Hi,

I h= =3D ave an IPA server 3.0 on centos 6.6.

I successfully attached to m= =3D y ovirt cluster.

I can see the users on ovirt user tab, but= =3D after auth I always get this error:

=3D

Cannot Login. User Password has expired. Use the following = =3D URL to change the password: (nothing)

I have try out with different long passwords and di= =3D fferent users, but it's same.

Is this ver= si=3D on compatible with ovirt 3.5?

What did I wr= =3D ong?

Thanks in advance,

Tibor

------=3D_Part_6727133_325728685.1416415592421-- --===============8443524904117080501== Content-Type: multipart/alternative MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.bin" LS0tLS0tPV9QYXJ0XzY3MjcxMzNfMzI1NzI4Njg1LjE0MTY0MTU1OTI0MjEKQ29udGVudC1UeXBl OiB0ZXh0L3BsYWluOyBjaGFyc2V0PXV0Zi04CkNvbnRlbnQtVHJhbnNmZXItRW5jb2Rpbmc6IDdi aXQKCkhpLCAKCkkgaGF2ZSBhbiBJUEEgc2VydmVyIDMuMCBvbiBjZW50b3MgNi42LiAKSSBzdWNj ZXNzZnVsbHkgYXR0YWNoZWQgdG8gbXkgb3ZpcnQgY2x1c3Rlci4gCkkgY2FuIHNlZSB0aGUgdXNl cnMgb24gb3ZpcnQgdXNlciB0YWIsIGJ1dCBhZnRlciBhdXRoIEkgYWx3YXlzIGdldCB0aGlzIGVy cm9yOiAKCkNhbm5vdCBMb2dpbi4gVXNlciBQYXNzd29yZCBoYXMgZXhwaXJlZC4gVXNlIHRoZSBm b2xsb3dpbmcgVVJMIHRvIGNoYW5nZSB0aGUgcGFzc3dvcmQ6IChub3RoaW5nKSAKCkkgaGF2ZSB0 cnkgb3V0IHdpdGggZGlmZmVyZW50IGxvbmcgcGFzc3dvcmRzIGFuZCBkaWZmZXJlbnQgdXNlcnMs IGJ1dCBpdCdzIHNhbWUuIAoKSXMgdGhpcyB2ZXJzaW9uIGNvbXBhdGlibGUgd2l0aCBvdmlydCAz LjU/IAoKV2hhdCBkaWQgSSB3cm9uZz8gCgpUaGFua3MgaW4gYWR2YW5jZSwgClRpYm9yIAoKLS0t LS0tPV9QYXJ0XzY3MjcxMzNfMzI1NzI4Njg1LjE0MTY0MTU1OTI0MjEKQ29udGVudC1UeXBlOiB0 ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgKQ29udGVudC1UcmFuc2Zlci1FbmNvZGluZzogcXVvdGVk LXByaW50YWJsZQoKPGh0bWw+PGJvZHk+PGRpdiBzdHlsZT0zRCJmb250LWZhbWlseTogdGltZXMg bmV3IHJvbWFuLCBuZXcgeW9yaywgdGltZXMsIHNlPQpyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29s b3I6ICMwMDAwMDAiPjxkaXY+SGksPC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5JIGg9CmF2ZSBh biBJUEEgc2VydmVyIDMuMCBvbiBjZW50b3MgNi42LjwvZGl2PjxkaXY+SSBzdWNjZXNzZnVsbHkg YXR0YWNoZWQgdG8gbT0KeSBvdmlydCBjbHVzdGVyLiZuYnNwOzwvZGl2PjxkaXY+SSBjYW4gc2Vl IHRoZSB1c2VycyBvbiBvdmlydCB1c2VyIHRhYiwgYnV0PQogYWZ0ZXIgYXV0aCBJIGFsd2F5cyBn ZXQgdGhpcyBlcnJvcjo8L2Rpdj48ZGl2PjxzcGFuIGFyaWEtaGlkZGVuPTNEImZhbHNlIiA9CmNs YXNzPTNEImxhYmVsIGxhYmVsLWRlZmF1bHQgR0xHUlExT0RIRUMgdGVtcC1saW5rLWNvbG9yIj48 YnI+PC9zcGFuPjwvZGl2Pj0KPGRpdj48c3BhbiBhcmlhLWhpZGRlbj0zRCJmYWxzZSIgY2xhc3M9 M0QibGFiZWwgbGFiZWwtZGVmYXVsdCBHTEdSUTFPREhFQyB0PQplbXAtbGluay1jb2xvciI+Q2Fu bm90IExvZ2luLiBVc2VyIFBhc3N3b3JkIGhhcyBleHBpcmVkLiBVc2UgdGhlIGZvbGxvd2luZyA9 ClVSTCB0byBjaGFuZ2UgdGhlIHBhc3N3b3JkOiAobm90aGluZyk8L3NwYW4+PC9kaXY+PGRpdj48 c3BhbiBhcmlhLWhpZGRlbj0zRD0KImZhbHNlIiBjbGFzcz0zRCJsYWJlbCBsYWJlbC1kZWZhdWx0 IEdMR1JRMU9ESEVDIHRlbXAtbGluay1jb2xvciI+PGJyPjwvc3BhPQpuPjwvZGl2PjxkaXY+PHNw YW4gYXJpYS1oaWRkZW49M0QiZmFsc2UiIGNsYXNzPTNEImxhYmVsIGxhYmVsLWRlZmF1bHQgR0xH UlE9CjFPREhFQyB0ZW1wLWxpbmstY29sb3IiPkkgaGF2ZSB0cnkgb3V0IHdpdGggZGlmZmVyZW50 IGxvbmcgcGFzc3dvcmRzIGFuZCBkaT0KZmZlcmVudCB1c2VycywgYnV0IGl0J3Mgc2FtZS48L3Nw YW4+PC9kaXY+PGRpdj48c3BhbiBhcmlhLWhpZGRlbj0zRCJmYWxzZSIgPQpjbGFzcz0zRCJsYWJl bCBsYWJlbC1kZWZhdWx0IEdMR1JRMU9ESEVDIHRlbXAtbGluay1jb2xvciI+PGJyPklzIHRoaXMg dmVyc2k9Cm9uIGNvbXBhdGlibGUgd2l0aCBvdmlydCAzLjU/PC9zcGFuPjwvZGl2PjxkaXY+PGJy PjwvZGl2PjxkaXY+V2hhdCBkaWQgSSB3cj0Kb25nPzwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+ VGhhbmtzIGluIGFkdmFuY2UsPC9kaXY+PGRpdj5UaWJvcjwvZGl2PjwvZGl2PQo+PC9ib2R5Pjwv aHRtbD4KLS0tLS0tPV9QYXJ0XzY3MjcxMzNfMzI1NzI4Njg1LjE0MTY0MTU1OTI0MjEtLQo= --===============8443524904117080501==-- From alonbl at redhat.com Wed Nov 19 11:55:09 2014 Content-Type: multipart/mixed; boundary="===============2536001619897647737==" MIME-Version: 1.0 From: Alon Bar-Lev To: users at ovirt.org Subject: Re: [ovirt-users] IPA-auth: user password expired Date: Wed, 19 Nov 2014 11:55:04 -0500 Message-ID: <187556873.910849.1416416104885.JavaMail.zimbra@redhat.com> In-Reply-To: 586192592.6727134.1416415592422.JavaMail.zimbra@itsmart.hu --===============2536001619897647737== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ----- Original Message ----- > From: "Demeter Tibor" > To: "users(a)ovirt.org List" > Sent: Wednesday, November 19, 2014 6:46:32 PM > Subject: [ovirt-users] IPA-auth: user password expired > = > Hi, > = > I have an IPA server 3.0 on centos 6.6. > I successfully attached to my ovirt cluster. > I can see the users on ovirt user tab, but after auth I always get this > error: > = > Cannot Login. User Password has expired. Use the following URL to change = the > password: (nothing) > = > I have try out with different long passwords and different users, but it's > same. > = > Is this version compatible with ovirt 3.5? > = > What did I wrong? > = Logs will be nice /var/log/ovirt-engine/engine.log. Also testing the new ovirt-engine-extension-aaa-ldap provider from 3.5 snap= shots repo will be nice[1] [1] http://gerrit.ovirt.org/gitweb?p=3Dovirt-engine-extension-aaa-ldap.git;= a=3Dblob;f=3DREADME;hb=3DHEAD --===============2536001619897647737==-- From ekin.meroglu at linuxera.com Wed Nov 19 12:32:34 2014 Content-Type: multipart/mixed; boundary="===============8361161381450610143==" MIME-Version: 1.0 From: =?utf-8?q?Ekin_Mero=C4=9Flu_=3Cekin=2Emeroglu_at_linuxera=2Ecom=3E?