- Users - oVirt List Archives

Problems exporting VM's
by Luciano Natale 15 Jun '16

15 Jun '16

Hi everyone. I've been having trouble when exporting VM's. I get error when moving image. I've created a whole new storage domain exclusive for this issue, and same thing happens. It's not always the same VM that fails, but once it fails on a certain storage domain, I cannot export it anymore. Please tell me which logs are relevant so i can post them and any other relevant iformation I can provide, and maybe someone can help me get through this problem. Ovirt version is 3.5.4.2-1.el6. Hosted engines is CentOS 6. Hosts are CentOS 7. VM's are all CentOS 7, except for two that are CentOS 6 and Windows 7. Please excuse my bad english! Thanks in advance! -- Luciano Natale

3 4

Hosted Engine Woes
by Nic Seltzer 15 Jun '16

15 Jun '16

Hello! I'm looking for someone who can help me out with a hosted-engine setup that I have. I experienced a power event a couple of weeks ago. Initially, things seemed to have come back fine, but the other day, I noticed that one of the nodes for the cluster was down. I tried to drop it into maintenance mode (which never completed) and reboot it then "Confirm the Host has been rebooted". Neither of these steps allowed the host to re-enter the cluster. Has anyone encountered this? At this point, I'd like to reboot the hosted-engine, but I can't find documentation instructing me on "how". I'm also open to other suggestions or references to documentation that will help triage my issue. Thanks! nic

3 4

WARNING: lvmetad is running but disabled. Restart lvmetad before enabling it!
by Claude Durocher 15 Jun '16

15 Jun '16

------=_=-_OpenGroupware_org_NGMime-1065-1466026308.760533-2------ content-type: text/plain; charset=utf-8 content-length: 330 content-transfer-encoding: quoted-printable I get this warning in vdsm logs with ovirt 3.6 installed on CentOS 7.2 = : WARNING: lvmetad is running but disabled. Restart lvmetad before enabli= ng it! The service is effectively running but disabled in systemd. In /etc/lvm= /lvm.conf I have : use=5Flvmetad =3D 1 Can someone please advise on how to solve this? =C2=A0 ------=_=-_OpenGroupware_org_NGMime-1065-1466026308.760533-2------ content-type: text/html; charset=utf-8 content-length: 398 content-transfer-encoding: quoted-printable <html>I get this warning in vdsm logs with ovirt 3.6 installed on CentO= S 7.2 : WARNING: lvmetad is running but disabled. Restart lv= metad before enabling it! The service is effectively running= but disabled in systemd. In /etc/lvm/lvm.conf I have : use=5F= lvmetad =3D 1 Can someone please advise on how to solve this= ?  </html> ------=_=-_OpenGroupware_org_NGMime-1065-1466026308.760533-2--------

2 1

[ANN] oVirt 4.0.0 GA postponed to Monday, June 20
by Rafael Martins 15 Jun '16

15 Jun '16

Hi, In order to give time to fix some last minute blockers, the GA is pushed to Monday, June 20. This should provide sufficient time for us to properly fix and test oVirt 4.0, in order to make sure we have no critical issues in the 4.0.0 version, that was originally scheduled for today. Thanks in advance, Rafael Martins

4 5

oVirt 3.6.7 Fourth Release Candidate is now available for testing
by Rafael Martins 15 Jun '16

15 Jun '16

The oVirt Project is pleased to announce the availability of the Fourth Release Candidate of oVirt 3.6.7 for testing, as of June 15th, 2016 This release is available now for: * Fedora 22 * Red Hat Enterprise Linux 6.7 or later * CentOS Linux (or similar) 6.7 or later * Red Hat Enterprise Linux 7.2 or later * CentOS Linux (or similar) 7.2 or later This release supports Hypervisor Hosts running: * Red Hat Enterprise Linux 7.2 or later * CentOS Linux (or similar) 7.2 or later * Fedora 22 This release candidate includes the following updated packages: * ovirt-engine See the release notes [1] for installation / upgrade instructions and a list of new features and bugs fixed. Notes: * A new oVirt Live ISO is available [2]. * A new oVirt Appliance will be available soon. * Mirrors[3] might need up to one day to synchronize. Additional Resources: * Read more about the oVirt 3.6.7 release highlights: http://www.ovirt.org/release/3.6.7/ * Get more oVirt Project updates on Twitter: https://twitter.com/ovirt * Check out the latest project news on the oVirt blog: http://www.ovirt.org/blog/ [1] http://www.ovirt.org/release/3.6.7/ [2] http://resources.ovirt.org/pub/ovirt-3.6-pre/iso/ovirt-live/ [3] http://www.ovirt.org/Repository_mirrors#Current_mirrors

1 0

oVirt training request
by Gonzalo Faramiñan 15 Jun '16

15 Jun '16

Hello everyone, this is my very fist message in this users list. I'm new to oVirt, and would like to know about online training/courses about it. Courses can be spanish or english imparted. Any info would be really appreciated. Thank you!

