- Users - oVirt List Archives

clone snapshot in ovirt-shell
by Sener ATAS 26 Apr '16

26 Apr '16

hi, I want to clone a snapshot from one datastore to other datastore in ovirt shell. But I cant find the correct command? Is there any command for cloning the snapshots? Thanks. -- Sener ATAS Sistem Yönetimi Bogazici Universitesi - Bilgi Islem Merkezi Telefon: +90 212 359 47 18 E-posta: sener.atas(a)boun.edu.tr

1 0

[hosted-engine] Dedicated LUN for hosted_engine data domain?
by Wee Sritippho 26 Apr '16

26 Apr '16

Hi, I used to install oVirt hosted-engine 3.5 using fibre channel storage. It required a dedicated LUN, which can't be used by other VMs, to host the hosted engine VM. Therefore, I have to create a small LUN (50GB) for the engine VM in addition to the LUN that I used to host other VMs. Does this still apply in 3.6.x? I'm currently using 3.6.4 and notice that I can now choose to create a new domain using the LUN reserved for the hosted engine (I didn't choose that LUN, but when I create my first data domain, 'hosted_storage' domain was created automatically and that LUN can't be selected by new domains anymore), and am able to deploy a new disk to 'hosted_storage' like any other data domain. -- Wee

2 1

ovirt java sdk: Port is invalid
by David David 26 Apr '16

26 Apr '16

hi. I have a remote server running with oVirt 3.5 I'm using ovirt-engine-sdk-java-3.5.1.0-1.fc20.noarch. there is code example: my app: ===================== package lab01; import java.io.IOException; import java.util.List; import java.util.UUID; import org.apache.http.client.ClientProtocolException; import org.ovirt.engine.sdk.*; import org.ovirt.engine.sdk.decorators.*; import org.ovirt.engine.sdk.entities.*; import org.ovirt.engine.sdk.exceptions.*; public class Hello { private static final String URL = "https://10.64.0.204/api"; private static final String crt = "/home/david/Desktop/dev/server.truststore"; private static final String user = "admin@internal"; private static final String pass = "11111111"; public static void main(String[] args) throws ClientProtocolException, ServerException, UnsecuredConnectionAttemptError, IOException { Api api = new Api(URL, user, pass, crt); } } ====================== Description of problem: While trying to start my app localy on my pc, I am getting an exception: Exception in thread "main" java.lang.IllegalArgumentException: Port is invalid at org.apache.http.util.Args.check(Args.java:36) at org.apache.http.conn.scheme.Scheme.<init>(Scheme.java:92) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createSchemeRegistry(ConnectionsPoolBuilder.java:358) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createPoolingClientConnectionManager(ConnectionsPoolBuilder.java:289) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createDefaultHttpClient(ConnectionsPoolBuilder.java:261) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.build(ConnectionsPoolBuilder.java:413) at org.ovirt.engine.sdk.Api.<init>(Api.java:131) at lab01.Hello.main(Hello.java:24) But I can connect to the server in https using curl or webrowser. How to fix it ?

