- Users - oVirt List Archives

ovirt java sdk: Port is invalid
by David David 26 Apr '16

26 Apr '16

hi. I have a remote server running with oVirt 3.5 I'm using ovirt-engine-sdk-java-3.5.1.0-1.fc20.noarch. there is code example: my app: ===================== package lab01; import java.io.IOException; import java.util.List; import java.util.UUID; import org.apache.http.client.ClientProtocolException; import org.ovirt.engine.sdk.*; import org.ovirt.engine.sdk.decorators.*; import org.ovirt.engine.sdk.entities.*; import org.ovirt.engine.sdk.exceptions.*; public class Hello { private static final String URL = "https://10.64.0.204/api"; private static final String crt = "/home/david/Desktop/dev/server.truststore"; private static final String user = "admin@internal"; private static final String pass = "11111111"; public static void main(String[] args) throws ClientProtocolException, ServerException, UnsecuredConnectionAttemptError, IOException { Api api = new Api(URL, user, pass, crt); } } ====================== Description of problem: While trying to start my app localy on my pc, I am getting an exception: Exception in thread "main" java.lang.IllegalArgumentException: Port is invalid at org.apache.http.util.Args.check(Args.java:36) at org.apache.http.conn.scheme.Scheme.<init>(Scheme.java:92) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createSchemeRegistry(ConnectionsPoolBuilder.java:358) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createPoolingClientConnectionManager(ConnectionsPoolBuilder.java:289) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createDefaultHttpClient(ConnectionsPoolBuilder.java:261) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.build(ConnectionsPoolBuilder.java:413) at org.ovirt.engine.sdk.Api.<init>(Api.java:131) at lab01.Hello.main(Hello.java:24) But I can connect to the server in https using curl or webrowser. How to fix it ?

2 2

how to disable drap file into virt-viewer in ovirt?
by CheungPaul 25 Apr '16

25 Apr '16

--_9094e293-8f98-4fe0-8224-aaaa615187ff_ Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 RGVhcnM6DQpXZSBwZXJmZXIgdXNlciBjYW4gbm90IHRyYW5zZmVyIGZpbGUgaW50byBWTSwgYnV0 IHdlIGZvdW5kIHRoYXQgdXNlciBjYW4gZHJhcCBmaWxlIGludG8gdGhlIFZNJ3MgZGVzdG9wLiAN CmhvdyB0byBkaXNhYmxlIGl0Pw0KDQoKDQoNClNpbmNlcmVseSB5b3VycywNClBhdWxDaGV1bmcN Cg0KDQogdGVsOiAxODAtODg4Mi03MTczDQogCQkgCSAgIAkJICA= --_9094e293-8f98-4fe0-8224-aaaa615187ff_ Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxzdHlsZT48IS0tDQouaG1tZXNzYWdlIFANCnsNCm1hcmdpbjowcHg7 DQpwYWRkaW5nOjBweA0KfQ0KYm9keS5obW1lc3NhZ2UNCnsNCmZvbnQtc2l6ZTogMTJwdDsNCmZv bnQtZmFtaWx5Os6iyO3RxbraDQp9DQotLT48L3N0eWxlPjwvaGVhZD4NCjxib2R5IGNsYXNzPSdo bW1lc3NhZ2UnPjxkaXYgZGlyPSdsdHInPkRlYXJzOjxkaXY+PGJyPjwvZGl2PjxkaXY+V2UgcGVy ZmVyIHVzZXIgY2FuIG5vdCB0cmFuc2ZlciBmaWxlIGludG8gVk0sIGJ1dCB3ZSBmb3VuZCB0aGF0 IHVzZXIgY2FuIGRyYXAgZmlsZSBpbnRvIHRoZSBWTSdzIGRlc3RvcC4mbmJzcDs8L2Rpdj48ZGl2 Pjxicj48L2Rpdj48ZGl2PmhvdyB0byBkaXNhYmxlIGl0Pzxicj48YnI+PGRpdj4KPGJyPjxicj5T aW5jZXJlbHkgeW91cnMsPGJyPlBhdWxDaGV1bmc8YnI+PGJyPjxicj4mbmJzcDt0ZWw6IDE4MC04 ODgyLTcxNzM8YnI+PC9kaXY+PC9kaXY+IAkJIAkgICAJCSAgPC9kaXY+PC9ib2R5Pg0KPC9odG1s Pg== --_9094e293-8f98-4fe0-8224-aaaa615187ff_--

