From: "René Koch (ovido)" <r.koch(a)ovido.at&gt; To: "ovirt-users" <users(a)ovirt.org&gt; Sent: Friday, April 5, 2013 3:47:07 PM Subject: [Users] DNS for IPA in oVirt Hi list, I don't want to ask my question in the mail thread of Eduardo to avoid mixing topics. Can you give me more detailed information on how oVirt is using DNS internally and how IPA users can work in the following scenario: # engine-manage-domains -action=list Domain: ovido.at User name: admin(a)OVIDO.AT Manage Domains completed successfully # cat /etc/hosts | grep engine 10.0.100.195 ovirt-engine.lab.ovido.at # ip a 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:1a:4a:00:64:14 brd ff:ff:ff:ff:ff:ff inet 10.0.100.195/24 brd 10.0.100.255 scope global eth0 # host ovirt-engine.lab.ovido.at ovirt-engine.lab.ovido.at has address 10.0.100.24 # host 10.0.100.24 24.100.0.10.in-addr.arpa domain name pointer ovirt-engine.lab.ovido.at. So in my case I have correct DNS settings (forward and reverse), but my ovirt-engine host has a totally different IP address. I didn't test SSO with Kerberos in user portal (maybe this want work), but authentication with IPA user in user portal and admin portal is working fine even with these totally wrong DNS configuration. Regards, René _______________________________________________ Users mailing list Users(a)ovirt.org http://lists.ovirt.org/mailman/listinfo/users

From: "René Koch (ovido)" <r.koch(a)ovido.at&gt; To: "Yair Zaslavsky" <yzaslavs(a)redhat.com&gt; Cc: "ovirt-users" <users(a)ovirt.org&gt; Sent: Tuesday, April 9, 2013 10:47:08 AM Subject: Re: [Users] DNS for IPA in oVirt Hi, Thanks a lot for your detailed explanation. That mean that I don't need DNS entries (forward and reverse) for oVirt engine anymore, only SRV records for the directory service (for sure)? So using IP or /etc/hosts is sufficient. Regards, René

On Mon, 2013-04-08 at 09:55 -0400, Yair Zaslavsky wrote: > Hi, > When you add a new domain - let's say example.com what happens from DNS > perspective is - > > > a. if useDnsLookup at engine-manage-domains conf is set to "true" then > dns_lookup_realm = true > and dns_lookup_kdc = true > > Will be placed at the krb5.conf that is being created. > This will cause the internal java kerberos implementation to issue DNS srv > requests per realm (for example, if you want to add the domain > example.com, the realm will be EXAMPLE.COM) > for kerberos - > the srv record query will look like _kerberos._tcp.example.com and it will > return a list of KDCs for the realm. > > If useDnsLookup is not set to true, > This will cause the manage-domains utility to issue kerberos DNS srv > records, and fill the krb5.conf file with information on KDCs per realm. > > > In return you will get a list of corresponding hosts for the ldap servers. > > b. If -ldapServers was not passed - a DNS srv record will be issues to get > the ldap servers for the domain - > _ldap._tcp.example.com after the manage-domains utility performs kerberos > authentication. > This is done, in order to get a URL of an ldap server to be used, to send > an ldap query and get the user id for the given user at the command line > utility. > > So, as long as your DNS is configured properly, and the SRV records are > well defined, you will get SRV records for kerberos and ldap. > > > > > > ----- Original Message ----- > > From: "René Koch (ovido)" <r.koch(a)ovido.at&gt; > > To: "ovirt-users" <users(a)ovirt.org&gt; > > Sent: Friday, April 5, 2013 3:47:07 PM > > Subject: [Users] DNS for IPA in oVirt > > > > Hi list, > > > > I don't want to ask my question in the mail thread of Eduardo to avoid > > mixing topics. > > > > Can you give me more detailed information on how oVirt is using DNS > > internally and how IPA users can work in the following scenario: > > > > # engine-manage-domains -action=list > > Domain: ovido.at > > User name: admin(a)OVIDO.AT > > Manage Domains completed successfully > > > > # cat /etc/hosts | grep engine > > 10.0.100.195 ovirt-engine.lab.ovido.at > > > > # ip a > > 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast > > state UP qlen 1000 > > link/ether 00:1a:4a:00:64:14 brd ff:ff:ff:ff:ff:ff > > inet 10.0.100.195/24 brd 10.0.100.255 scope global eth0 > > > > # host ovirt-engine.lab.ovido.at > > ovirt-engine.lab.ovido.at has address 10.0.100.24 > > > > # host 10.0.100.24 > > 24.100.0.10.in-addr.arpa domain name pointer ovirt-engine.lab.ovido.at. > > > > So in my case I have correct DNS settings (forward and reverse), but my > > ovirt-engine host has a totally different IP address. > > > > I didn't test SSO with Kerberos in user portal (maybe this want work), > > but authentication with IPA user in user portal and admin portal is > > working fine even with these totally wrong DNS configuration. > > > > > > Regards, > > René > > > > > > _______________________________________________ > > Users mailing list > > Users(a)ovirt.org > > http://lists.ovirt.org/mailman/listinfo/users > >