirt.engineextens= ions.aaa.misc.mapping.MappingExtension ovirt.engine.extension.provides =3D org.ovirt.engine.api.extensions.aaa.Map= ping config.mapUser.type =3D regex config.mapUser.regex.pattern =3D ^(?<user>[^@]*)$ config.mapUser.regex.replacement =3D ${user}(a)foo.bar config.mapUser.regex.mustMatch =3D false # ovirt-engine-extensions-tool --log-level=3DFINEST aaa login-user --profil= e=3Dbaz.foo.bar-new --user-name=3Duser@baz.foo.bar<mailto:user-name=3Duser@= baz.foo.bar# grep Mapping.InvokeCommands.MAP_USER login.log 2016-03-26 13:27:40 INFO API: -->Mapping.InvokeCommands.MAP_USER user=3D= 'user@baz.foo.bar<mailto:user=3D'user@baz.foo.bar>' 2016-03-26 13:27:40 INFO API: <--Mapping.InvokeCommands.MAP_USER user=3D= 'user@baz.foo.bar<mailto:user=3D'user@baz.foo.bar>' And here is the log: https://dropoff.slu.se/index.php/s/SK9T8vOUO7yB3PM/download /K Eureka! I changed =91vars.user=92 in =91baz.foo.bar-new.properties=92 from = one with suffix =91(a)baz.foo.bar=92 to mine that has a =91(a)foo.bar=92 ending= and now it works, for some reason. Very strange, but anyway... How do I go= about changing from UPN to samAccountName, if I=B4d want that instead? /K On 03/26/2016 10:07 AM, Karli Sj=F6berg wrote: What the heck, my message disappeares! Trying again. Ok, so it's mapping now but the only thing working is: config.mapUser.regex.pattern =3D user@baz.foo.bar<mailto:user@baz.foo.barconfig.mapUser.regex.replacement =3D user@foo.bar<mailto:user@foo.bar And that isn't very useful. Please advice! /K On 03/25/2016 12:26 AM, Karli Sj=F6berg wrote: Den 25 mars 2016 12:10 fm skrev Karli Sj=F6berg <karli.sjoberg(a)slu.se&lt;mailt= o:karli.sjoberg@slu.se>>: to:omachace@redhat.com>>: ailto:omachace@redhat.com>>: --cacert --profile=3Dbaz.foo.bar-new just --profile=3Dbaz.foo.bar-new can use it in mapped to oo.bar>' will remain d t lto:user@baz.foo.bar>$', the Just noticed after logging in to webadmin as "user@foo.bar<mailto:user@foo.= bar>" (which worked btw, so good there) that the "User Name" in Users main tab looks really odd: user@foo.bar<mailto:user@foo.bar>@baz.foo.bar-new-authz Sorry you are right, it don't work. I've sent you incorrect cofiguration, the correct one is: /etc/ovirt-engine/extensions.d/mapping-suffix.properties ... config.mapUser.regex.pattern =3D ^(?<user>[^@]*)$ config.mapUser.regex.replacement =3D ${user}(a)foo.bar config.mapUser.regex.mustMatch =3D false ... Notice there was missing 'regex', after 'mapUser'. /K result=3DSUCCESS bar>' baz.foo.bar>' er(a)foo.bar&gt; -W -b userPrincipalName | ' when --_000_DC6968B979404A68B4986B61460DEDD9sluse_ Content-Type: text/html; charset="Windows-1252" Content-ID: <7C99868A39F0CD4E83EED89EDD689798(a)ad.slu.seContent-Transfer-Encoding: quoted-printable <html<head<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1= 252"</head<body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-lin= e-break: after-white-space;" class=3D""<br class=3D""<div<blockquote type=3D"cite" class=3D""<div class=3D"">On 26 Mar 2016, at 13:49, Karli Sj=F6berg &lt;<a href=3D"ma= ilto:Karli.Sjoberg@slu.se" class=3D&quot;&quot;&gt;Karli.Sjoberg(a)slu.se&lt;/a&gt;&amp;gt; wrote:</= div<br class=3D"Apple-interchange-newline"<div class=3D""<div style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line= -break: after-white-space;" class=3D""<br class=3D""<div class=3D""<blockquote type=3D"cite" class=3D""<div class=3D"">On 26 Mar 2016, at 11:35, Ondra Machacek &lt;<a href=3D"mai= lto:omachace@redhat.com" class=3D&quot;&quot;&gt;omachace(a)redhat.com&lt;/a&gt;&amp;gt; wrote:</div= <br class=3D"Apple-interchange-newline"<div class=3D"">For me it's working completelly fine:<br class=3D""<br class=3D""...<br class=3D""config.mapUser.type =3D regex<br class=3D""config.mapUser.regex.pattern =3D ^(?