1 0

All field on guest info tab are unknown
by Kevin C 25 Apr '16

25 Apr '16

--=-KnL3+aRj45s3Tmd5Gv2X Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi list, On a windows VM, all field in "Guest info" tab are "unknown". ovirt agent s= tart successfully, I can see IP adress or applications. All drivers are OK. Must I reinstall my agents ? Thanks=C2=A0 Kevin C --=-KnL3+aRj45s3Tmd5Gv2X Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEeww ggXiMIIDyqADAgECAhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYT AklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0 aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eTAeFw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17AkefMyUGwrQdvwO bhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzLA84J6Ws5T4NfXZ0q n4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmCS+kICslYYWgXOMt2xlsS slxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6mySu8j8BWWHpChNNeTrFuhVfrO AyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR9t4APXGzAgMBAAGjggFkMIIBYDAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQI MAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2Eu Y3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29t MDAGCCsGAQUFBzAChiRodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0O BBYEFCSBbDlhvkkPj7cbRivJKLUnSG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7y MD8GA1UdIAQ4MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNv bS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh 2NCXTq7im61g7F1LIiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw 5kG3DN8pd1hSEUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07 v29MdhaPv3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Y klue/quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6UpVD o/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHMzcwk3EV2 B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuKKwHNL8F4GGp6 jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ8j6y6S9p0xE/Ga0p eVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMIIF/zCCBOegAwIBAgIQTLnfP04vlkvqxMUZU04a zjANBgkqhkiG9w0BAQsFADB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBMB4XDTE2MDIwMzA5NDQ1N1oXDTE3MDIwMzA5NDQ1N1owSDEf MB0GA1UEAwwWa2V2aW5AZmFtaWxsZWNvdXNpbi5mcjElMCMGCSqGSIb3DQEJARYWa2V2aW5AZmFt aWxsZWNvdXNpbi5mcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM7aVEpOkTQPuDSV lEcQ9J3Pjb+XrzJeE5nFDTD3uLfVZ5bXEsHlGJtgzS0AIT5dCgtyAO44QL8HQY/qOnyNU3/DSQIq 0c2BV/AJt9qrGdInhD32LfsyaIGyEUS1KYY++SfndVwWGxy2ZAtaqlwGSuR19mTwv4BCD0IqSLbo ANo8xR+Hy6A10BzHRBklNhMPerWxySzSNC4YMQXDwQWe9cWqm1TcvOZmnYh/O0HCjirbNcA5gpgq cimNC6YTHEsfvLzpnbi53QdJC4gobRaQKw5MuMDDMOgOZVNGaKe8MVrVelyDFbXo4VNk5CbTcXP2 YK3Lbeuu/krCbYIN6CxioW9obxIMVzCbjA4z+6CqFJNc1Qv389vMF/WkeghZQOJL5JE/zB0NFgrq hriPmX1IEA/kW/MSBWujjFwxkS3p7V/Kg98mioCBerDEuU4k77y5NuOif42e1ssKWweRoi54kfzp m/DHigfzBoqowo2pudiEuMc91ta3CtgOBqEZSiQBYqS8biHChCXZv3me6Gf8WPaqyN0OwnCD+lOx dGKd56yHHKZyfT0b/RSfJ89uWls7+Ou47sXAa7IjKRLyirqEKjmC4Efl+pAsxbMoV4ZgWIAr8/VM x1pzwoUFbdla2jYttvOEWog/c1Ss+1/WJM+Lre9ItC+LN8iKKrT7fZfKy0f9AgMBAAGjggG2MIIB sjALBgNVHQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAw HQYDVR0OBBYEFFZg5P1hZz/039cwy9+ThVfL+w6kMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJ KLUnSG1oMG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wu Y29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50 MS5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVu dDEuY3JsMCEGA1UdEQQaMBiBFmtldmluQGZhbWlsbGVjb3VzaW4uZnIwIwYDVR0SBBwwGoYYaHR0 cDovL3d3dy5zdGFydHNzbC5jb20vMEYGA1UdIAQ/MD0wOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEF BQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUAA4IBAQC0 