2 2

Re: [ovirt-users] Migrate hosted-engine from NFS to ISCSI
by Madhuranthakam, Ravi Kumar 15 Jun '16

15 Jun '16

--_000_AT5PR84MB0033516E5EEAAAB43924AB58B55F0AT5PR84MB0033NAMP_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Is there any solution to it on oVirt 3.6? I am also planning to move hosted engine from NFS storage to ISCSI . ~Ravi --_000_AT5PR84MB0033516E5EEAAAB43924AB58B55F0AT5PR84MB0033NAMP_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" xmlns=3D"http:= //www.w3.org/TR/REC-html40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72"> <div class=3D"WordSection1"> Is there any solution to it on oVirt 3.6?<o:p></o:p>= <o:p> </o:p> I am also planning to move hosted engine from NFS st= orage to ISCSI . <o:p></o:p> <o:p> </o:p> ~Ravi<o:p></o:p> <o:p> </o:p> <o:p> </o:p> </div> </body> </html> --_000_AT5PR84MB0033516E5EEAAAB43924AB58B55F0AT5PR84MB0033NAMP_--

2 5

Recall: Migrate hosted-engine from NFS to ISCSI
by Madhuranthakam, Ravi Kumar 15 Jun '16

15 Jun '16

Madhuranthakam, Ravi Kumar would like to recall the message, "[ovirt-users] Migrate hosted-engine from NFS to ISCSI".

1 0

hosted-engine vm-status stale data and cluster seems "broken"
by Charles Kozler 15 Jun '16

15 Jun '16

See linked images please. As you can see all three nodes are reporting stale data. The results of this are: 1. Not all VM's migrate seamlessly in the cluster. Sometimes I have to shut them down to get them to be able to migrate again 2. Hosted engine refuses to move due to constraints (image). This part doesnt make sense to me because I can forcefully shut it down and then go directly on a hosted engine node and bring it back up. Also, the Web UI shows all nodes under the cluster except then it thinks its not apart of the cluster 3. Time is in sync (image) 4. Storage is 100% fine. Gluster back end reports mirroring and status 'started'. No split brain has occurred and ovirt nodes have never lost connectivity to storage 5. I reinstalled all three nodes. For some reason only node 3 still shows as having updates available. (image). For clarity, I did not click "upgrade" I simply did 'reinstall' from the Web UI. Having looked at the output and yum.log from /var/log it almost looks like it did do an update. All package versions across all three nodes are the same (respective to ovirt/vdsm) (image). For some reason though ovirt-engine-appliance-3.6-20160126.1.el7.centos.noarch exists on node 1 but not on node 2 or 3. Could this be relative? I dont recall installing that specifically on node 1 but I may have Been slamming my head on this so I am hoping you can provide some assistance http://imgur.com/a/6xkaS Thanks! -- *Charles Kozler* *Vice President, IT Operations* FIX Flyer, LLC 225 Broadway | Suite 1600 | New York, NY 10007 1-888-349-3593 http://www.fixflyer.com <http://fixflyer.com> NOTICE TO RECIPIENT: THIS E-MAIL IS MEANT ONLY FOR THE INTENDED RECIPIENT(S) OF THE TRANSMISSION, AND CONTAINS CONFIDENTIAL INFORMATION WHICH IS PROPRIETARY TO FIX FLYER LLC. ANY UNAUTHORIZED USE, COPYING, DISTRIBUTION, OR DISSEMINATION IS STRICTLY PROHIBITED. ALL RIGHTS TO THIS INFORMATION IS RESERVED BY FIX FLYER LLC. IF YOU ARE NOT THE INTENDED RECIPIENT, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND PLEASE DELETE THIS E-MAIL FROM YOUR SYSTEM AND DESTROY ANY COPIES.