&lt;user&gt;[^@]*)$<br class=3D""config.mapUser.regex.replacement =3D ${user}@<a href=3D"http://domainx.com/= " class=3D"">DOMAINX.com</a><br class=3D""config.mapUser.regex.mustMatch =3D false<br class=3D""...<br class=3D""<br class=3D""$ ovirt-engine-extensions-tool aaa login-user --password=3Dpass:password --= user-name=3Duser@DOMAINY --profile=3Dad<br class=3D""<br class=3D""INFO &nbsp;&nbsp;&nbsp;API: --&gt;Mapping.InvokeCommands.MAP_USER profile= =3D'ad' user=3D'user@DOMAINY'<br class=3D""INFO &nbsp;&nbsp;&nbsp;API: &lt;--Mapping.InvokeCommands.MAP_USER profile= =3D'ad' user=3D'user@DOMAINY'<br class=3D""<br class=3D""$ ovirt-engine-extensions-tool aaa login-user --password=3Dpass:password --= user-name=3Duser --profile=3Dad<br class=3D""<br class=3D""INFO &nbsp;&nbsp;&nbsp;API: --&gt;Mapping.InvokeCommands.MAP_USER profile= =3D'ad' user=3D'user'<br class=3D""INFO &nbsp;&nbsp;&nbsp;API: &lt;--Mapping.InvokeCommands.MAP_USER profile= =3D'ad' <a href=3D"mailto:user=3D'user@DOMAINX.com" class=3D""user=3D&#39;user(a)DOMAINX.com&lt;/a&gt;&#39;&lt;br class=3D""<br class=3D""As you can see it's correctly mapped.<br class=3D""<br class=3D""Please check once again the regex is correct, if it still won't work, pleas= e send log output again.<br class=3D""</div</blockquote<div class=3D""><br class=3D""</div<span class=3D""<div class=3D"">/etc/ovirt-engine/extensions.d/mapping-suffix.properties:</= div</span><span class=3D"">ovirt.engine.extension.name =3D mapping-suffix<br c= lass=3D""ovirt.engine.extension.bindings.method =3D jbossmodule<br class=3D""ovirt.engine.extension.binding.jbossmodule.module =3D org.ovirt.engine-exte= nsions.aaa.misc<br class=3D""ovirt.engine.extension.binding.jbossmodule.class =3D&nbsp;org.ovirt.enginee= xtensions.aaa.misc.mapping.MappingExtension<br class=3D""ovirt.engine.extension.provides =3D org.ovirt.engine.api.extensions.aaa.Map= ping<br class=3D""config.mapUser.type =3D regex<br class=3D""config.mapUser.regex.pattern =3D ^(?&lt;user&gt;[^@]*)$<br class=3D""config.mapUser.regex.replacement =3D ${user}(a)foo.bar&lt;br class=3D""config.mapUser.regex.mustMatch =3D false</span></div<div class=3D""><span class=3D""><br class=3D""</span></div<span class=3D""># ovirt-engine-extensions-tool --log-level=3DFINEST aaa lo= gin-user --profile=3Dbaz.foo.bar-new --<a href=3D"mailto:user-name=3Duser@b= az.foo.bar" class=3D&quot;&quot;&gt;user-name=3Duser(a)baz.foo.bar&lt;/a&gt;&lt;br class=3D""# grep Mapping.InvokeCommands.MAP_USER login.log&nbsp;<br class=3D""2016-03-26 13:27:40 INFO&nbsp; &nbsp;&nbsp;API: --&gt;Mapping.InvokeCommand= s.MAP_USER&nbsp;<a href=3D"mailto:user=3D'user@baz.foo.bar" class=3D"">user= =3D&#39;user(a)baz.foo.bar&lt;/a&gt;&#39;&lt;br class=3D""2016-03-26 13:27:40 INFO&nbsp; &nbsp; API: &lt;--Mapping.InvokeCommands.MAP= _USER&nbsp;<a href=3D"mailto:user=3D'user@baz.foo.bar" class=3D"">user=3D'u= ser(a)baz.foo.bar&lt;/a&gt;&#39;&lt;br class=3D""</span><span class=3D""><br class=3D""</span<div class=3D""><span class=3D"">And here is the log:</span></div<div class=3D""><span class=3D""><a href=3D"https://dropoff.slu.se/index.ph= p/s/SK9T8vOUO7yB3PM/download" class=3D"">https://dropoff.slu.se/index.php/s= /SK9T8vOUO7yB3PM/download</a></span></div<div class=3D""><span class=3D""><br class=3D""</span></div<div class=3D""><span class=3D"">/K</span></div</div</div</blockquote<div><br class=3D""</divEureka! I changed =91vars.user=92 in =91baz.foo.bar-new.properties=92 from = one with suffix =91(a)baz.foo.bar=92 to mine that has a =91(a)foo.bar=92 ending= and now it works, for some reason. Very strange, but anyway... How do I go= about changing from UPN to samAccountName, if I=B4d want that instead?