QbMzgSfJicGx8BJneSYlo7ZxeMKKSWb8wXBj3rwCKrR1uiVx8fVIt5x/Hl1F3dZ6aVoF+dzTvUIA qTovD5ACumfqhu6qb1TiHRaCQr9tKBN6Cb5Du11muun5k5T17tFWD8qPi7u4iZCOGrynd3uWv9Dl T9a0LY6yL+GeIiIVwq8DyDHE7sqCiN+S9iL4Zkho7pS4l7mIW71JNqKZZgOANpzbCFw4lJc2NMhR GlcVdwdJeHpZyW5vpHxmNjWQ+ptaBfKaWOFO5r5na5wF2QOsbICq6e8IKNsliY9hlZnRzu32AzLj GXnmUfy+JF1+gOpSsxpzMGi+axBmxxV0gWCNMIIF/zCCBOegAwIBAgIQTLnfP04vlkvqxMUZU04a zjANBgkqhkiG9w0BAQsFADB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBMB4XDTE2MDIwMzA5NDQ1N1oXDTE3MDIwMzA5NDQ1N1owSDEf MB0GA1UEAwwWa2V2aW5AZmFtaWxsZWNvdXNpbi5mcjElMCMGCSqGSIb3DQEJARYWa2V2aW5AZmFt aWxsZWNvdXNpbi5mcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM7aVEpOkTQPuDSV lEcQ9J3Pjb+XrzJeE5nFDTD3uLfVZ5bXEsHlGJtgzS0AIT5dCgtyAO44QL8HQY/qOnyNU3/DSQIq 0c2BV/AJt9qrGdInhD32LfsyaIGyEUS1KYY++SfndVwWGxy2ZAtaqlwGSuR19mTwv4BCD0IqSLbo ANo8xR+Hy6A10BzHRBklNhMPerWxySzSNC4YMQXDwQWe9cWqm1TcvOZmnYh/O0HCjirbNcA5gpgq cimNC6YTHEsfvLzpnbi53QdJC4gobRaQKw5MuMDDMOgOZVNGaKe8MVrVelyDFbXo4VNk5CbTcXP2 YK3Lbeuu/krCbYIN6CxioW9obxIMVzCbjA4z+6CqFJNc1Qv389vMF/WkeghZQOJL5JE/zB0NFgrq hriPmX1IEA/kW/MSBWujjFwxkS3p7V/Kg98mioCBerDEuU4k77y5NuOif42e1ssKWweRoi54kfzp m/DHigfzBoqowo2pudiEuMc91ta3CtgOBqEZSiQBYqS8biHChCXZv3me6Gf8WPaqyN0OwnCD+lOx dGKd56yHHKZyfT0b/RSfJ89uWls7+Ou47sXAa7IjKRLyirqEKjmC4Efl+pAsxbMoV4ZgWIAr8/VM x1pzwoUFbdla2jYttvOEWog/c1Ss+1/WJM+Lre9ItC+LN8iKKrT7fZfKy0f9AgMBAAGjggG2MIIB sjALBgNVHQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAw HQYDVR0OBBYEFFZg5P1hZz/039cwy9+ThVfL+w6kMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJ KLUnSG1oMG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wu Y29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50 MS5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVu dDEuY3JsMCEGA1UdEQQaMBiBFmtldmluQGZhbWlsbGVjb3VzaW4uZnIwIwYDVR0SBBwwGoYYaHR0 cDovL3d3dy5zdGFydHNzbC5jb20vMEYGA1UdIAQ/MD0wOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEF BQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUAA4IBAQC0 QbMzgSfJicGx8BJneSYlo7ZxeMKKSWb8wXBj3rwCKrR1uiVx8fVIt5x/Hl1F3dZ6aVoF+dzTvUIA qTovD5ACumfqhu6qb1TiHRaCQr9tKBN6Cb5Du11muun5k5T17tFWD8qPi7u4iZCOGrynd3uWv9Dl T9a0LY6yL+GeIiIVwq8DyDHE7sqCiN+S9iL4Zkho7pS4l7mIW71JNqKZZgOANpzbCFw4lJc2NMhR GlcVdwdJeHpZyW5vpHxmNjWQ+ptaBfKaWOFO5r5na5wF2QOsbICq6e8IKNsliY9hlZnRzu32AzLj GXnmUfy+JF1+gOpSsxpzMGi+axBmxxV0gWCNMYIEXjCCBFoCAQEwgYkwdTELMAkGA1UEBhMCSUwx FjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQTLnfP04vlkvq xMUZU04azjANBglghkgBZQMEAgEFAKCCAaUwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkq hkiG9w0BCQUxDxcNMTYwNDI1MTU1NTQ5WjAvBgkqhkiG9w0BCQQxIgQgctGla3YFhCzLLMywKGKD Fd2OCzvaYHVi1JlnR3Y1N+cwgZoGCSsGAQQBgjcQBDGBjDCBiTB1MQswCQYDVQQGEwJJTDEWMBQG A1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRo b3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhBMud8/Ti+WS+rExRlT ThrOMIGcBgsqhkiG9w0BCRACCzGBjKCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNV BAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhBMud8/Ti+WS+rExRlTThrOMA0GCSqGSIb3 DQEBAQUABIICABDYLDdHyhHJzcx/TqiUYqsydgbwrKZfdbnNS320vYeUFymrf1TF8Lxw+c55uk7d Yvdr+I3qt8HTktjMLDsXL/0YeMXNSUeBd871U7XbozJeX+hWROf6zxeVUvAqRb9Ki+C+zsCFYvNw prlbmzR6CiyAWxWXluav5Cy4qyuCdPp42r7XKX6SJqAUb88EXC6GkgahiKpSn67YTyW3zum/xBg0 1K+FPzIhr3ADLLdaqFaH8FzyP6wmY6+Cy8P7pi6ivUTVJoiQAMlzVChB/20OZMalaxQeeTGLf8IE RA2v3HBQEe8Lrm/AxcuCLRDh6SF/g+N5cgl1a2HFRyAlodpZV4mVg5dsQS5v3U/sMkaSgJWnlMyk qC5GJwnbitF9CqH31VnN+oXS9k0UTYkbVavaoyucRaH202UONrIv7Fs/mKKyG8xR9zifT8NaijJa n8+jizDtIgwR7FahSPMnIPrvrXga7vQll5G9Phlou07062CJJirYeKXozDE9yECp+XN6vVPvdo/D qiRpaMm0PUkWD+8c6Kt8tuDUDopN+DtJCo6UMJTboJDSKwcDEqwzJOveTWSP8WuoJynrwjUyh7VR kLL0TQw7uHTwnobL96NtLWQ/W/B6TCXNJElGBdav1Rr1OrWJjeDr7LcpOy33Aa1GjZI6H30z12FB 72Wz+2N+qWf/AAAAAAAA --=-KnL3+aRj45s3Tmd5Gv2X--