2 2

how to disable drap file into virt-viewer in ovirt?
by CheungPaul 26 Apr '16

26 Apr '16

--_9094e293-8f98-4fe0-8224-aaaa615187ff_ Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 RGVhcnM6DQpXZSBwZXJmZXIgdXNlciBjYW4gbm90IHRyYW5zZmVyIGZpbGUgaW50byBWTSwgYnV0 IHdlIGZvdW5kIHRoYXQgdXNlciBjYW4gZHJhcCBmaWxlIGludG8gdGhlIFZNJ3MgZGVzdG9wLiAN CmhvdyB0byBkaXNhYmxlIGl0Pw0KDQoKDQoNClNpbmNlcmVseSB5b3VycywNClBhdWxDaGV1bmcN Cg0KDQogdGVsOiAxODAtODg4Mi03MTczDQogCQkgCSAgIAkJICA= --_9094e293-8f98-4fe0-8224-aaaa615187ff_ Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxzdHlsZT48IS0tDQouaG1tZXNzYWdlIFANCnsNCm1hcmdpbjowcHg7 DQpwYWRkaW5nOjBweA0KfQ0KYm9keS5obW1lc3NhZ2UNCnsNCmZvbnQtc2l6ZTogMTJwdDsNCmZv bnQtZmFtaWx5Os6iyO3RxbraDQp9DQotLT48L3N0eWxlPjwvaGVhZD4NCjxib2R5IGNsYXNzPSdo bW1lc3NhZ2UnPjxkaXYgZGlyPSdsdHInPkRlYXJzOjxkaXY+PGJyPjwvZGl2PjxkaXY+V2UgcGVy ZmVyIHVzZXIgY2FuIG5vdCB0cmFuc2ZlciBmaWxlIGludG8gVk0sIGJ1dCB3ZSBmb3VuZCB0aGF0 IHVzZXIgY2FuIGRyYXAgZmlsZSBpbnRvIHRoZSBWTSdzIGRlc3RvcC4mbmJzcDs8L2Rpdj48ZGl2 Pjxicj48L2Rpdj48ZGl2PmhvdyB0byBkaXNhYmxlIGl0Pzxicj48YnI+PGRpdj4KPGJyPjxicj5T aW5jZXJlbHkgeW91cnMsPGJyPlBhdWxDaGV1bmc8YnI+PGJyPjxicj4mbmJzcDt0ZWw6IDE4MC04 ODgyLTcxNzM8YnI+PC9kaXY+PC9kaXY+IAkJIAkgICAJCSAgPC9kaXY+PC9ib2R5Pg0KPC9odG1s Pg== --_9094e293-8f98-4fe0-8224-aaaa615187ff_--