= To: users at ovirt.org Subject: Re: [ovirt-users] IPA-auth: user password expired Date: Wed, 19 Nov 2014 19:32:12 +0200 Message-ID: In-Reply-To: 586192592.6727134.1416415592422.JavaMail.zimbra@itsmart.hu --===============8361161381450610143== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi Tibor, On Wed, Nov 19, 2014 at 6:46 PM, Demeter Tibor wrot= e: > Hi, > > I have an IPA server 3.0 on centos 6.6. > I successfully attached to my ovirt cluster. > I can see the users on ovirt user tab, but after auth I always get this > error: > > Cannot Login. User Password has expired. Use the following URL to change > the password: (nothing) > > I have try out with different long passwords and different users, but it's > same. > =E2=80=8BDid you try accessing a regular linux client with the same account= ? In IPA, new user passwords are always set as expired by design - please see [1]. To test this, you can try to login a client. If it is really expired, system will ask you to provide a new password. After this, you'll be able to login RHEVM with the new password you've just set. =E2=80=8B[1] http://www.freeipa.org/page/New_Passwords_Expired=E2=80=8B Regards, -- Ekin --===============8361161381450610143== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgVGlib3IsPC9kaXY+PGRp diBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+T24gV2Vk LCBOb3YgMTksIDIwMTQgYXQgNjo0NiBQTSwgRGVtZXRlciBUaWJvciA8c3BhbiBkaXI9Imx0ciI+ Jmx0OzxhIGhyZWY9Im1haWx0bzp0ZGVtZXRlckBpdHNtYXJ0Lmh1IiB0YXJnZXQ9Il9ibGFuayI+ dGRlbWV0ZXJAaXRzbWFydC5odTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2NrcXVvdGUg Y2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4IDAuOGV4O2JvcmRl ci1sZWZ0LXdpZHRoOjFweDtib3JkZXItbGVmdC1jb2xvcjpyZ2IoMjA0LDIwNCwyMDQpO2JvcmRl ci1sZWZ0LXN0eWxlOnNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYgc3R5bGU9ImZvbnQtZmFt aWx5OiYjMzk7dGltZXMgbmV3IHJvbWFuJiMzOTssJiMzOTtuZXcgeW9yayYjMzk7LHRpbWVzLHNl cmlmO2ZvbnQtc2l6ZToxMnB0O2NvbG9yOnJnYigwLDAsMCkiPjxkaXY+SGksPC9kaXY+PGRpdj48 YnI+PC9kaXY+PGRpdj5JIGhhdmUgYW4gSVBBIHNlcnZlciAzLjAgb24gY2VudG9zIDYuNi48L2Rp dj48ZGl2Pkkgc3VjY2Vzc2Z1bGx5IGF0dGFjaGVkIHRvIG15IG92aXJ0IGNsdXN0ZXIuwqA8L2Rp dj48ZGl2PkkgY2FuIHNlZSB0aGUgdXNlcnMgb24gb3ZpcnQgdXNlciB0YWIsIGJ1dCBhZnRlciBh dXRoIEkgYWx3YXlzIGdldCB0aGlzIGVycm9yOjwvZGl2PjxkaXY+PHNwYW4+PGJyPjwvc3Bhbj48 L2Rpdj48ZGl2PjxzcGFuPkNhbm5vdCBMb2dpbi4gVXNlciBQYXNzd29yZCBoYXMgZXhwaXJlZC4g VXNlIHRoZSBmb2xsb3dpbmcgVVJMIHRvIGNoYW5nZSB0aGUgcGFzc3dvcmQ6IChub3RoaW5nKTwv c3Bhbj48L2Rpdj48ZGl2PjxzcGFuPjxicj48L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj5JIGhhdmUg dHJ5IG91dCB3aXRoIGRpZmZlcmVudCBsb25nIHBhc3N3b3JkcyBhbmQgZGlmZmVyZW50IHVzZXJz LCBidXQgaXQmIzM5O3Mgc2FtZS48L3NwYW4+PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3RlPjxkaXY+ PGJyPjwvZGl2PjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbDtkaXNwbGF5OmlubGluZSI+4oCL RGlkIHlvdSB0cnkgYWNjZXNzaW5nIGEgcmVndWxhciBsaW51eCBjbGllbnQgd2l0aCB0aGUgc2Ft ZSBhY2NvdW50PyBJbiBJUEEsIG5ldyB1c2VyIHBhc3N3b3JkcyBhcmUgYWx3YXlzIHNldCBhcyBl eHBpcmVkIGJ5IGRlc2lnbiDCoC0gcGxlYXNlIHNlZSBbMV0uwqA8L2Rpdj48L2Rpdj48ZGl2Pjxk aXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1z ZXJpZjtmb250LXNpemU6c21hbGw7ZGlzcGxheTppbmxpbmUiPjxicj48L2Rpdj48L2Rpdj48ZGl2 PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fu cy1zZXJpZjtmb250LXNpemU6c21hbGw7ZGlzcGxheTppbmxpbmUiPlRvIHRlc3QgdGhpcywgeW91 IGNhbiB0cnkgdG8gbG9naW4gYSBjbGllbnQuIElmIGl0IGlzIHJlYWxseSBleHBpcmVkLCBzeXN0 ZW0gd2lsbCBhc2sgeW91IHRvIHByb3ZpZGUgYSBuZXcgcGFzc3dvcmQuIEFmdGVyIHRoaXMsIHlv dSYjMzk7bGwgYmUgYWJsZSB0byBsb2dpbiDCoFJIRVZNIHdpdGggdGhlIG5ldyBwYXNzd29yZCB5 b3UmIzM5O3ZlIGp1c3Qgc2V0LjwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXYgY2xhc3M9 ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250 LXNpemU6c21hbGwiPuKAi1sxXcKgPC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5 bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+PGEgaHJl Zj0iaHR0cDovL3d3dy5mcmVlaXBhLm9yZy9wYWdlL05ld19QYXNzd29yZHNfRXhwaXJlZCI+aHR0 cDovL3d3dy5mcmVlaXBhLm9yZy9wYWdlL05ld19QYXNzd29yZHNfRXhwaXJlZDwvYT7igIs8L2Rp dj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21hLHNh bnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVm YXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFs bCI+UmVnYXJkcyw8L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1m YW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj4tLTwvZGl2PjxkaXYgY2xh c3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtm b250LXNpemU6c21hbGwiPkVraW48L2Rpdj48L2Rpdj4KPC9kaXY+PC9kaXY+Cg== --===============8361161381450610143==-- From tdemeter at itsmart.hu Wed Nov 19 13:39:03 2014 Content-Type: multipart/mixed; boundary="===============7382935045714800137==" MIME-Version: 1.0 From: Demeter Tibor To: users at ovirt.org Subject: Re: [ovirt-users] IPA-auth: user password expired Date: Wed, 19 Nov 2014 19:38:55 +0100 Message-ID: <759348954.6733634.1416422335900.JavaMail.zimbra@itsmart.hu> In-Reply-To: CAA0tEyNU40Z769pKeLnAa2Ly9Fs=HqcbL5=kJH4uAUFJa+juMA@mail.gmail.com --===============7382935045714800137== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ------=3D_Part_6733633_1982062574.1416422335899 Content-Type: text/plain; charset=3Dutf-8 Content-Transfer-Encoding: quoted-printable Hi,=3D20 I don't have linux client.=3D20 Can I change password without this?=3D20 Thanks,=3D20 Tibor=3D20 ----- Eredeti =3DC3=3DBCzenet ----- > Hi Tibor, > On Wed, Nov 19, 2014 at 6:46 PM, Demeter Tibor < tdemeter(a)itsmart.hu > = wr=3D ote: > > Hi, >=3D20 > > I have an IPA server 3.0 on centos 6.6. >=3D20 > > I successfully attached to my ovirt cluster. >=3D20 > > I can see the users on ovirt user tab, but after auth I always get this > > error: >=3D20 > > Cannot Login. User Password has expired. Use the following URL to chang= =3D e > > the > > password: (nothing) >=3D20 > > I have try out with different long passwords and different users, but i= =3D t's > > same. >=3D20 > =3DE2=3D80=3D8BDid you try accessing a regular linux client with the same= accou=3D nt? In IPA, > new user passwords are always set as expired by design - please see [1]. > To test this, you can try to login a client. If it is really expired, sys= =3D tem > will ask you to provide a new password. After this, you'll be able to log= =3D in > RHEVM with the new password you've just set. > =3DE2=3D80=3D8B[1] > http://www.freeipa.org/page/New_Passwords_Expired =3DE2=3D80=3D8B > Regards, > -- > Ekin ------=3D_Part_6733633_1982062574.1416422335899 Content-Type: text/html; charset=3Dutf-8 Content-Transfer-Encoding: quoted-printable