1 0

oVirt 3.5 and SSLv3
by Robert Story 25 Apr '16

25 Apr '16

--Sig_/5hzIpMGnpyZJ8h0tE1_0JkE Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Yesterday I had to re-install a host node in my 3.5.6 cluster. After a fres= h install of CentOS 7.2, attempts to re-install failed, as did removing and= re-adding the node. Here is a log excerpt from the engine: 2016-04-19 18:22:01,100 INFO [org.ovirt.vdsm.jsonrpc.client.reactors.React= orClient] (SSL Stomp Reactor) Connecting to eclipse.localdomain/10.71.10.249 2016-04-19 18:22:01,116 WARN [org.ovirt.vdsm.jsonrpc.client.utils.retry.Re= tryable] (SSL Stomp Reactor) Retry failed 2016-04-19 18:22:01,129 ERROR [org.ovirt.vdsm.jsonrpc.client.reactors.React= orClient] (DefaultQuartzScheduler_Worker-38) Exception during connection 2016-04-19 18:22:01,208 ERROR [org.ovirt.engine.core.vdsbroker.vdsbroker.Ge= tCapabilitiesVDSCommand] (DefaultQuartzScheduler_Worker-38) Command GetCapa= bilitiesVDSCommand(HostName =3D eclipse, HostId =3D 37a4a1c2-4906-489e-947c= -1ef9fb828bc5, vds=3DHost[eclipse,37a4a1c2-4906-489e-947c-1ef9fb828bc5]) ex= ecution failed. Exception: VDSNetworkException: java.net.NoRouteToHostExcep= tion: No route to host 2016-04-19 18:22:01,209 WARN [org.ovirt.engine.core.vdsbroker.VdsManager] = (DefaultQuartzScheduler_Worker-38) Host eclipse is not responding. It will = stay in Connecting state for a grace period of 120 seconds and after that a= n attempt to fence the host will be issued. 2016-04-19 18:22:01,938 ERROR [org.ovirt.engine.core.vdsbroker.VdsUpdateRun= TimeInfo] (DefaultQuartzScheduler_Worker-38) Failure to refresh Vds runtime= info: org.ovirt.engine.core.vdsbroker.vdsbroker.VDSNetworkException: java.= net.NoRouteToHostException: No route to host at org.ovirt.engine.core.vdsbroker.vdsbroker.VdsBrokerCommand.creat= eNetworkException(VdsBrokerCommand.java:126) [vdsbroker.jar:] Luckily seeing SSL+java in the log tickled my memory about java disabling S= SLv3, and google helped me find this workaround: - edit /usr/lib/jvm/java/jre/lib/security/java.security - look for jdk.tls.disabledAlgorithms - remove SSLv3 from the list - service ovirt-engine restart Google also tells me that this should be an issue for 3.5, and there is a vdsm setting, VdsmSSLProtocol, that can be set to use TLS, but I can't find how to change/set it. Anyone know the secret? Robert --=20 Senior Software Engineer @ Parsons --Sig_/5hzIpMGnpyZJ8h0tE1_0JkE Content-Type: application/pgp-signature Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlcXeHIACgkQ7/fVLLY1mnimKgCeL1PD9TRtKtdxC07VPjs3A3eh a4sAnieFpARV2TUY6Ot0PbZoFI5PNgBm =NjWI -----END PGP SIGNATURE----- --Sig_/5hzIpMGnpyZJ8h0tE1_0JkE--

3 4

advanced users authentication, using kerberos, CAS SSO and Active Directory
by Fabrice Bacchella 25 Apr '16