4 13

free-IPA Multi-Master Authentication Problem
by Kilian Ries 15 Jun '16

15 Jun '16

--_000_ef9bab9b95a64bbfbda0fcdfb57bcf55kilianriesde_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, i have two free-IPA directories setup in multi-master replication. Both are= running on CentOS 7.2 with latest Software installed. Replication between = both IPAs is setup correctly and i am able to authenticate against each of = the two manually. However, if i shutdown IPA1 and try to authenticate from oVirt 3.5.6.2 agai= nst IPA2 i can't login. Login is only working if IPA1 is running (keep in m= ind that manual authentication against IPA2 is working). In the dirSRV Error-Logfile nothing is logged, however i can see the authen= tication in the access log from IPA2: ### filter=3D"(&(|(objectClass=3Dkrbprincipalaux)(objectClass=3Dkrbprincipal)(o= bjectClass=3Dipakrbprincipal))(|(ipaKrbPrincipalAlias=3Dkrbtgt/INTERN.CUSTO= MER-VIRT.EU@INTERN.CUSTOMER-VIRT.EU)(krbPrincipalName=3Dkrbtgt/INTERN.CUSTO= MER-VIRT.EU(a)INTERN.CUSTOMER-VIRT.EU)))" attrs=3D"krbPrincipalName krbCanoni= calName ipaKrbPrincipalAlias krbUPEnabled krbPrincipalKey krbTicketPolicyRe= ference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference = krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLast= SuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAd= minUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewab= leAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatoke= nRadiusConfigLink objectClass" [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D758 RESULT err=3D0 tag=3D101 nen= tries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D759 SRCH base=3D"cn=3Dglobal_pol= icy,cn=3DINTERN.CUSTOMER-VIRT.EU,cn=3Dkerberos,dc=3Dintern,dc=3Dcustomer-vi= rt,dc=3Deu" scope=3D0 filter=3D"(objectClass=3D*)" attrs=3D"krbMaxPwdLife k= rbMinPwdLife krbPwdMinDiffChars krbPwdMinLength krbPwdHistoryLength krbPwdM= axFailure krbPwdFailureCountInterval krbPwdLockoutDuration" [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D759 RESULT err=3D0 tag=3D101 nen= tries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D760 SRCH base=3D"uid=3Dkries,cn= =3Dusers,cn=3Daccounts,dc=3Dintern,dc=3Dcustomer-virt,dc=3Deu" scope=3D0 fi= lter=3D"(objectClass=3D*)" attrs=3D"objectClass uid cn fqdn gidNumber krbPr= incipalName krbCanonicalName krbTicketPolicyReference krbPrincipalExpiratio= n krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdCh= ange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFa= iledCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLo= gonScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D760 RESULT err=3D0 tag=3D101 nen= tries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D761 MOD dn=3D"uid=3Dkries,cn=3Du= sers,cn=3Daccounts,dc=3Dintern,dc=3Dcustomer-virt,dc=3Deu" [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D761 RESULT err=3D0 tag=3D103 nen= tries=3D0 etime=3D0 csn=3D5751a1820001000d0000 [03/Jun/2016:17:18:39 +0200] conn=3D95 fd=3D109 slot=3D109 connection from = 192.168.210.45 to 192.168.210.181 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D937 SRCH base=3D"dc=3Dintern,dc= =3Dcustomer-virt,dc=3Deu" scope=3D2 filter=3D"(&(|(objectClass=3Dkrbprincip= alaux)(objectClass=3Dkrbprincipal)(objectClass=3Dipakrbprincipal))(|(ipaKrb= PrincipalAlias=3Dkrbtgt/INTERN.CUSTOMER-VIRT.EU(a)INTERN.CUSTOMER-VIRT.EU)(kr= bPrincipalName=3Dkrbtgt/INTERN.CUSTOMER-VIRT.EU(a)INTERN.CUSTOMER-VIRT.EU)))"= attrs=3D"krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias krbUPEnabl= ed krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPassw= ordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastP= wdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLog= inFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences krbTicket= Flags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipa= KrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass" [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D937 RESULT err=3D0 tag=3D101 