Hi,

I don't have linux client.

Can I change password without this?

Thanks,

Tibor

Hi Tibor,

On Wed, Nov 19, 2014 at 6:46 PM, Demeter Tibor <t=3D demeter(a)itsmart.hu> wrote:
Hi,

I have an IPA server 3.0 on ce= =3D ntos 6.6.
I successfully attached to my ovirt cluster.
I can see the users on ovirt user tab, but after auth I always get th= =3D is error:

Cannot Login. User Pa= =3D ssword has expired. Use the following URL to change the password: (nothing)= =3D

I have try out with dif= =3D ferent long passwords and different users, but it's same.

=3DE2=3D80=3D8BD= id you=3D try accessing a regular linux client with the same account? In IPA, new us= =3D er passwords are always set as expired by design - please see [1].&nb= =3D sp;

To test this, you can try to login a client. If it is reall= =3D y expired, system will ask you to provide a new password. After this, you'l= =3D l be able to login RHEVM with the new password you've just set.
= =3D

=3DE2=3D80=3D8B[1]
htt= p:=3D //www.freeipa.org/page/New_Passwords_Expired=3DE2=3D80=3D8B
=3D
Regards,
--
Ekin
<= /d=3D iv>

------=3D_Part_6733633_1982062574.1416422335899-- --===============7382935045714800137== Content-Type: multipart/alternative MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.bin" LS0tLS0tPV9QYXJ0XzY3MzM2MzNfMTk4MjA2MjU3NC4xNDE2NDIyMzM1ODk5CkNvbnRlbnQtVHlw ZTogdGV4dC9wbGFpbjsgY2hhcnNldD11dGYtOApDb250ZW50LVRyYW5zZmVyLUVuY29kaW5nOiBx dW90ZWQtcHJpbnRhYmxlCgpIaSw9MjAKCkkgZG9uJ3QgaGF2ZSBsaW51eCBjbGllbnQuPTIwCkNh biBJIGNoYW5nZSBwYXNzd29yZCB3aXRob3V0IHRoaXM/PTIwCgpUaGFua3MsPTIwCgpUaWJvcj0y MAoKLS0tLS0gRXJlZGV0aSA9QzM9QkN6ZW5ldCAtLS0tLQoKPiBIaSBUaWJvciwKCj4gT24gV2Vk LCBOb3YgMTksIDIwMTQgYXQgNjo0NiBQTSwgRGVtZXRlciBUaWJvciA8IHRkZW1ldGVyQGl0c21h cnQuaHUgPiB3cj0Kb3RlOgoKPiA+IEhpLAo+PTIwCgo+ID4gSSBoYXZlIGFuIElQQSBzZXJ2ZXIg My4wIG9uIGNlbnRvcyA2LjYuCj49MjAKPiA+IEkgc3VjY2Vzc2Z1bGx5IGF0dGFjaGVkIHRvIG15 IG92aXJ0IGNsdXN0ZXIuCj49MjAKPiA+IEkgY2FuIHNlZSB0aGUgdXNlcnMgb24gb3ZpcnQgdXNl ciB0YWIsIGJ1dCBhZnRlciBhdXRoIEkgYWx3YXlzIGdldCB0aGlzCj4gPiBlcnJvcjoKPj0yMAoK PiA+IENhbm5vdCBMb2dpbi4gVXNlciBQYXNzd29yZCBoYXMgZXhwaXJlZC4gVXNlIHRoZSBmb2xs b3dpbmcgVVJMIHRvIGNoYW5nPQplCj4gPiB0aGUKPiA+IHBhc3N3b3JkOiAobm90aGluZykKPj0y MAoKPiA+IEkgaGF2ZSB0cnkgb3V0IHdpdGggZGlmZmVyZW50IGxvbmcgcGFzc3dvcmRzIGFuZCBk aWZmZXJlbnQgdXNlcnMsIGJ1dCBpPQp0J3MKPiA+IHNhbWUuCj49MjAKCj4gPUUyPTgwPThCRGlk IHlvdSB0cnkgYWNjZXNzaW5nIGEgcmVndWxhciBsaW51eCBjbGllbnQgd2l0aCB0aGUgc2FtZSBh Y2NvdT0KbnQ/IEluIElQQSwKPiBuZXcgdXNlciBwYXNzd29yZHMgYXJlIGFsd2F5cyBzZXQgYXMg ZXhwaXJlZCBieSBkZXNpZ24gLSBwbGVhc2Ugc2VlIFsxXS4KCj4gVG8gdGVzdCB0aGlzLCB5b3Ug Y2FuIHRyeSB0byBsb2dpbiBhIGNsaWVudC4gSWYgaXQgaXMgcmVhbGx5IGV4cGlyZWQsIHN5cz0K dGVtCj4gd2lsbCBhc2sgeW91IHRvIHByb3ZpZGUgYSBuZXcgcGFzc3dvcmQuIEFmdGVyIHRoaXMs IHlvdSdsbCBiZSBhYmxlIHRvIGxvZz0KaW4KPiBSSEVWTSB3aXRoIHRoZSBuZXcgcGFzc3dvcmQg eW91J3ZlIGp1c3Qgc2V0LgoKPiA9RTI9ODA9OEJbMV0KPiBodHRwOi8vd3d3LmZyZWVpcGEub3Jn L3BhZ2UvTmV3X1Bhc3N3b3Jkc19FeHBpcmVkID1FMj04MD04QgoKPiBSZWdhcmRzLAo+IC0tCj4g RWtpbgoKLS0tLS0tPV9QYXJ0XzY3MzM2MzNfMTk4MjA2MjU3NC4xNDE2NDIyMzM1ODk5CkNvbnRl bnQtVHlwZTogdGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04CkNvbnRlbnQtVHJhbnNmZXItRW5jb2Rp bmc6IHF1b3RlZC1wcmludGFibGUKCjxodG1sPjxib2R5PjxkaXYgc3R5bGU9M0QiZm9udC1mYW1p bHk6IHRpbWVzIG5ldyByb21hbiwgbmV3IHlvcmssIHRpbWVzLCBzZT0KcmlmOyBmb250LXNpemU6 IDEycHQ7IGNvbG9yOiAjMDAwMDAwIj48ZGl2PkhpLDxicj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48 ZGl2PQo+SSBkb24ndCBoYXZlIGxpbnV4IGNsaWVudC48L2Rpdj48ZGl2PkNhbiBJIGNoYW5nZSBw YXNzd29yZCB3aXRob3V0IHRoaXM/PC89CmRpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PlRoYW5rcyw8 L2Rpdj48ZGl2Pjxicj5UaWJvcjwvZGl2PjxkaXY+PGJyPjwvZGl2Pjxocj0KIGlkPTNEInp3Y2hy Ij48YmxvY2txdW90ZSBzdHlsZT0zRCJib3JkZXItbGVmdDoycHggc29saWQgIzEwMTBGRjttYXJn aW4tbGVmPQp0OjVweDtwYWRkaW5nLWxlZnQ6NXB4O2NvbG9yOiMwMDA7Zm9udC13ZWlnaHQ6bm9y bWFsO2ZvbnQtc3R5bGU6bm9ybWFsO3RleHQ9Ci1kZWNvcmF0aW9uOm5vbmU7Zm9udC1mYW1pbHk6 SGVsdmV0aWNhLEFyaWFsLHNhbnMtc2VyaWY7Zm9udC1zaXplOjEycHQ7Ij48ZD0KaXYgZGlyPTNE Imx0ciI+PGRpdiBjbGFzcz0zRCJnbWFpbF9kZWZhdWx0IiBzdHlsZT0zRCJmb250LWZhbWlseTp0 YWhvbWEsc2FuPQpzLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgVGlib3IsPC9kaXY+PGRpdiBj