25 Apr '16

--Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I have a production were hard coded password are avoided. We prefer to = use kerberos. We also provided a SSO for Web UI using CAS = <http://jasig.github.io/cas/4.2.x/index.html>. We use ActiveDirectory = for user backend. So I wanted a oVirt installation that will use kerberos for API = authentication. For the web ui, kerberos is not always the best = solution, so I wanted to integrated it in our CAS. The Apache part was easy to setup. I will show only subpart of the whole Apache setup and only = authentication related part # The CAS modules LoadModule authz_user_module = /usr/lib64/httpd/modules/mod_authz_user.so # Needed because auth_cas_module forget to link openssl LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so LoadModule auth_cas_module = /usr/lib64/httpd/modules/mod_auth_cas.so # For the kerberos authentication on the API LoadModule auth_gssapi_module = /usr/lib64/httpd/modules/mod_auth_gssapi.so LoadModule session_module /usr/lib64/httpd/modules/mod_session.so LoadModule session_cookie_module = /usr/lib64/httpd/modules/mod_session_cookie.so CASLoginURL https://sso/cas/login CASValidateSAML On CASValidateURL https://sso/cas/samlValidate <VirtualHost *:443> RequestHeader unset X-Remote-User early <LocationMatch ^/api($|/)> RewriteEngine on RewriteCond %{LA-U:REMOTE_USER} ^(.*@DOMAIN)$ RewriteRule ^(.*)$ - [L,P,E=3DREMOTE_USER:%1] RequestHeader set X-Remote-User %{REMOTE_USER}s AuthType GSSAPI AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:.../httpd.keytab Require valid-user GssapiUseSessions On Session On SessionCookieName ovirt_gssapi_session = path=3D/private;httponly;secure; </LocationMatch> <LocationMatch = ^/(ovirt-engine($|/)|RHEVManagerWeb/|OvirtEngineWeb/|ca.crt$|engine.ssh.ke= y.txt$|rhevm.ssh.key.txt$)> AuthType CAS Require valid-user CASAuthNHeader X-Remote-User </LocationMatch> </VirtualHost> The authn file /etc/ovirt-engine/extensions.d/apachesso-authn.properties = is : ovirt.engine.extension.name =3D apachesso-authn ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.misc.http.AuthnExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name =3D apachesso ovirt.engine.aaa.authn.authz.plugin =3D DOMAIN-authz config.artifact.name =3D HEADER config.artifact.arg =3D X-Remote-User And the authz file = /etc/ovirt-engine/extensions.d/DOMAIN-authz.properties is: ovirt.engine.extension.name =3D DOMAIN-authz ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 =3D ../aaa/DOMAIN.properties I had some difficulties with AD backend. A straightforward solution = would have been : include =3D <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D domain.com pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 # Only TLSv1.2 is secure nowadays pool.default.ssl.startTLSProtocol =3D TLSv1.2 # long time out should be avoided pool.default.connection-options.connectTimeoutMillis =3D 500 But if fails. We have a special setup with about 100 domain controlers = and only two of them can be reached from the ovirt engine. So my first = try was so defined them directly in the configuration file: pool.default.serverset.type =3D failover pool.default.serverset.failover.1.server =3D dcX.domain.com pool.default.serverset.failover.2.server =3D dcY.domain.com But that fails. Server-engine was still using a lot of unreachable = domain controler. After some digging I found that other part of the ldap = extension use a different serverset, I don=E2=80=99t know why it don=E2=80= =99t reuse the default pool. It=E2=80=99s called pool.default.dc-resolve = (it should be called pool.dc-resolve, as it=E2=80=99s not the default = but a custom one), so I added in my configuration: pool.default.dc-resolve.default.serverset.type =3D failover pool.default.dc-resolve.serverset.failover.1.server =3D dcX.domain.com pool.default.dc-resolve.serverset.failover.2.server =3D dcY.domain.com But there is a better solution. Ondra Machacek point it to me. In Active = Directory, there is something called a =E2=80=9Csite=E2=80=9D, with a = subset of all the domain controler in it. It can be found under = CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN,... To list them: ldapsearch -H ldap://somedc -b CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN = -s one -o ldif-wrap=3Dno cn The information to write down is the cn returned You get a list of all domain, just pick the right one, remove all the = serverset configuration and add : pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} The entry _sites.${domain} don=E2=80=99t exist in the DNS, so to check = that your regex is good, try instead: dig +short _ldap._tcp.GOOD_SITE._sites.${domain} srv It should return only reachable domain controlers. So the final /etc/ovirt-engine/aaa/DOMAIN.properties was : include =3D <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D domain.com pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 pool.default.ssl.startTLSProtocol =3D TLSv1.2 pool.default.connection-options.connectTimeoutMillis =3D 500 pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} With this setup, my python client = <https://github.com/fbacchella/ovirtcmd> can connect to ovirt-engine = using kerberos ticket, web users are authenticated using CAS. And there = is no need to duplicate user base. --Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D"">I have a production were hard coded password are avoided. We = prefer to use kerberos. We also provided a SSO for Web UI using <a = href=3D"http://jasig.github.io/cas/4.2.x/index.html" style=3D"color: = rgb(104, 0, 148); text-decoration: none; margin-top: auto;" = class=3D"">CAS</a>. We use ActiveDirectory for user backend.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">So I wanted a oVirt installation that will use kerberos for = API authentication. For the web ui, kerberos is not always the best = solution, so I wanted to integrated it in our CAS.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">The Apache part was easy to setup.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">I will show only subpart of the whole Apache setup and only = authentication related part<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D""># The CAS modules LoadModule authz_user_module = /usr/lib64/httpd/modules/mod_authz_user.so # Needed because auth_cas_module forget to link openssl LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so LoadModule auth_cas_module = /usr/lib64/httpd/modules/mod_auth_cas.so # For the kerberos authentication on the API LoadModule auth_gssapi_module = /usr/lib64/httpd/modules/mod_auth_gssapi.so LoadModule session_module /usr/lib64/httpd/modules/mod_session.so LoadModule session_cookie_module = /usr/lib64/httpd/modules/mod_session_cookie.so CASLoginURL <a href=3D"https://sso/cas/login" = class=3D"">https://sso/cas/login</a> CASValidateSAML On CASValidateURL <a href=3D"https://sso/cas/samlValidate" = class=3D"">https://sso/cas/samlValidate</a> <VirtualHost *:443> RequestHeader unset X-Remote-User early <LocationMatch ^/api($|/)> RewriteEngine on RewriteCond %{LA-U:REMOTE_USER} ^(.