[ovirt-users] oVirt 3.6 AAA LDAP cannot not log in when end of UPN is different from domain base

Hi! Starting new thread instead of jacking someone else´s. Managed to migrate from old 'engine-manage-domains' auth to aaa-ldap using: # ovirt-engine-kerbldap-migration-tool --domain baz.foo.bar --cacert /tmp/ca.crt --apply All OK, no errors, but cannot log in: # ovirt-engine-extensions-tool aaa login-user --profile=baz.foo.bar-new --user-name=user: API: <--Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS result=SUCCESS but: API: -->Authz.InvokeCommands.FETCH_PRINCIPAL_RECORD principal=&#39;user(a)baz.foo.bar&#39; SEVERE Cannot resolve principal &#39;user(a)baz.foo.bar&#39; So it fails. # ldapsearch -x -H ldap://baz.foo.bar -D user(a)foo.bar -W -b DC=baz,DC=foo,DC=bar -s sub "(samAccountName=user)" userPrincipalName | grep 'userPrincipalName:' userPrincipalName: user(a)foo.bar How do you configure AAA with base 'DC=baz,DC=foo,DC=bar' when userPrincipalName ends only on &#39;(a)foo.bar&#39;? /K