bGFzcz0zRCJnbWFpbF9leHRyYSI+PGJyPjxkaXY9CiBjbGFzcz0zRCJnbWFpbF9xdW90ZSI+T24g V2VkLCBOb3YgMTksIDIwMTQgYXQgNjo0NiBQTSwgRGVtZXRlciBUaWJvciA8c3Bhbj0KIGRpcj0z RCJsdHIiPiZsdDs8YSBocmVmPTNEIm1haWx0bzp0ZGVtZXRlckBpdHNtYXJ0Lmh1IiB0YXJnZXQ9 M0QiX2JsYW5rIj50PQpkZW1ldGVyQGl0c21hcnQuaHU8L2E+Jmd0Ozwvc3Bhbj4gd3JvdGU6PGJy PjxibG9ja3F1b3RlIGNsYXNzPTNEImdtYWlsX3F1b3Q9CmUiIHN0eWxlPTNEIm1hcmdpbjowcHgg MHB4IDBweCAwLjhleDtib3JkZXItbGVmdC13aWR0aDoxcHg7Ym9yZGVyLWxlZnQtY29sbz0Kcjpy Z2IoMjA0LDIwNCwyMDQpO2JvcmRlci1sZWZ0LXN0eWxlOnNvbGlkO3BhZGRpbmctbGVmdDoxZXgi PjxkaXYgc3R5bGU9M0QiPQpmb250LWZhbWlseTondGltZXMgbmV3IHJvbWFuJywnbmV3IHlvcmsn LHRpbWVzLHNlcmlmO2ZvbnQtc2l6ZToxMnB0O2NvbG9yOnI9CmdiKDAsMCwwKSI+PGRpdj5IaSw8 L2Rpdj48ZGl2Pjxicj48L2Rpdj48ZGl2PkkgaGF2ZSBhbiBJUEEgc2VydmVyIDMuMCBvbiBjZT0K bnRvcyA2LjYuPC9kaXY+PGRpdj5JIHN1Y2Nlc3NmdWxseSBhdHRhY2hlZCB0byBteSBvdmlydCBj bHVzdGVyLiZuYnNwOzwvZGl2PQo+PGRpdj5JIGNhbiBzZWUgdGhlIHVzZXJzIG9uIG92aXJ0IHVz ZXIgdGFiLCBidXQgYWZ0ZXIgYXV0aCBJIGFsd2F5cyBnZXQgdGg9CmlzIGVycm9yOjwvZGl2Pjxk aXY+PHNwYW4+PGJyPjwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPkNhbm5vdCBMb2dpbi4gVXNlciBQ YT0Kc3N3b3JkIGhhcyBleHBpcmVkLiBVc2UgdGhlIGZvbGxvd2luZyBVUkwgdG8gY2hhbmdlIHRo ZSBwYXNzd29yZDogKG5vdGhpbmcpPQo8L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj48YnI+PC9zcGFu PjwvZGl2PjxkaXY+PHNwYW4+SSBoYXZlIHRyeSBvdXQgd2l0aCBkaWY9CmZlcmVudCBsb25nIHBh c3N3b3JkcyBhbmQgZGlmZmVyZW50IHVzZXJzLCBidXQgaXQncyBzYW1lLjwvc3Bhbj48L2Rpdj48 L2Rpdj0KPjwvYmxvY2txdW90ZT48ZGl2Pjxicj48L2Rpdj48ZGl2PjxkaXYgY2xhc3M9M0QiZ21h aWxfZGVmYXVsdCIgc3R5bGU9M0QiZm9uPQp0LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250 LXNpemU6c21hbGw7ZGlzcGxheTppbmxpbmUiPj1FMj04MD04QkRpZCB5b3U9CiB0cnkgYWNjZXNz aW5nIGEgcmVndWxhciBsaW51eCBjbGllbnQgd2l0aCB0aGUgc2FtZSBhY2NvdW50PyBJbiBJUEEs IG5ldyB1cz0KZXIgcGFzc3dvcmRzIGFyZSBhbHdheXMgc2V0IGFzIGV4cGlyZWQgYnkgZGVzaWdu ICZuYnNwOy0gcGxlYXNlIHNlZSBbMV0uJm5iPQpzcDs8L2Rpdj48L2Rpdj48ZGl2PjxkaXYgY2xh c3M9M0QiZ21haWxfZGVmYXVsdCIgc3R5bGU9M0QiZm9udC1mYW1pbHk6dGFob209CmEsc2Fucy1z ZXJpZjtmb250LXNpemU6c21hbGw7ZGlzcGxheTppbmxpbmUiPjxicj48L2Rpdj48L2Rpdj48ZGl2 PjxkaXYgY2xhcz0Kcz0zRCJnbWFpbF9kZWZhdWx0IiBzdHlsZT0zRCJmb250LWZhbWlseTp0YWhv bWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGw7PQpkaXNwbGF5OmlubGluZSI+VG8gdGVzdCB0 aGlzLCB5b3UgY2FuIHRyeSB0byBsb2dpbiBhIGNsaWVudC4gSWYgaXQgaXMgcmVhbGw9CnkgZXhw aXJlZCwgc3lzdGVtIHdpbGwgYXNrIHlvdSB0byBwcm92aWRlIGEgbmV3IHBhc3N3b3JkLiBBZnRl ciB0aGlzLCB5b3UnbD0KbCBiZSBhYmxlIHRvIGxvZ2luICZuYnNwO1JIRVZNIHdpdGggdGhlIG5l dyBwYXNzd29yZCB5b3UndmUganVzdCBzZXQuPC9kaXY+PQo8L2Rpdj48ZGl2Pjxicj48L2Rpdj48 ZGl2IGNsYXNzPTNEImdtYWlsX2RlZmF1bHQiIHN0eWxlPTNEImZvbnQtZmFtaWx5OnRhaG89Cm1h LHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj49RTI9ODA9OEJbMV0mbmJzcDs8L2Rpdj48ZGl2 IGNsYXNzPTNEImdtYWlsXz0KZGVmYXVsdCIgc3R5bGU9M0QiZm9udC1mYW1pbHk6dGFob21hLHNh bnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj48YSBocmVmPTNEPQoiaHR0cDovL3d3dy5mcmVlaXBh Lm9yZy9wYWdlL05ld19QYXNzd29yZHNfRXhwaXJlZCIgdGFyZ2V0PTNEIl9ibGFuayI+aHR0cDo9 Ci8vd3d3LmZyZWVpcGEub3JnL3BhZ2UvTmV3X1Bhc3N3b3Jkc19FeHBpcmVkPC9hPj1FMj04MD04 QjwvZGl2PjxkaXYgY2xhc3M9Cj0zRCJnbWFpbF9kZWZhdWx0IiBzdHlsZT0zRCJmb250LWZhbWls eTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPj0KPGJyPjwvZGl2PjxkaXYgY2xh c3M9M0QiZ21haWxfZGVmYXVsdCIgc3R5bGU9M0QiZm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2Vy PQppZjtmb250LXNpemU6c21hbGwiPlJlZ2FyZHMsPC9kaXY+PGRpdiBjbGFzcz0zRCJnbWFpbF9k ZWZhdWx0IiBzdHlsZT0zRCJmb249CnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6 ZTpzbWFsbCI+LS08L2Rpdj48ZGl2IGNsYXNzPTNEImdtYWlsX2RlZj0KYXVsdCIgc3R5bGU9M0Qi Zm9udC1mYW1pbHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5Fa2luPC9kaXY+ PC9kPQppdj4KPC9kaXY+PC9kaXY+CjwvYmxvY2txdW90ZT48ZGl2Pjxicj48L2Rpdj48L2Rpdj48 L2JvZHk+PC9odG1sPgotLS0tLS09X1BhcnRfNjczMzYzM18xOTgyMDYyNTc0LjE0MTY0MjIzMzU4 OTktLQo= --===============7382935045714800137==-- From ekin.meroglu at linuxera.com Wed Nov 19 13:50:55 2014 Content-Type: multipart/mixed; boundary="===============5415863195040491807==" MIME-Version: 1.0 From: =?utf-8?q?Ekin_Mero=C4=9Flu_=3Cekin=2Emeroglu_at_linuxera=2Ecom=3E?