nen= tries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D938 SRCH base=3D"dc=3Dintern,dc= =3Dcustomer-virt,dc=3Deu" scope=3D2 filter=3D"(&(|(objectClass=3Dkrbprincip= alaux)(objectClass=3Dkrbprincipal)(objectClass=3Dipakrbprincipal))(|(ipaKrb= PrincipalAlias=3Dldap/auth02.intern.customer-virt.eu(a)INTERN.CUSTOMER-VIRT.E= U)(krbPrincipalName=3Dldap/auth02.intern.customer-virt.eu(a)INTERN.CUSTOMER-V= IRT.EU)))" attrs=3D"krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias = krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiratio= n krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistor= y krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedA= uth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences= krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordH= istory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass= " [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D938 RESULT err=3D0 tag=3D101 nen= tries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D939 SRCH base=3D"cn=3DINTERN.CUS= TOMER-VIRT.EU,cn=3Dkerberos,dc=3Dintern,dc=3Dcustomer-virt,dc=3Deu" scope= =3D0 filter=3D"(objectClass=3Dkrbticketpolicyaux)" attrs=3D"krbMaxTicketLif= e krbMaxRenewableAge krbTicketFlags" [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D939 RESULT err=3D0 tag=3D101 nen= tries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D940 SRCH base=3D"dc=3Dintern,dc= =3Dcustomer-virt,dc=3Deu" scope=3D2 filter=3D"(&(|(objectClass=3Dkrbprincip= alaux)(objectClass=3Dkrbprincipal))(krbPrincipalName=3Dkries(a)INTERN.CUSTOME= R-VIRT.EU))" attrs=3D"krbPrincipalName krbCanonicalName ipaKrbPrincipalAlia= s krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpirat= ion krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHist= ory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFaile= dAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferenc= es krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwor= dHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectCla= ss" [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D940 RESULT err=3D0 tag=3D101 nen= tries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D941 SRCH base=3D"cn=3DINTERN.CUS= TOMER-VIRT.EU,cn=3Dkerberos,dc=3Dintern,dc=3Dcustomer-virt,dc=3Deu" scope= =3D0 filter=3D"(objectClass=3Dkrbticketpolicyaux)" attrs=3D"krbMaxTicketLif= e krbMaxRenewableAge krbTicketFlags" [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D941 RESULT err=3D0 tag=3D101 nen= tries=3D1 etime=3D0 ### In the oVirt Engine log i can see the following: ### 2016-06-03 17:18:40,402 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerb= erosldap.LdapSearchExceptionHandler] (ajp--127.0.0.1-8702-3) Error in commu= nicating with LDAP server auth02.intern.customer-virt.eu.intern.customer-vi= rt.eu:389; nested exception is javax.naming.CommunicationException: auth02.= intern.customer-virt.eu.intern.customer-virt.eu:389 [Root exception is java= .net.UnknownHostException: auth02.intern.customer-virt.eu.intern.customer-v= irt.eu] 2016-06-03 17:18:40,416 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerb= erosldap.DirectorySearcher] (ajp--127.0.0.1-8702-3) Failed ldap search serv= er ldap://auth02.intern.customer-virt.eu.intern.customer-virt.eu:389 using = user kries(a)INTERN.CUSTOMER-VIRT.EU due to auth02.intern.customer-virt.eu.in= tern.customer-virt.eu:389; nested exception is javax.naming.CommunicationEx= ception: auth02.intern.customer-virt.eu.intern.customer-virt.eu:389 [Root e= xception is java.net.UnknownHostException: auth02.intern.customer-virt.eu.i= ntern.customer-virt.eu]. We should try the next server 2016-06-03 17:18:41,675 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerb= erosldap.LDAPTemplateWrapper] (ajp--127.0.0.1-8702-3) Error in running LDAP= query. BaseDN is , filter is (&(objectClass=3DposixAccount)(objectClass=3D= krbPrincipalAux)(uid=3Dkries)). Exception message is: null 2016-06-03 17:18:41,681 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerb= erosldap.LdapSearchExceptionHandler] (ajp--127.0.0.1-8702-3) Ldap