</div<div><br class=3D""</div<div>/K</div<div><br class=3D""<blockquote type=3D"cite" class=3D""<div class=3D""<div style=3D"word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line= -break: after-white-space;" class=3D""<div class=3D""><span class=3D""><br class=3D""</span<blockquote type=3D"cite" class=3D""<div class=3D""><br class=3D""On 03/26/2016 10:07 AM, Karli Sj=F6berg wrote:<br class=3D""<blockquote type=3D"cite" class=3D"">What the heck, my message disappeares!= Trying again.<br class=3D""<br class=3D""Ok, so it's mapping now but the only thing working is:<br class=3D""config.mapUser.regex.pattern =3D <a href=3D"mailto:user@baz.foo.bar" class= =3D&quot;&quot;&gt;user(a)baz.foo.bar&lt;/a&gt;&lt;br class=3D""config.mapUser.regex.replacement =3D <a href=3D"mailto:user@foo.bar" class= =3D&quot;&quot;&gt;user(a)foo.bar&lt;/a&gt;&lt;br class=3D""<br class=3D""And that isn't very useful. Please advice!<br class=3D""<br class=3D""/K<br class=3D""<br class=3D""On 03/25/2016 12:26 AM, Karli Sj=F6berg wrote:<br class=3D""<blockquote type=3D"cite" class=3D""><br class=3D""Den 25 mars 2016 12:10 fm skrev Karli Sj=F6berg &lt;<a href=3D"mailto:karli= .sjoberg(a)slu.se&quot; class=3D"">karli.sjoberg@slu.se</a>&gt;:<br class=3D""&nbsp;&gt;<br class=3D""&nbsp;&gt;<br class=3D""&nbsp;&gt; Den 24 mars 2016 11:26 em skrev Ondra Machacek &lt;<a href=3D"ma= ilto:omachace@redhat.com" class=3D"">omachace@redhat.com</a>&gt;:<br class= =3D""&nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; On 03/24/2016 11:14 PM, Karli Sj=F6berg wrote:<br class=3D"= "&nbsp;&gt; &gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; Den 24 mars 2016 7:26 em skrev Ondra Machacek &lt;<a h= ref=3D"mailto:omachace@redhat.com" class=3D"">omachace@redhat.com</a>&gt;:<= br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; On 03/24/2016 06:16 PM, Karli Sj=F6berg wro= te:<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; Hi!<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; Starting new thread instead of jacking= someone else=B4s.<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; Managed to migrate from old 'engine-ma= nage-domains' auth to<br class=3D""&nbsp;&gt; &gt; &gt; aaa-ldap using:<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; #| ovirt-engine-kerbldap-migration-too= l --domain baz.foo.bar<br class=3D""--cacert<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; /tmp/ca.crt --apply<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; |<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; All OK, no errors, but cannot log in:<= br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; # ovirt-engine-extensions-tool aaa log= in-user<br class=3D""--profile=3Dbaz.foo.bar-new<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; --user-name=3Duser:<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; If you want to login with user with differe= nt upn suffix, then<br class=3D""just<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; append that suffix<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; $ ovirt-engine-extensions-tool aaa login-us= er<br class=3D""--profile=3Dbaz.foo.bar-new<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; --<a href=3D"mailto:user-name=3Duser@foo.ba= r" class=3D&quot;&quot;&gt;user-name=3Duser(a)foo.bar&lt;/a&gt;&lt;br class=3D""&nbsp;&gt; &gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; OK, some progress, that works!<br class=3D""&nbsp;&gt; &gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; If you have more suffixes and want to have = some as default you<br class=3D""can use<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; following approach:<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; 1) install ovirt-engine-extension-aaa-misc<= br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; 2) create new mapping extension like this:<= br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; /etc/ovirt-engine/extensions.d/mapping-suff= ix.properties<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; ovirt.engine.extension.name =3D mapping-suf= fix<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; ovirt.engine.extension.bindings.method =3D = jbossmodule<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; ovirt.engine.extension.binding.jbossmodule.