= To: users at ovirt.org Subject: Re: [ovirt-users] IPA-auth: user password expired Date: Wed, 19 Nov 2014 20:50:34 +0200 Message-ID: In-Reply-To: 759348954.6733634.1416422335900.JavaMail.zimbra@itsmart.hu --===============5415863195040491807== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Hi, An ldappasswd command would change it without setting as expired. It will prompt twice for the account password you'll set, and the password for the directory manager once: $ ldappasswd -ZZ -D 'cn=3Ddirectory manager' -W -S uid=3DUSERNAME,cn=3Dusers,cn=3Daccounts,dc=3Dexample,dc=3Dorg -H ldap:// ipaserver.example.org You'll need to set the username (USERNAME) domain (example.org) and server FQDN accordingly. Hope this helps, On Wed, Nov 19, 2014 at 8:38 PM, Demeter Tibor wrot= e: > Hi, > > I don't have linux client. > Can I change password without this? > > Thanks, > > Tibor > > ------------------------------ > > Hi Tibor, > > On Wed, Nov 19, 2014 at 6:46 PM, Demeter Tibor > wrote: > >> Hi, >> >> I have an IPA server 3.0 on centos 6.6. >> I successfully attached to my ovirt cluster. >> I can see the users on ovirt user tab, but after auth I always get this >> error: >> >> Cannot Login. User Password has expired. Use the following URL to change >> the password: (nothing) >> >> I have try out with different long passwords and different users, but >> it's same. >> > > =E2=80=8BDid you try accessing a regular linux client with the same accou= nt? In > IPA, new user passwords are always set as expired by design - please see > [1]. > > To test this, you can try to login a client. If it is really expired, > system will ask you to provide a new password. After this, you'll be able > to login RHEVM with the new password you've just set. > > =E2=80=8B[1] > http://www.freeipa.org/page/New_Passwords_Expired=E2=80=8B > > Regards, > -- > Ekin > > > -- = Ekin Mero=C4=9Flu *Red Hat Certified Datacenter Specialist* *linuxera* =C3=96zg=C3=BCr Yaz=C4=B1l=C4=B1m =C3=87=C3=B6z=C3=BCm ve Hizmet= leri *T* +90 (850) 22 LINUX *GSM* +90 (532) 137 77 04 --===============5415863195040491807== Content-Type: text/html MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="attachment.html" PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFt aWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGksPC9kaXY+PGRpdiBjbGFz cz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2Zv bnQtc2l6ZTpzbWFsbCI+PGJyPjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxl PSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGwiPkFuIGxkYXBw YXNzd2QgY29tbWFuZCB3b3VsZCBjaGFuZ2UgaXQgd2l0aG91dCBzZXR0aW5nIGFzIGV4cGlyZWQu IEl0IHdpbGwgcHJvbXB0IHR3aWNlIGZvciB0aGUgYWNjb3VudCBwYXNzd29yZCB5b3UmIzM5O2xs IHNldCwgYW5kIHRoZSBwYXNzd29yZCBmb3IgdGhlIGRpcmVjdG9yeSDCoG1hbmFnZXIgb25jZTo8 L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1pbHk6dGFob21h LHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj48YnI+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxf ZGVmYXVsdCIgc3R5bGU+PGZvbnQgZmFjZT0ibW9ub3NwYWNlIj4kIGxkYXBwYXNzd2QgLVpaIC1E ICYjMzk7Y249ZGlyZWN0b3J5IG1hbmFnZXImIzM5OyAtVyAtUyB1aWQ9VVNFUk5BTUUsY249dXNl cnMsY249YWNjb3VudHMsZGM9ZXhhbXBsZSxkYz1vcmcgLUggbGRhcDovLzxhIGhyZWY9Imh0dHA6 Ly9pcGFzZXJ2ZXIuZXhhbXBsZS5vcmciPmlwYXNlcnZlci5leGFtcGxlLm9yZzwvYT48L2ZvbnQ+ PGJyPjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPjxmb250IGZhY2U9InRh aG9tYSwgc2Fucy1zZXJpZiI+PGJyPjwvZm9udD48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZh dWx0IiBzdHlsZT48Zm9udCBmYWNlPSJ0YWhvbWEsIHNhbnMtc2VyaWYiPllvdSYjMzk7bGwgbmVl ZCB0byBzZXQgdGhlIHVzZXJuYW1lIChVU0VSTkFNRSkgZG9tYWluICg8YSBocmVmPSJodHRwOi8v ZXhhbXBsZS5vcmciPmV4YW1wbGUub3JnPC9hPikgYW5kIHNlcnZlciBGUUROIGFjY29yZGluZ2x5 LjwvZm9udD48L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT48Zm9udCBmYWNl PSJ0YWhvbWEsIHNhbnMtc2VyaWYiPjxicj48L2ZvbnQ+PC9kaXY+PGRpdiBjbGFzcz0iZ21haWxf ZGVmYXVsdCIgc3R5bGU+PGZvbnQgZmFjZT0idGFob21hLCBzYW5zLXNlcmlmIj5Ib3BlIHRoaXMg aGVscHMsPC9mb250PjwvZGl2PjwvZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2V4dHJhIj48YnI+PGRp diBjbGFzcz0iZ21haWxfcXVvdGUiPk9uIFdlZCwgTm92IDE5LCAyMDE0IGF0IDg6MzggUE0sIERl bWV0ZXIgVGlib3IgPHNwYW4gZGlyPSJsdHIiPiZsdDs8YSBocmVmPSJtYWlsdG86dGRlbWV0ZXJA aXRzbWFydC5odSIgdGFyZ2V0PSJfYmxhbmsiPnRkZW1ldGVyQGl0c21hcnQuaHU8L2E+Jmd0Ozwv