authentic= ation failed. Please check that the login name , password and path are corr= ect. 2016-06-03 17:18:41,690 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerb= erosldap.DirectorySearcher] (ajp--127.0.0.1-8702-3) Failed ldap search serv= er ldap://auth02.intern.customer-virt.eu:389 using user kries(a)INTERN.CUSTOM= ER-VIRT.EU due to Kerberos error. Please check log for further details.. We= should not try the next server 2016-06-03 17:18:41,698 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerb= erosldap.LdapAuthenticateUserCommand] (ajp--127.0.0.1-8702-3) Failed authen= ticating user: kries to domain intern.customer-virt.eu. Ldap Query Type is = getUserByName 2016-06-03 17:18:41,703 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerb= erosldap.LdapAuthenticateUserCommand] (ajp--127.0.0.1-8702-3) Kerberos erro= r. Please check log for further details. 2016-06-03 17:18:41,706 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerb= erosldap.LdapBrokerCommandBase] (ajp--127.0.0.1-8702-3) Failed to run comma= nd LdapAuthenticateUserCommand. Domain is intern.customer-virt.eu. User is = kries. 2016-06-03 17:18:41,712 INFO [org.ovirt.engine.core.bll.aaa.LoginBaseComma= nd] (ajp--127.0.0.1-8702-3) Cant login user "kries" with authentication pro= file "intern.customer-virt.eu" because the authentication failed. 2016-06-03 17:18:41,719 ERROR [org.ovirt.engine.core.dal.dbbroker.auditlogh= andling.AuditLogDirector] (ajp--127.0.0.1-8702-3) Correlation ID: null, Cal= l Stack: null, Custom Event ID: -1, Message: User kries(a)intern.customer-vir= t.eu failed to log in. 2016-06-03 17:18:41,723 WARN [org.ovirt.engine.core.bll.aaa.LoginAdminUser= Command] (ajp--127.0.0.1-8702-3) CanDoAction of action LoginAdminUser faile= d for user kries(a)intern.customer-virt.eu. Reasons: USER_FAILED_TO_AUTHENTIC= ATE ### Any thoughts why i can't authenticate via oVirt against IPA2? Thanks Greets Kilian --_000_ef9bab9b95a64bbfbda0fcdfb57bcf55kilianriesde_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-8859-= 1"> <style type=3D"text/css" style=3D"display:none;"></style> </head> <body dir=3D"ltr"> <div id=3D"divtagdefaultwrapper" style=3D"font-size:12pt;color:#000000;back= ground-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;"> Hi, i have two free-IPA directories setup in multi-master replication. Both = are running on CentOS 7.2 with latest Software installed. Replication betwe= en both IPAs is setup correctly and i am able to authenticate against each = of the two manually. However, if i shutdown IPA1 and try to authenticate from oVirt 3.5.6.2 a= gainst IPA2 i can't login. Login is only working if IPA1 is running (k= eep in mind that manual authentication against IPA2 is working). In the dirSRV Error-Logfile nothing is logged, however i can see the aut= hentication in the access log from IPA2: ### filter=3D"(&(|(objectClass=3Dkrbprincipalaux)(objectClass=3Dkrb= principal)(objectClass=3Dipakrbprincipal))(|(ipaKrbPrincipalAlias=3Dkrbtgt/= INTERN.CUSTOMER-VIRT.EU(a)INTERN.CUSTOMER-VIRT.EU)(krbPrincipalName=3Dkrbtgt/= INTERN.CUSTOMER-VIRT.EU(a)INTERN.CUSTOMER-VIRT.EU)))" attrs=3D"krbP= rincipalName krbCanonicalName ipaKrbPrincipalAlias krbUPEnabled krbPrincipalKey krbTick= etPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicy= Reference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAlias= es krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences kr= bTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHist= ory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass&qu= ot; [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D758 RESULT err=3D0 tag=3D= 101 nentries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D759 SRCH base=3D"cn= =3Dglobal_policy,cn=3DINTERN.CUSTOMER-VIRT.EU,cn=3Dkerberos,dc=3Dintern,dc= =3Dcustomer-virt,dc=3Deu" scope=3D0 filter=3D"(objectClass=3D*)&q= uot; attrs=3D"krbMaxPwdLife krbMinPwdLife krbPwdMinDiffChars krbPwdMin= Length krbPwdHistoryLength krbPwdMaxFailure krbPwdFailureCountInterval