*@DOMAIN)$ RewriteRule ^(.*)$ - [L,P,E=3DREMOTE_USER:%1] RequestHeader set X-Remote-User %{REMOTE_USER}s AuthType GSSAPI AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:.../httpd.keytab Require valid-user GssapiUseSessions On Session On SessionCookieName ovirt_gssapi_session = path=3D/private;httponly;secure; </LocationMatch> <LocationMatch = ^/(ovirt-engine($|/)|RHEVManagerWeb/|OvirtEngineWeb/|ca.crt$|engine.ssh.ke= y.txt$|rhevm.ssh.key.txt$)> AuthType CAS Require valid-user CASAuthNHeader X-Remote-User </LocationMatch> </VirtualHost> </code></pre>The authn file <code style=3D"font-size: 12px; = font-family: Menlo, Monaco, 'Courier New', monospace; word-wrap: = break-word; white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">/etc/ovirt-engine/extensions.d/apachesso-authn.properties</code= > is :<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">ovirt.engine.extension.name =3D apachesso-authn ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.misc.http.AuthnExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name =3D apachesso ovirt.engine.aaa.authn.authz.plugin =3D DOMAIN-authz config.artifact.name =3D HEADER config.artifact.arg =3D X-Remote-User </code></pre>And the authz file <code style=3D"font-size: 12px; = font-family: Menlo, Monaco, 'Courier New', monospace; word-wrap: = break-word; white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">/etc/ovirt-engine/extensions.d/DOMAIN-authz.properties</code>&n= bsp;is:<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">ovirt.engine.extension.name =3D DOMAIN-authz ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 =3D ../aaa/DOMAIN.properties </code></pre>I had some difficulties with AD backend. A straightforward = solution would have been :<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">include =3D = <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D <a href=3D"http://domain.com" class=3D"">domain.com</a> pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 # Only TLSv1.2 is secure nowadays pool.default.ssl.startTLSProtocol =3D TLSv1.2 # long time out should be avoided pool.default.connection-options.connectTimeoutMillis =3D 500 </code></pre>But if fails. We have a special setup with about 100 domain = controlers and only two of them can be reached from the ovirt engine. So = my first try was so defined them directly in the configuration = file:<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.serverset.type =3D failover pool.default.serverset.failover.1.server =3D <a = href=3D"http://dcX.domain.com" class=3D"">dcX.domain.com</a> pool.default.serverset.failover.2.server =3D <a = href=3D"http://dcY.domain.com" class=3D"">dcY.domain.com</a> </code></pre>But that fails. Server-engine was still using a lot of = unreachable domain controler. After some digging I found that other part = of the ldap extension use a different serverset, I don=E2=80=99t know = why it don=E2=80=99t reuse the default pool. It=E2=80=99s = called <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">pool.default.dc-resolve</code> (it should be = called <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px;" = class=3D"">pool.dc-resolve</code>, as it=E2=80=99s not the default but a = custom one), so I added in my configuration:<pre style=3D"font-family:= Menlo, Monaco, 'Courier New', monospace; word-wrap: normal; = white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.dc-resolve.default.serverset.type =3D failover pool.default.dc-resolve.serverset.failover.1.server =3D <a = href=3D"http://dcX.domain.com" class=3D"">dcX.domain.com</a> pool.default.dc-resolve.serverset.failover.2.server =3D <a = href=3D"http://dcY.domain.com" class=3D"">dcY.domain.com</a> </code></pre>But there is a better solution. Ondra Machacek point it to = me. In Active Directory, there is something called a =E2=80=9Csite=E2=80=9D= , with a subset of all the domain controler in it. It can be found = under <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN,...</code><p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">To list them:<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">ldapsearch -H <a = href=3D"ldap://somedc" class=3D"">ldap://somedc</a> -b = CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN -s one -o ldif-wrap=3Dno cn </code></pre>The information to write down is the cn returned<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">You get a list of all domain, just pick the right one, remove = all the serverset configuration and add :<pre style=3D"font-family: = Menlo, Monaco, 'Courier New', monospace; word-wrap: normal; white-space: = pre-wrap; padding: 0.6em 0.8em; -webkit-margin-before-collapse: = collapse; -webkit-margin-after-collapse: collapse; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.serverset.srvrecord.domain-conversion.type =3D = regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} </code></pre>The entry <code style=3D"font-size: 12px; font-family: = Menlo, Monaco, 'Courier New', monospace; word-wrap: break-word; = white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">_sites.${domain}</code> don=E2=80=99t exist in the DNS, = so to check that your regex is good, try instead:<pre = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">dig +short = _ldap._tcp.GOOD_SITE._sites.${domain} srv </code></pre>It should return only reachable domain controlers.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">So the final /etc/ovirt-engine/aaa/DOMAIN.properties was = :<pre style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">include =3D = <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D <a href=3D"http://domain.com" class=3D"">domain.com</a> pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 pool.default.ssl.startTLSProtocol =3D TLSv1.2 pool.default.connection-options.connectTimeoutMillis =3D 500 pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} </code></pre>With this setup, my <a = href=3D"https://github.com/fbacchella/ovirtcmd" style=3D"color: rgb(104, = 0, 148); text-decoration: none; margin-top: auto;" class=3D"">python = client</a> can connect to ovirt-engine using kerberos ticket, web = users are authenticated using CAS. And there is no need to duplicate = user base.<div class=3D""> </div></body></html>= --Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205--