c3Bhbj4gd3JvdGU6PGJyPjxibG9ja3F1b3RlIGNsYXNzPSJnbWFpbF9xdW90ZSIgc3R5bGU9Im1h cmdpbjowIDAgMCAuOGV4O2JvcmRlci1sZWZ0OjFweCAjY2NjIHNvbGlkO3BhZGRpbmctbGVmdDox ZXgiPjxkaXY+PGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6dGltZXMgbmV3IHJvbWFuLG5ldyB5b3Jr LHRpbWVzLHNlcmlmO2ZvbnQtc2l6ZToxMnB0O2NvbG9yOiMwMDAwMDAiPjxkaXY+SGksPGJyPjwv ZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+SSBkb24mIzM5O3QgaGF2ZSBsaW51eCBjbGllbnQuPC9k aXY+PGRpdj5DYW4gSSBjaGFuZ2UgcGFzc3dvcmQgd2l0aG91dCB0aGlzPzwvZGl2PjxkaXY+PGJy PjwvZGl2PjxkaXY+VGhhbmtzLDwvZGl2PjxkaXY+PGJyPlRpYm9yPC9kaXY+PGRpdj48YnI+PC9k aXY+PGhyPjxkaXY+PGRpdiBjbGFzcz0iaDUiPjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXItbGVm dDoycHggc29saWQgIzEwMTBmZjttYXJnaW4tbGVmdDo1cHg7cGFkZGluZy1sZWZ0OjVweDtjb2xv cjojMDAwO2ZvbnQtd2VpZ2h0Om5vcm1hbDtmb250LXN0eWxlOm5vcm1hbDt0ZXh0LWRlY29yYXRp b246bm9uZTtmb250LWZhbWlseTpIZWx2ZXRpY2EsQXJpYWwsc2Fucy1zZXJpZjtmb250LXNpemU6 MTJwdCI+PGRpdiBkaXI9Imx0ciI+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZv bnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+SGkgVGlib3IsPC9k aXY+PGRpdiBjbGFzcz0iZ21haWxfZXh0cmEiPjxicj48ZGl2IGNsYXNzPSJnbWFpbF9xdW90ZSI+ T24gV2VkLCBOb3YgMTksIDIwMTQgYXQgNjo0NiBQTSwgRGVtZXRlciBUaWJvciA8c3BhbiBkaXI9 Imx0ciI+Jmx0OzxhIGhyZWY9Im1haWx0bzp0ZGVtZXRlckBpdHNtYXJ0Lmh1IiB0YXJnZXQ9Il9i bGFuayI+dGRlbWV0ZXJAaXRzbWFydC5odTwvYT4mZ3Q7PC9zcGFuPiB3cm90ZTo8YnI+PGJsb2Nr cXVvdGUgY2xhc3M9ImdtYWlsX3F1b3RlIiBzdHlsZT0ibWFyZ2luOjBweCAwcHggMHB4IDAuOGV4 O2JvcmRlci1sZWZ0LXdpZHRoOjFweDtib3JkZXItbGVmdC1jb2xvcjpyZ2IoMjA0LDIwNCwyMDQp O2JvcmRlci1sZWZ0LXN0eWxlOnNvbGlkO3BhZGRpbmctbGVmdDoxZXgiPjxkaXYgc3R5bGU9ImZv bnQtZmFtaWx5OiYjMzk7dGltZXMgbmV3IHJvbWFuJiMzOTssJiMzOTtuZXcgeW9yayYjMzk7LHRp bWVzLHNlcmlmO2ZvbnQtc2l6ZToxMnB0O2NvbG9yOnJnYigwLDAsMCkiPjxkaXY+SGksPC9kaXY+ PGRpdj48YnI+PC9kaXY+PGRpdj5JIGhhdmUgYW4gSVBBIHNlcnZlciAzLjAgb24gY2VudG9zIDYu Ni48L2Rpdj48ZGl2Pkkgc3VjY2Vzc2Z1bGx5IGF0dGFjaGVkIHRvIG15IG92aXJ0IGNsdXN0ZXIu wqA8L2Rpdj48ZGl2PkkgY2FuIHNlZSB0aGUgdXNlcnMgb24gb3ZpcnQgdXNlciB0YWIsIGJ1dCBh ZnRlciBhdXRoIEkgYWx3YXlzIGdldCB0aGlzIGVycm9yOjwvZGl2PjxkaXY+PHNwYW4+PGJyPjwv c3Bhbj48L2Rpdj48ZGl2PjxzcGFuPkNhbm5vdCBMb2dpbi4gVXNlciBQYXNzd29yZCBoYXMgZXhw aXJlZC4gVXNlIHRoZSBmb2xsb3dpbmcgVVJMIHRvIGNoYW5nZSB0aGUgcGFzc3dvcmQ6IChub3Ro aW5nKTwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuPjxicj48L3NwYW4+PC9kaXY+PGRpdj48c3Bhbj5J IGhhdmUgdHJ5IG91dCB3aXRoIGRpZmZlcmVudCBsb25nIHBhc3N3b3JkcyBhbmQgZGlmZmVyZW50 IHVzZXJzLCBidXQgaXQmIzM5O3Mgc2FtZS48L3NwYW4+PC9kaXY+PC9kaXY+PC9ibG9ja3F1b3Rl PjxkaXY+PGJyPjwvZGl2PjxkaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9ImZv bnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbDtkaXNwbGF5OmlubGlu ZSI+4oCLRGlkIHlvdSB0cnkgYWNjZXNzaW5nIGEgcmVndWxhciBsaW51eCBjbGllbnQgd2l0aCB0 aGUgc2FtZSBhY2NvdW50PyBJbiBJUEEsIG5ldyB1c2VyIHBhc3N3b3JkcyBhcmUgYWx3YXlzIHNl dCBhcyBleHBpcmVkIGJ5IGRlc2lnbiDCoC0gcGxlYXNlIHNlZSBbMV0uwqA8L2Rpdj48L2Rpdj48 ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEs c2Fucy1zZXJpZjtmb250LXNpemU6c21hbGw7ZGlzcGxheTppbmxpbmUiPjxicj48L2Rpdj48L2Rp dj48ZGl2PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhv bWEsc2Fucy1zZXJpZjtmb250LXNpemU6c21hbGw7ZGlzcGxheTppbmxpbmUiPlRvIHRlc3QgdGhp cywgeW91IGNhbiB0cnkgdG8gbG9naW4gYSBjbGllbnQuIElmIGl0IGlzIHJlYWxseSBleHBpcmVk LCBzeXN0ZW0gd2lsbCBhc2sgeW91IHRvIHByb3ZpZGUgYSBuZXcgcGFzc3dvcmQuIEFmdGVyIHRo aXMsIHlvdSYjMzk7bGwgYmUgYWJsZSB0byBsb2dpbiDCoFJIRVZNIHdpdGggdGhlIG5ldyBwYXNz d29yZCB5b3UmIzM5O3ZlIGp1c3Qgc2V0LjwvZGl2PjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXYg Y2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fucy1zZXJp Zjtmb250LXNpemU6c21hbGwiPuKAi1sxXcKgPC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVs dCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+ PGEgaHJlZj0iaHR0cDovL3d3dy5mcmVlaXBhLm9yZy9wYWdlL05ld19QYXNzd29yZHNfRXhwaXJl ZCIgdGFyZ2V0PSJfYmxhbmsiPmh0dHA6Ly93d3cuZnJlZWlwYS5vcmcvcGFnZS9OZXdfUGFzc3dv cmRzX0V4cGlyZWQ8L2E+4oCLPC9kaXY+PGRpdiBjbGFzcz0iZ21haWxfZGVmYXVsdCIgc3R5bGU9 ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpzbWFsbCI+PGJyPjwvZGl2 PjxkaXYgY2xhc3M9ImdtYWlsX2RlZmF1bHQiIHN0eWxlPSJmb250LWZhbWlseTp0YWhvbWEsc2Fu cy1zZXJpZjtmb250LXNpemU6c21hbGwiPlJlZ2FyZHMsPC9kaXY+PGRpdiBjbGFzcz0iZ21haWxf