krbPwdLockoutDuration"</p= > [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D759 RESULT err=3D0 tag=3D= 101 nentries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D760 SRCH base=3D"uid= =3Dkries,cn=3Dusers,cn=3Daccounts,dc=3Dintern,dc=3Dcustomer-virt,dc=3Deu&qu= ot; scope=3D0 filter=3D"(objectClass=3D*)" attrs=3D"objectCl= ass uid cn fqdn gidNumber krbPrincipalName krbCanonicalName krbTicketPolicy= Reference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbLastPwdCha= nge krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFai= ledCount krbLastAdminUnlock krbTicketFlags ipaNTSecurityIdentifier ipaNTLog= onScript ipaNTProfilePath ipaNTHomeDirectory ipaNTHomeDirectoryDrive" [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D760 RESULT err=3D0 tag=3D= 101 nentries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D761 MOD dn=3D"uid=3D= kries,cn=3Dusers,cn=3Daccounts,dc=3Dintern,dc=3Dcustomer-virt,dc=3Deu"= [03/Jun/2016:17:18:39 +0200] conn=3D5 op=3D761 RESULT err=3D0 tag=3D= 103 nentries=3D0 etime=3D0 csn=3D5751a1820001000d0000 [03/Jun/2016:17:18:39 +0200] conn=3D95 fd=3D109 slot=3D109 connectio= n from 192.168.210.45 to 192.168.210.181 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D937 SRCH base=3D"dc= =3Dintern,dc=3Dcustomer-virt,dc=3Deu" scope=3D2 filter=3D"(&(= |(objectClass=3Dkrbprincipalaux)(objectClass=3Dkrbprincipal)(objectClass=3D= ipakrbprincipal))(|(ipaKrbPrincipalAlias=3Dkrbtgt/INTERN.CUSTOMER-VIRT.EU@I= NTERN.CUSTOMER-VIRT.EU)(krbPrincipalName=3Dkrbtgt/INTERN.CUSTOMER-VIRT.EU@I= NTERN.CUSTOMER-VIRT.EU)))" attrs=3D"krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias krbUP= Enabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krb= PasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krb= LastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbO= bjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccoun= tLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigL= ink objectClass" [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D937 RESULT err=3D0 tag=3D= 101 nentries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D938 SRCH base=3D"dc= =3Dintern,dc=3Dcustomer-virt,dc=3Deu" scope=3D2 filter=3D"(&(= |(objectClass=3Dkrbprincipalaux)(objectClass=3Dkrbprincipal)(objectClass=3D= ipakrbprincipal))(|(ipaKrbPrincipalAlias=3Dldap/auth02.intern.customer-virt= .eu@INTERN.CUSTOMER-VIRT.EU)(krbPrincipalName=3Dldap/auth02.intern.customer= -virt.eu(a)INTERN.CUSTOMER-VIRT.EU)))" attrs=3D"krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias krbUP= Enabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krb= PasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krb= LastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbO= bjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccoun= tLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigL= ink objectClass" [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D938 RESULT err=3D0 tag=3D= 101 nentries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D939 SRCH base=3D"cn= =3DINTERN.CUSTOMER-VIRT.EU,cn=3Dkerberos,dc=3Dintern,dc=3Dcustomer-virt,dc= =3Deu" scope=3D0 filter=3D"(objectClass=3Dkrbticketpolicyaux)&quo= t; attrs=3D"krbMaxTicketLife krbMaxRenewableAge krbTicketFlags"</= p> [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D939 RESULT err=3D0 tag=3D= 101 nentries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D940 SRCH base=3D"dc= =3Dintern,dc=3Dcustomer-virt,dc=3Deu" scope=3D2 filter=3D"(&(= |(objectClass=3Dkrbprincipalaux)(objectClass=3Dkrbprincipal))(krbPrincipalN= ame=3Dkries(a)INTERN.CUSTOMER-VIRT.EU))" attrs=3D"krbPrincipalName = krbCanonicalName ipaKrbPrincipalAlias krbUPEnabled krbPrincipalKey krbTicketPolicyReference= krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrin= cipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccess= fulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxT= icketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData = ipaUserAuthType ipatokenRadiusConfigLink