1 0

All field on guest info tab are unknown
by Kevin C 25 Apr '16

25 Apr '16

--=-KnL3+aRj45s3Tmd5Gv2X Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi list, On a windows VM, all field in "Guest info" tab are "unknown". ovirt agent s= tart successfully, I can see IP adress or applications. All drivers are OK. Must I reinstall my agents ? Thanks=C2=A0 Kevin C --=-KnL3+aRj45s3Tmd5Gv2X Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEeww ggXiMIIDyqADAgECAhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYT AklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0 aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eTAeFw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17AkefMyUGwrQdvwO bhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzLA84J6Ws5T4NfXZ0q n4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmCS+kICslYYWgXOMt2xlsS slxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6mySu8j8BWWHpChNNeTrFuhVfrO AyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR9t4APXGzAgMBAAGjggFkMIIBYDAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQI MAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2Eu Y3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29t MDAGCCsGAQUFBzAChiRodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0O BBYEFCSBbDlhvkkPj7cbRivJKLUnSG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7y MD8GA1UdIAQ4MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNv bS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh 2NCXTq7im61g7F1LIiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw 5kG3DN8pd1hSEUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07 v29MdhaPv3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Y klue/quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6UpVD o/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHMzcwk3EV2 B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuKKwHNL8F4GGp6 jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ8j6y6S9p0xE/Ga0p eVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMIIF/zCCBOegAwIBAgIQTLnfP04vlkvqxMUZU04a zjANBgkqhkiG9w0BAQsFADB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBMB4XDTE2MDIwMzA5NDQ1N1oXDTE3MDIwMzA5NDQ1N1owSDEf MB0GA1UEAwwWa2V2aW5AZmFtaWxsZWNvdXNpbi5mcjElMCMGCSqGSIb3DQEJARYWa2V2aW5AZmFt aWxsZWNvdXNpbi5mcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM7aVEpOkTQPuDSV lEcQ9J3Pjb+XrzJeE5nFDTD3uLfVZ5bXEsHlGJtgzS0AIT5dCgtyAO44QL8HQY/qOnyNU3/DSQIq 0c2BV/AJt9qrGdInhD32LfsyaIGyEUS1KYY++SfndVwWGxy2ZAtaqlwGSuR19mTwv4BCD0IqSLbo ANo8xR+Hy6A10BzHRBklNhMPerWxySzSNC4YMQXDwQWe9cWqm1TcvOZmnYh/O0HCjirbNcA5gpgq cimNC6YTHEsfvLzpnbi53QdJC4gobRaQKw5MuMDDMOgOZVNGaKe8MVrVelyDFbXo4VNk5CbTcXP2 YK3Lbeuu/krCbYIN6CxioW9obxIMVzCbjA4z+6CqFJNc1Qv389vMF/WkeghZQOJL5JE/zB0NFgrq hriPmX1IEA/kW/MSBWujjFwxkS3p7V/Kg98mioCBerDEuU4k77y5NuOif42e1ssKWweRoi54kfzp m/DHigfzBoqowo2pudiEuMc91ta3CtgOBqEZSiQBYqS8biHChCXZv3me6Gf8WPaqyN0OwnCD+lOx dGKd56yHHKZyfT0b/RSfJ89uWls7+Ou47sXAa7IjKRLyirqEKjmC4Efl+pAsxbMoV4ZgWIAr8/VM x1pzwoUFbdla2jYttvOEWog/c1Ss+1/WJM+Lre9ItC+LN8iKKrT7fZfKy0f9AgMBAAGjggG2MIIB sjALBgNVHQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAw HQYDVR0OBBYEFFZg5P1hZz/039cwy9+ThVfL+w6kMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJ KLUnSG1oMG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wu Y29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50 MS5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVu dDEuY3JsMCEGA1UdEQQaMBiBFmtldmluQGZhbWlsbGVjb3VzaW4uZnIwIwYDVR0SBBwwGoYYaHR0 cDovL3d3dy5zdGFydHNzbC5jb20vMEYGA1UdIAQ/MD0wOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEF BQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUAA4IBAQC0 