ZGVmYXVsdCIgc3R5bGU9ImZvbnQtZmFtaWx5OnRhaG9tYSxzYW5zLXNlcmlmO2ZvbnQtc2l6ZTpz bWFsbCI+LS08L2Rpdj48ZGl2IGNsYXNzPSJnbWFpbF9kZWZhdWx0IiBzdHlsZT0iZm9udC1mYW1p bHk6dGFob21hLHNhbnMtc2VyaWY7Zm9udC1zaXplOnNtYWxsIj5Fa2luPC9kaXY+PC9kaXY+Cjwv ZGl2PjwvZGl2Pgo8L2Jsb2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+PC9kaXY+PC9kaXY+PC9kaXY+ PC9kaXY+PC9ibG9ja3F1b3RlPjwvZGl2Pjxicj48YnIgY2xlYXI9ImFsbCI+PGRpdj48YnI+PC9k aXY+LS0gPGJyPjxkaXYgY2xhc3M9ImdtYWlsX3NpZ25hdHVyZSI+PGRpdiBkaXI9Imx0ciI+PGZv bnQ+PGZvbnQgZmFjZT0idGFob21hLCBzYW5zLXNlcmlmIj5Fa2luIE1lcm/En2x1IDwvZm9udD48 Zm9udCBmYWNlPSJ0YWhvbWEsIHNhbnMtc2VyaWYiPjxpPlJlZCBIYXQgQ2VydGlmaWVkIERhdGFj ZW50ZXIgU3BlY2lhbGlzdDwvaT48YnI+PGI+bGludXhlcmE8L2I+IMOWemfDvHIgWWF6xLFsxLFt IMOHw7Z6w7xtIHZlIEhpem1ldGxlcmk8YnI+PGI+VDwvYj4gKzkwICg4NTApIDIyIExJTlVYIDxi PkdTTTwvYj4gKzkwICg1MzIpIDEzNyA3NyAwNDwvZm9udD48L2ZvbnQ+PC9kaXY+PC9kaXY+Cjwv ZGl2Pgo= --===============5415863195040491807==-- From tdemeter at itsmart.hu Thu Nov 20 03:11:12 2014 Content-Type: multipart/mixed; boundary="===============8647049910979885991==" MIME-Version: 1.0 From: Demeter Tibor To: users at ovirt.org Subject: Re: [ovirt-users] IPA-auth: user password expired Date: Thu, 20 Nov 2014 09:11:06 +0100 Message-ID: <148449010.6830392.1416471066746.JavaMail.zimbra@itsmart.hu> In-Reply-To: CAA0tEyOHtmZ8CuEnJtjUavCh=VncVKF2RMXAfUjr9EhyjOi+Pg@mail.gmail.com --===============8647049910979885991== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable ------=3D_Part_6830391_1351976731.1416471066743 Content-Type: text/plain; charset=3Dutf-8 Content-Transfer-Encoding: quoted-printable Hi,=3D20 Thank you, that's worked!=3D20 Bye=3D20 Tibor=3D20 ----- Eredeti =3DC3=3DBCzenet ----- > Hi, > An ldappasswd command would change it without setting as expired. It will > prompt twice for the account password you'll set, and the password for th= =3D e > directory manager once: > $ ldappasswd -ZZ -D 'cn=3D3Ddirectory manager' -W -S > uid=3D3DUSERNAME,cn=3D3Dusers,cn=3D3Daccounts,dc=3D3Dexample,dc=3D3Dorg -= H ldap:// > ipaserver.example.org > You'll need to set the username (USERNAME) domain ( example.org ) and ser= =3D ver > FQDN accordingly. > Hope this helps, > On Wed, Nov 19, 2014 at 8:38 PM, Demeter Tibor < tdemeter(a)itsmart.hu > = wr=3D ote: > > Hi, >=3D20 > > I don't have linux client. >=3D20 > > Can I change password without this? >=3D20 > > Thanks, >=3D20 > > Tibor >=3D20 > > > Hi Tibor, > >=3D20 >=3D20 > > > On Wed, Nov 19, 2014 at 6:46 PM, Demeter Tibor < tdemeter(a)itsmart.h= u =3D > > > > wrote: > >=3D20 >=3D20 > > > > Hi, > > >=3D20 > >=3D20 >=3D20 > > > > I have an IPA server 3.0 on centos 6.6. > > >=3D20 > >=3D20 >=3D20 > > > > I successfully attached to my ovirt cluster. > > >=3D20 > >=3D20 >=3D20 > > > > I can see the users on ovirt user tab, but after auth I always get = =3D this > > > > error: > > >=3D20 > >=3D20 >=3D20 > > > > Cannot Login. User Password has expired. Use the following URL to > > > > change > > > > the > > > > password: (nothing) > > >=3D20 > >=3D20 >=3D20 > > > > I have try out with different long passwords and different users, b= =3D ut > > > > it's > > > > same. > > >=3D20 > >=3D20 >=3D20 > > > =3DE2=3D80=3D8BDid you try accessing a regular linux client with the = same a=3D ccount? In > > > IPA, > > > new user passwords are always set as expired by design - please see [= =3D 1]. > >=3D20 >=3D20 > > > To test this, you can try to login a client. If it is really expired, > > > system > > > will ask you to provide a new password. After this, you'll be able to > > > login > > > RHEVM with the new password you've just set. > >=3D20 >=3D20 > > > =3DE2=3D80=3D8B[1] > >=3D20 >=3D20 > > > http://www.freeipa.org/page/New_Passwords_Expired =3DE2=3D80=3D8B > >=3D20 >=3D20 > > > Regards, > >=3D20 >=3D20 > > > -- > >=3D20 >=3D20 > > > Ekin > >=3D20 >=3D20 > -- > Ekin Mero=3DC4=3D9Flu Red Hat Certified Datacenter Specialist > linuxera =3DC3=3D96zg=3DC3=3DBCr Yaz=3DC4=3DB1l=3DC4=3DB1m =3DC3=3D87=3DC= 3=3DB6z=3DC3=3DBCm ve Hizmet=3D leri > T +90 (850) 22 LINUX GSM +90 (532) 137 77 04 ------=3D_Part_6830391_1351976731.1416471066743 Content-Type: text/html; charset=3Dutf-8 Content-Transfer-Encoding: quoted-printable