objectClass" [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D940 RESULT err=3D0 tag=3D= 101 nentries=3D1 etime=3D0 [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D941 SRCH base=3D"cn= =3DINTERN.CUSTOMER-VIRT.EU,cn=3Dkerberos,dc=3Dintern,dc=3Dcustomer-virt,dc= =3Deu" scope=3D0 filter=3D"(objectClass=3Dkrbticketpolicyaux)&quo= t; attrs=3D"krbMaxTicketLife krbMaxRenewableAge krbTicketFlags"</= p> [03/Jun/2016:17:18:39 +0200] conn=3D6 op=3D941 RESULT err=3D0 tag=3D= 101 nentries=3D1 etime=3D0 ### In the oVirt Engine log i can see the following: ### 2016-06-03 17:18:40,402 ERROR [org.ovirt.engine.extensions.aaa.builtin.k= erberosldap.LdapSearchExceptionHandler] (ajp--127.0.0.1-8702-3) Error in co= mmunicating with LDAP server auth02.intern.customer-virt.eu.intern.customer= -virt.eu:389; nested exception is javax.naming.CommunicationException: auth02.intern.customer-virt.eu.intern= .customer-virt.eu:389 [Root exception is java.net.UnknownHostException: aut= h02.intern.customer-virt.eu.intern.customer-virt.eu] 2016-06-03 17:18:40,416 ERROR [org.ovirt.engine.extensions.aaa.builtin.k= erberosldap.DirectorySearcher] (ajp--127.0.0.1-8702-3) Failed ldap search s= erver ldap://auth02.intern.customer-virt.eu.intern.customer-virt.eu:389 usi= ng user kries(a)INTERN.CUSTOMER-VIRT.EU due to auth02.intern.customer-virt.eu.intern.customer-virt.eu:389; nested = exception is javax.naming.CommunicationException: auth02.intern.customer-vi= rt.eu.intern.customer-virt.eu:389 [Root exception is java.net.UnknownHostEx= ception: auth02.intern.customer-virt.eu.intern.customer-virt.eu]. We should try the next server 2016-06-03 17:18:41,675 ERROR [org.ovirt.engine.extensions.aaa.builtin.k= erberosldap.LDAPTemplateWrapper] (ajp--127.0.0.1-8702-3) Error in running L= DAP query. BaseDN is , filter is (&(objectClass=3DposixAccount)(objectC= lass=3DkrbPrincipalAux)(uid=3Dkries)). Exception message is: null 2016-06-03 17:18:41,681 ERROR [org.ovirt.engine.extensions.aaa.builtin.k= erberosldap.LdapSearchExceptionHandler] (ajp--127.0.0.1-8702-3) Ldap authen= tication failed. Please check that the login name , password and path are c= orrect.  2016-06-03 17:18:41,690 ERROR [org.ovirt.engine.extensions.aaa.builtin.k= erberosldap.DirectorySearcher] (ajp--127.0.0.1-8702-3) Failed ldap search s= erver ldap://auth02.intern.customer-virt.eu:389 using user kries(a)INTERN.CUS= TOMER-VIRT.EU due to Kerberos error. Please check log for further details.. We should not try the next server</= p> 2016-06-03 17:18:41,698 ERROR [org.ovirt.engine.extensions.aaa.builtin.k= erberosldap.LdapAuthenticateUserCommand] (ajp--127.0.0.1-8702-3) Failed aut= henticating user: kries to domain intern.customer-virt.eu. Ldap Query Type = is getUserByName 2016-06-03 17:18:41,703 ERROR [org.ovirt.engine.extensions.aaa.builtin.k= erberosldap.LdapAuthenticateUserCommand] (ajp--127.0.0.1-8702-3) Kerberos e= rror. Please check log for further details. 2016-06-03 17:18:41,706 ERROR [org.ovirt.engine.extensions.aaa.builtin.k= erberosldap.LdapBrokerCommandBase] (ajp--127.0.0.1-8702-3) Failed to run co= mmand LdapAuthenticateUserCommand. Domain is intern.customer-virt.eu. User = is kries. 2016-06-03 17:18:41,712 INFO  [org.ovirt.engine.core.bll.aaa.LoginB= aseCommand] (ajp--127.0.0.1-8702-3) Cant login user "kries" with = authentication profile "intern.customer-virt.eu" because the auth= entication failed. 2016-06-03 17:18:41,719 ERROR [org.ovirt.engine.core.dal.dbbroker.auditl= oghandling.AuditLogDirector] (ajp--127.0.0.1-8702-3) Correlation ID: null, = Call Stack: null, Custom Event ID: -1, Message: User kries(a)intern.customer-= virt.eu failed to log in. 2016-06-03 17:18:41,723 WARN  [org.ovirt.engine.core.bll.aaa.LoginA= dminUserCommand] (ajp--127.0.0.1-8702-3) CanDoAction of action LoginAdminUs= er failed for user kries(a)intern.customer-virt.eu. Reasons: USER_FAILED_TO_A= UTHENTICATE ### Any thoughts why i can't authenticate via oVirt against IPA2? Thanks Greets Kilian </div> </body> </html> --_000_ef9bab9b95a64bbfbda0fcdfb57bcf55kilianriesde_--

3 5