QbMzgSfJicGx8BJneSYlo7ZxeMKKSWb8wXBj3rwCKrR1uiVx8fVIt5x/Hl1F3dZ6aVoF+dzTvUIA qTovD5ACumfqhu6qb1TiHRaCQr9tKBN6Cb5Du11muun5k5T17tFWD8qPi7u4iZCOGrynd3uWv9Dl T9a0LY6yL+GeIiIVwq8DyDHE7sqCiN+S9iL4Zkho7pS4l7mIW71JNqKZZgOANpzbCFw4lJc2NMhR GlcVdwdJeHpZyW5vpHxmNjWQ+ptaBfKaWOFO5r5na5wF2QOsbICq6e8IKNsliY9hlZnRzu32AzLj GXnmUfy+JF1+gOpSsxpzMGi+axBmxxV0gWCNMIIF/zCCBOegAwIBAgIQTLnfP04vlkvqxMUZU04a zjANBgkqhkiG9w0BAQsFADB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBMB4XDTE2MDIwMzA5NDQ1N1oXDTE3MDIwMzA5NDQ1N1owSDEf MB0GA1UEAwwWa2V2aW5AZmFtaWxsZWNvdXNpbi5mcjElMCMGCSqGSIb3DQEJARYWa2V2aW5AZmFt aWxsZWNvdXNpbi5mcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM7aVEpOkTQPuDSV lEcQ9J3Pjb+XrzJeE5nFDTD3uLfVZ5bXEsHlGJtgzS0AIT5dCgtyAO44QL8HQY/qOnyNU3/DSQIq 0c2BV/AJt9qrGdInhD32LfsyaIGyEUS1KYY++SfndVwWGxy2ZAtaqlwGSuR19mTwv4BCD0IqSLbo ANo8xR+Hy6A10BzHRBklNhMPerWxySzSNC4YMQXDwQWe9cWqm1TcvOZmnYh/O0HCjirbNcA5gpgq cimNC6YTHEsfvLzpnbi53QdJC4gobRaQKw5MuMDDMOgOZVNGaKe8MVrVelyDFbXo4VNk5CbTcXP2 YK3Lbeuu/krCbYIN6CxioW9obxIMVzCbjA4z+6CqFJNc1Qv389vMF/WkeghZQOJL5JE/zB0NFgrq hriPmX1IEA/kW/MSBWujjFwxkS3p7V/Kg98mioCBerDEuU4k77y5NuOif42e1ssKWweRoi54kfzp m/DHigfzBoqowo2pudiEuMc91ta3CtgOBqEZSiQBYqS8biHChCXZv3me6Gf8WPaqyN0OwnCD+lOx dGKd56yHHKZyfT0b/RSfJ89uWls7+Ou47sXAa7IjKRLyirqEKjmC4Efl+pAsxbMoV4ZgWIAr8/VM x1pzwoUFbdla2jYttvOEWog/c1Ss+1/WJM+Lre9ItC+LN8iKKrT7fZfKy0f9AgMBAAGjggG2MIIB sjALBgNVHQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAw HQYDVR0OBBYEFFZg5P1hZz/039cwy9+ThVfL+w6kMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJ KLUnSG1oMG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wu Y29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50 MS5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVu dDEuY3JsMCEGA1UdEQQaMBiBFmtldmluQGZhbWlsbGVjb3VzaW4uZnIwIwYDVR0SBBwwGoYYaHR0 cDovL3d3dy5zdGFydHNzbC5jb20vMEYGA1UdIAQ/MD0wOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEF BQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUAA4IBAQC0 QbMzgSfJicGx8BJneSYlo7ZxeMKKSWb8wXBj3rwCKrR1uiVx8fVIt5x/Hl1F3dZ6aVoF+dzTvUIA qTovD5ACumfqhu6qb1TiHRaCQr9tKBN6Cb5Du11muun5k5T17tFWD8qPi7u4iZCOGrynd3uWv9Dl T9a0LY6yL+GeIiIVwq8DyDHE7sqCiN+S9iL4Zkho7pS4l7mIW71JNqKZZgOANpzbCFw4lJc2NMhR GlcVdwdJeHpZyW5vpHxmNjWQ+ptaBfKaWOFO5r5na5wF2QOsbICq6e8IKNsliY9hlZnRzu32AzLj GXnmUfy+JF1+gOpSsxpzMGi+axBmxxV0gWCNMYIEXjCCBFoCAQEwgYkwdTELMAkGA1UEBhMCSUwx FjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQTLnfP04vlkvq xMUZU04azjANBglghkgBZQMEAgEFAKCCAaUwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkq hkiG9w0BCQUxDxcNMTYwNDI1MTU1NTQ5WjAvBgkqhkiG9w0BCQQxIgQgctGla3YFhCzLLMywKGKD Fd2OCzvaYHVi1JlnR3Y1N+cwgZoGCSsGAQQBgjcQBDGBjDCBiTB1MQswCQYDVQQGEwJJTDEWMBQG A1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRo b3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhBMud8/Ti+WS+rExRlT ThrOMIGcBgsqhkiG9w0BCRACCzGBjKCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNV BAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhBMud8/Ti+WS+rExRlTThrOMA0GCSqGSIb3 DQEBAQUABIICABDYLDdHyhHJzcx/TqiUYqsydgbwrKZfdbnNS320vYeUFymrf1TF8Lxw+c55uk7d Yvdr+I3qt8HTktjMLDsXL/0YeMXNSUeBd871U7XbozJeX+hWROf6zxeVUvAqRb9Ki+C+zsCFYvNw prlbmzR6CiyAWxWXluav5Cy4qyuCdPp42r7XKX6SJqAUb88EXC6GkgahiKpSn67YTyW3zum/xBg0 1K+FPzIhr3ADLLdaqFaH8FzyP6wmY6+Cy8P7pi6ivUTVJoiQAMlzVChB/20OZMalaxQeeTGLf8IE RA2v3HBQEe8Lrm/AxcuCLRDh6SF/g+N5cgl1a2HFRyAlodpZV4mVg5dsQS5v3U/sMkaSgJWnlMyk qC5GJwnbitF9CqH31VnN+oXS9k0UTYkbVavaoyucRaH202UONrIv7Fs/mKKyG8xR9zifT8NaijJa n8+jizDtIgwR7FahSPMnIPrvrXga7vQll5G9Phlou07062CJJirYeKXozDE9yECp+XN6vVPvdo/D qiRpaMm0PUkWD+8c6Kt8tuDUDopN+DtJCo6UMJTboJDSKwcDEqwzJOveTWSP8WuoJynrwjUyh7VR kLL0TQw7uHTwnobL96NtLWQ/W/B6TCXNJElGBdav1Rr1OrWJjeDr7LcpOy33Aa1GjZI6H30z12FB 72Wz+2N+qWf/AAAAAAAA --=-KnL3+aRj45s3Tmd5Gv2X--