Hi,

Tha= =3D nk you, that's worked!

Bye

Tibor

Hi= ,<=3D /div>

An ldappasswd command would change it wi= =3D thout setting as expired. It will prompt twice for the account password you= =3D 'll set, and the password for the directory manager once:

$ ldappasswd -ZZ -D 'cn=3D3Ddirectory manager' -W -S uid=3D3DUSERNAME= ,cn=3D =3D3Dusers,cn=3D3Daccounts,dc=3D3Dexample,dc=3D3Dorg -H ldap://ipaserver.example.org=3D

You'll need = to=3D set the username (USERNAME) domain (example.org) and server FQDN accordingly.

= Hope this helps,=

On = Wed,=3D Nov 19, 2014 at 8:38 PM, Demeter Tibor <tdemeter(a)itsmart.hu&g= t; wrote:
Hi= =3D ,

I don't have linux client.
Can I c= =3D hange password without this?

Thanks,
Tibor

Hi Tibor,=

On Wed, N= ov 1=3D 9, 2014 at 6:46 PM, Demeter Tibor <tdemeter(a)itsmart.hu> wr=3D ote:
Hi,

I have an IPA server 3.0 on centos 6.6.
I successfully a= =3D ttached to my ovirt cluster.
I can see the users on ovirt u= =3D ser tab, but after auth I always get this error:

Cannot Login. User Password has expired. Use the followin= =3D g URL to change the password: (nothing)

<= =3D /div>
I have try out with different long passwords and different = =3D users, but it's same.

=3DE2=3D80=3D8BDid you try accessing a regular linux= clien=3D t with the same account? In IPA, new user passwords are always set as expir= =3D ed by design - please see [1].

To test this, you ca= =3D n try to login a client. If it is really expired, system will ask you to pr= =3D ovide a new password. After this, you'll be able to login RHEVM with = =3D the new password you've just set.

=3D= E2=3D =3D80=3D8B[1]
http://www.freeipa.org/page/New_Passw= or=3D ds_Expired=3DE2=3D80=3D8B

Regards,
= --
Ekin