= module =3D<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; org.ovirt.engine-extensions.aaa.misc<br cla= ss=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; ovirt.engine.extension.binding.jbossmodule.= class =3D<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; org.ovirt.engineextensions.aaa.misc.mapping= .MappingExtension<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; ovirt.engine.extension.provides =3D<br clas= s=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; org.ovirt.engine.api.extensions.aaa.Mapping= <br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; config.mapUser.type =3D regex<br class=3D""= &nbsp;&gt; &gt; &gt; &nbsp;&gt; config.mapUser.pattern =3D ^(?&lt;user&gt;[= ^@]*)$<br class=3D""&nbsp;&gt; &gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; Is that supposed to really say '&lt;user&gt;' or shoul= d it be changed to a<br class=3D""&nbsp;&gt; &gt; &gt; real user name? Either way, it doesn't work, I tried i= t all.<br class=3D""&nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; '?&lt;user&gt;' is just a named group in that regex so you = can later use<br class=3D""it in<br class=3D""&nbsp;&gt; &gt; 'config.mapUser.replacement' &nbsp;option. It should take e= verything until<br class=3D""&nbsp;&gt; &gt; first &#39;(a)&#39;.&lt;br class=3D""&nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; config.mapUser.replacement =3D ${user}(a)foo.= bar<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; config.mapUser.mustMatch =3D false<br class= =3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; 3) select a mapping plugin in authn configu= ration:<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; ovirt.engine.aaa.authn.mapping.plugin =3D m= apping-suffix<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; With above configuration in use, your user = 'user' witll be<br class=3D""mapped to<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; user '<a href=3D"mailto:user@foo.bar" class= =3D&quot;&quot;&gt;user(a)foo.bar&lt;/a&gt;&#39;&lt;br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; and users '<a href=3D"mailto:user@anotherdo= main.foo.bar" class=3D&quot;&quot;&gt;user(a)anotherdomain.foo.bar&lt;/a&gt;&#39; will remain<br cla= ss=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; '<a href=3D"mailto:user@anotherdomain.foo.b= ar" class=3D&quot;&quot;&gt;user(a)anotherdomain.foo.bar&lt;/a&gt;&#39;.&lt;br class=3D""&nbsp;&gt; &gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; This however does not, it doesn't replace the suffix a= s it's supposed<br class=3D""&nbsp;&gt; &gt; &gt; to. I tried with many different types of the 'mapUser.= pattern' but it<br class=3D""&nbsp;&gt; &gt; &gt; simply won't change it, even if I type in '=3D ^<a hre= f=3D"mailto:user@baz.foo.bar" class=3D&quot;&quot;&gt;user(a)baz.foo.bar&lt;/a&gt;$&#39;, the<br cla= ss=3D""&nbsp;&gt; &gt; &gt; error is the same:(<br class=3D""&nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; Hmm, hard to say what's wrong, try to run:<br class=3D""&nbsp;&gt; &gt; $ ovirt-engine-extensions-tool --log-level=3DFINEST aaa log= in-user<br class=3D""&nbsp;&gt; &gt; --profile=3Dbaz.foo.bar-new --user-name=3Duser<br class=3D"= "&nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; and search for a mapping part in log.<br class=3D""&nbsp;&gt;<br class=3D""&nbsp;&gt; Wow what a mouthfull:) Can you make anything out of it?