1 0

Re: [ovirt-users] Unable to install CentOS 6.7 on ovirt 3.5/.6
by Yaniv Kaul 24 Apr '16

24 Apr '16

The checksum looks correct. From a bit of Googling around, might be a (known?) issue - can you try the workaround mentioned @ https://bugzilla.redhat.com/show_bug.cgi?id=632811 ? Y. On Fri, Apr 22, 2016 at 6:37 AM, Gene Fontanilla <ginofontanilla(a)gmail.com> wrote: > follow up attachment. > > everything freezes here. > > regards, > Gene > > On Fri, Apr 22, 2016 at 10:57 AM, Gene Fontanilla < > ginofontanilla(a)gmail.com> wrote: > >> Hi, >> >> md5sum: 9381a24b8bee2fed0c26896141a64b69 >> >> please see attached screenshots, i didn't find any error logs on >> engine.log. >> >> weird thing is that windows installations work like a charm. >> >> regards, >> Gene >> >> >> >> On Thu, Apr 21, 2016 at 8:12 PM, Yaniv Kaul <ykaul(a)redhat.com> wrote: >> >>> >>> >>> On Thu, Apr 21, 2016 at 5:18 AM, Gene Fontanilla < >>> ginofontanilla(a)gmail.com> wrote: >>> >>>> Hi, >>>> >>>> Anyone having issues on using CentOS 6.6 iso on oVirt 3.5 and 3.6? >>>> >>>> I have two environments for testing (oVirt 3.5 and 3.6) and I can't >>>> install centos 6.6 iso on the vms. >>>> >>>> it after anaconda installer starts. >>>> >>> >>> Can you provide a bit more information? Can you ensure the ISO is not >>> corrupted (check its MD5/SHA sum) ? >>> Y. >>> >>> >>>> >>>> regards. >>>> Gene >>>> >>>> _______________________________________________ >>>> Users mailing list >>>> Users(a)ovirt.org >>>> http://lists.ovirt.org/mailman/listinfo/users >>>> >>>> >>> >> >

2 3

Hosted Engine installation fails while deploying in hyper-converged configuration
by Stefano Stagnaro 24 Apr '16

24 Apr '16

Hi, while deploying Hosted Engine in hyper-converged configuration, installation fails with following error: [ ERROR ] Failed to execute stage 'Environment customization': <Fault 1: "<type 'exceptions.TypeError'>:cannot marshal None unless allow_none is enabled"> I followed Ramesh post: http://blogs-ramesh.blogspot.it/2016/01/ovirt-and-gluster-hyperconvergence.… My setup includes 3 hosts with: - ovirt 3.6.3 - glusterfs 3.7.8 - vdsm 4.17.23.2 - replica 3 gluster volume - no firewall - selinux enforcing - 1 network for management, 1 network for gluster I've uploaded logs on pastebin: - hosted-engine --deploy http://pastebin.com/aZwwdt51 - ovirt-hosted-engine-setup.log http://pastebin.com/114zfbAB - rhev-data-center-mnt-glusterSD-h4gfs.newvirt:_engine.log http://pastebin.com/GL4yyT95 - vdsm.log http://pastebin.com/WjSm0cHQ Thank you very much for your help. -- Stefano Stagnaro Prisma Telecom Testing S.r.l. Via Petrocchi, 4 20127 Milano – Italy Tel. 02 26113507 int 339 e-mail: stefanos(a)prismatelecomtesting.com skype: stefano.stagnaro

3 7

Procedure to upgrade single-host datacenter from el6 to el7
by Rik Theys 24 Apr '16

24 Apr '16

Hi, I'm looking for the best procedure to upgrade a host from CentOS 6 to CentOS 7. The host is the only host in the oVirt data center (the engine is running on another machine and manages multiple data centers). For datacenters with multiple hosts I followed the following steps: - Add new cluster - Put host in maintenance - Remove host from old cluster - Reinstall host - Add host to new cluster - repeat for all hosts until old cluster is empty This worked OK and the data center was never "non operational". Is the procedure identical for a data center with only one host? Should I also remove the host from the (only) cluster in the data center, or should I reinstall it and select the "reinstall" option in the oVirt web interface? Since there is only one host in the cluster there's no need to create a new cluster? Is there any state on the host that I should keep when performing the reinstall with CentOS 7? The host is using FC storage (local disks configured as FC through multipath). Regards, Rik -- Rik Theys System Engineer KU Leuven - Dept. Elektrotechniek (ESAT) Kasteelpark Arenberg 10 bus 2440 - B-3001 Leuven-Heverlee +32(0)16/32.11.07 ---------------------------------------------------------------- <<Any errors in spelling, tact or fact are transmission errors>>