<br class= =3D""&nbsp;&gt;<br class=3D""&nbsp;&gt; <a href=3D"https://dropoff.slu.se/index.php/s/EMe2NPmOfsWCNTv/do= wnload" class=3D""https://dropoff.slu.se/index.php/s/EMe2NPmOfsWCNTv/download</a><br class=3D= ""&nbsp;&gt;<br class=3D""&nbsp;&gt; /K<br class=3D""<br class=3D""Just noticed after logging in to webadmin as &quot;<a href=3D"mailto:user@f= oo.bar" class=3D&quot;&quot;&gt;user(a)foo.bar&lt;/a&gt;&amp;quot; (which<br class=3D""worked btw, so good there) that the &quot;User Name&quot; in Users main tab= looks<br class=3D""really odd:<br class=3D""<a href=3D"mailto:user@foo.bar" class=3D&quot;&quot;&gt;user@foo.bar&lt;/a&gt;(a)baz.foo.bar-new= -authz<br class=3D""</blockquote<br class=3D""Sorry you are right, it don't work. I've sent you incorrect<br class=3D""cofiguration, &nbsp;the correct one is:<br class=3D""<br class=3D""/etc/ovirt-engine/extensions.d/mapping-suffix.properties<br class=3D""<br class=3D""...<br class=3D""config.mapUser.regex.pattern =3D ^(?&lt;user&gt;[^@]*)$<br class=3D""config.mapUser.regex.replacement =3D ${user}(a)foo.bar&lt;br class=3D""config.mapUser.regex.mustMatch =3D false<br class=3D""...<br class=3D""<br class=3D""Notice there was missing 'regex', after 'mapUser'.<br class=3D""<br class=3D""<blockquote type=3D"cite" class=3D""><br class=3D""/K<br class=3D""<br class=3D""&nbsp;&gt;<br class=3D""&nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; /K<br class=3D""&nbsp;&gt; &gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; API: &lt;--Authn.InvokeCommands.AUTHEN= TICATE_CREDENTIALS<br class=3D""result=3DSUCCESS<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; but:<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; API: --&gt;Authz.InvokeCommands.FETCH_= PRINCIPAL_RECORD<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; <a href=3D"mailto:principal=3D'user@ba= z.foo.bar" class=3D&quot;&quot;&gt;principal=3D&#39;user(a)baz.foo.bar&lt;/a&gt;&#39;&lt;br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; SEVERE &nbsp;Cannot resolve principal = '<a href=3D"mailto:user@baz.foo.bar" class=3D&quot;&quot;&gt;user(a)baz.foo.bar&lt;/a&gt;&#39;&lt;br cl= ass=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; So it fails.<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; # ldapsearch -x -H <a href=3D"ldap://b= az.foo.bar" class=3D"">ldap://baz.foo.bar</a> -D <a href=3D"mailto:user@foo.bar" class=3D&quot;&quot;&gt;user(a)foo.bar&lt;/a&gt; -W -b<br class= =3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; DC=3Dbaz,DC=3Dfoo,DC=3Dbar -s sub &quo= t;(samAccountName=3Duser)&quot;<br class=3D""userPrincipalName |<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; grep 'userPrincipalName:'<br class=3D"= "&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; userPrincipalName: <a href=3D"mailto:u= ser(a)foo.bar&quot; class=3D&quot;&quot;&gt;user(a)foo.bar&lt;/a&gt;&lt;br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; |How do you configure AAA with base 'D= C=3Dbaz,DC=3Dfoo,DC=3Dbar' when<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; userPrincipalName ends only on &#39;(a)foo.b= ar'?<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; /K<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; |<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; ______________________________________= _________<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; Users mailing list<br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; <a href=3D"mailto:Users@ovirt.org" cla= ss=3D&quot;&quot;&gt;Users(a)ovirt.org&lt;/a&gt;&lt;br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt; <a href=3D"http://lists.ovirt.org/mail= man/listinfo/users" class=3D"">http://lists.ovirt.org/mailman/listinfo/user= s</a><br class=3D""&nbsp;&gt; &gt; &gt; &nbsp;&gt; &gt;<br class=3D""&nbsp;&gt; &gt; &gt;<br class=3D""<br class=3D""</blockquote</blockquote</div</blockquote</div<br class=3D""</div</div</blockquote</div<br class=3D""</body</html --_000_DC6968B979404A68B4986B61460DEDD9sluse_--