2 3

ovirt 3.6 hosted engine vm not displaying in vms tab
by Dobó László 24 Apr '16

24 Apr '16

Hi, I just upgraded from 3.6.3 to 3.6.5, but the hosted engine vm still not visible in vms list. Its running on iscsi storage domain. The hosted_storage status is "Inactive", cross data center status is "Locked". I didn't find anything interesting in engine or vdsm log file. Is there any workaround or idea for this problem? engine os: CentOS Linux release 7.2.1511 (Core) pkg list: ebay-cors-filter.noarch 1.0.1-3.el7 @centos-ovirt36 jasperreports-server.noarch 6.0.1-1.el7 @ovirt-3.6 novnc.noarch 0.5.1-2.el7 @ovirt-3.6-epel otopi.noarch 1.4.1-1.el7.centos @ovirt-3.6 otopi-java.noarch 1.4.1-1.el7.centos @ovirt-3.6 ovirt-engine.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-backend.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-cli.noarch 3.6.2.0-1.el7.centos @ovirt-3.6 ovirt-engine-dbscripts.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-extension-aaa-jdbc.noarch 1.0.6-1.el7 @ovirt-3.6 ovirt-engine-extensions-api-impl.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-jboss-as.x86_64 7.1.1-1.el7.centos @ovirt-3.6 ovirt-engine-lib.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-restapi.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-sdk-java.noarch 3.6.5.0-1.el7 @ovirt-3.6 ovirt-engine-sdk-python.noarch 3.6.5.0-1.el7.centos @ovirt-3.6 ovirt-engine-setup.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-setup-base.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-setup-plugin-ovirt-engine.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-setup-plugin-ovirt-engine-common.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-setup-plugin-vmconsole-proxy-helper.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-setup-plugin-websocket-proxy.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-tools.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-tools-backup.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-userportal.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-vmconsole-proxy-helper.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-webadmin-portal.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-websocket-proxy.noarch 3.6.5.3-1.el7.centos @ovirt-3.6 ovirt-engine-wildfly.x86_64 8.2.1-1.el7 @ovirt-3.6 ovirt-engine-wildfly-overlay.noarch 8.0.5-1.el7 @ovirt-3.6 ovirt-host-deploy.noarch 1.4.1-1.el7.centos @ovirt-3.6 ovirt-host-deploy-java.noarch 1.4.1-1.el7.centos @ovirt-3.6 ovirt-image-uploader.noarch 3.6.0-1.el7.centos @ovirt-3.6 ovirt-iso-uploader.noarch 3.6.0-1.el7.centos @ovirt-3.6 ovirt-optimizer.noarch 0.9.1-2.el7.centos @ovirt-3.6 ovirt-optimizer-ui.noarch 0.9.1-2.el7.centos @ovirt-3.6 ovirt-release36.noarch 007-1 @ovirt-3.6 ovirt-setup-lib.noarch 1.0.1-1.el7.centos @ovirt-3.6 ovirt-vmconsole.noarch 1.0.0-1.el7.centos @ovirt-3.6 ovirt-vmconsole-proxy.noarch 1.0.0-1.el7.centos @ovirt-3.6 patternfly1.noarch 1.3.0-1.el7.centos @ovirt-3.6-patternfly1-noarch-epel python-daemon.noarch 1.6-4.el7 @ovirt-3.6-epel python-paramiko.noarch 1.15.1-1.el7 @ovirt-3.6-epel python-websockify.noarch 0.6.0-2.el7 @ovirt-3.6-epel spice-html5.noarch 0.1.6-1.el7 @ovirt-3.6-epel vdsm-jsonrpc-java.noarch 1.1.9-1.el7.centos @ovirt-3.6 nodes : oVirt Node Hypervisor release 3.6 (0.999.201603090756.el7.centos) vdsm.noarch 4.17.24-0.el7.centos vdsm-cli.noarch 4.17.24-0.el7.centos vdsm-hook-ethtool-options.noarch 4.17.24-0.el7.centos vdsm-hook-vmfex-dev.noarch 4.17.24-0.el7.centos vdsm-infra.noarch 4.17.24-0.el7.centos vdsm-jsonrpc.noarch 4.17.24-0.el7.centos vdsm-python.noarch 4.17.24-0.el7.centos vdsm-xmlrpc.noarch 4.17.24-0.el7.centos vdsm-yajsonrpc.noarch 4.17.24-0.el7.centos greetings, enax

2 1

Second DataCenter isn't available to attach Export Storage Domain
by Joshua Adkisson 24 Apr '16

24 Apr '16

I have put the export domain into maintenance, detach from Datacenter 1, and when I try to attach it to Datacenter 2, attached to the same engine, when the Attach to Data Center dialog pops up, it only shows Datacenter 1. What am I missing here? Please be kind, I’m very new to oVirt… Version 3.6 CONFIDENTIALITY NOTICE: This email, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure, or distribution is prohibited. If you received this email and are not the intended recipient, please inform the sender by email reply and destroy all copies of the original message.

2 1