1 0

oVirt 3.5 and SSLv3
by Robert Story 25 Apr '16

25 Apr '16

--Sig_/5hzIpMGnpyZJ8h0tE1_0JkE Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Yesterday I had to re-install a host node in my 3.5.6 cluster. After a fres= h install of CentOS 7.2, attempts to re-install failed, as did removing and= re-adding the node. Here is a log excerpt from the engine: 2016-04-19 18:22:01,100 INFO [org.ovirt.vdsm.jsonrpc.client.reactors.React= orClient] (SSL Stomp Reactor) Connecting to eclipse.localdomain/10.71.10.249 2016-04-19 18:22:01,116 WARN [org.ovirt.vdsm.jsonrpc.client.utils.retry.Re= tryable] (SSL Stomp Reactor) Retry failed 2016-04-19 18:22:01,129 ERROR [org.ovirt.vdsm.jsonrpc.client.reactors.React= orClient] (DefaultQuartzScheduler_Worker-38) Exception during connection 2016-04-19 18:22:01,208 ERROR [org.ovirt.engine.core.vdsbroker.vdsbroker.Ge= tCapabilitiesVDSCommand] (DefaultQuartzScheduler_Worker-38) Command GetCapa= bilitiesVDSCommand(HostName =3D eclipse, HostId =3D 37a4a1c2-4906-489e-947c= -1ef9fb828bc5, vds=3DHost[eclipse,37a4a1c2-4906-489e-947c-1ef9fb828bc5]) ex= ecution failed. Exception: VDSNetworkException: java.net.NoRouteToHostExcep= tion: No route to host 2016-04-19 18:22:01,209 WARN [org.ovirt.engine.core.vdsbroker.VdsManager] = (DefaultQuartzScheduler_Worker-38) Host eclipse is not responding. It will = stay in Connecting state for a grace period of 120 seconds and after that a= n attempt to fence the host will be issued. 2016-04-19 18:22:01,938 ERROR [org.ovirt.engine.core.vdsbroker.VdsUpdateRun= TimeInfo] (DefaultQuartzScheduler_Worker-38) Failure to refresh Vds runtime= info: org.ovirt.engine.core.vdsbroker.vdsbroker.VDSNetworkException: java.= net.NoRouteToHostException: No route to host at org.ovirt.engine.core.vdsbroker.vdsbroker.VdsBrokerCommand.creat= eNetworkException(VdsBrokerCommand.java:126) [vdsbroker.jar:] Luckily seeing SSL+java in the log tickled my memory about java disabling S= SLv3, and google helped me find this workaround: - edit /usr/lib/jvm/java/jre/lib/security/java.security - look for jdk.tls.disabledAlgorithms - remove SSLv3 from the list - service ovirt-engine restart Google also tells me that this should be an issue for 3.5, and there is a vdsm setting, VdsmSSLProtocol, that can be set to use TLS, but I can't find how to change/set it. Anyone know the secret? Robert --=20 Senior Software Engineer @ Parsons --Sig_/5hzIpMGnpyZJ8h0tE1_0JkE Content-Type: application/pgp-signature Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlcXeHIACgkQ7/fVLLY1mnimKgCeL1PD9TRtKtdxC07VPjs3A3eh a4sAnieFpARV2TUY6Ot0PbZoFI5PNgBm =NjWI -----END PGP SIGNATURE----- --Sig_/5hzIpMGnpyZJ8h0tE1_0JkE--

3 4

advanced users authentication, using kerberos, CAS SSO and Active Directory
by Fabrice Bacchella 25 Apr '16

25 Apr '16

--Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I have a production were hard coded password are avoided. We prefer to = use kerberos. We also provided a SSO for Web UI using CAS = <http://jasig.github.io/cas/4.2.x/index.html>. We use ActiveDirectory = for user backend. So I wanted a oVirt installation that will use kerberos for API = authentication. For the web ui, kerberos is not always the best = solution, so I wanted to integrated it in our CAS. The Apache part was easy to setup. I will show only subpart of the whole Apache setup and only = authentication related part # The CAS modules LoadModule authz_user_module = /usr/lib64/httpd/modules/mod_authz_user.so # Needed because auth_cas_module forget to link openssl LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so LoadModule auth_cas_module = /usr/lib64/httpd/modules/mod_auth_cas.so # For the kerberos authentication on the API LoadModule auth_gssapi_module = /usr/lib64/httpd/modules/mod_auth_gssapi.so LoadModule session_module /usr/lib64/httpd/modules/mod_session.so LoadModule session_cookie_module = /usr/lib64/httpd/modules/mod_session_cookie.so CASLoginURL https://sso/cas/login CASValidateSAML On CASValidateURL https://sso/cas/samlValidate <VirtualHost *:443> RequestHeader unset X-Remote-User early <LocationMatch ^/api($|/)> RewriteEngine on RewriteCond %{LA-U:REMOTE_USER} ^(.*@DOMAIN)$ RewriteRule ^(.*)$ - [L,P,E=3DREMOTE_USER:%1] RequestHeader set X-Remote-User %{REMOTE_USER}s AuthType GSSAPI AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:.../httpd.keytab Require valid-user GssapiUseSessions On Session On SessionCookieName ovirt_gssapi_session = path=3D/private;httponly;secure; </LocationMatch> <LocationMatch = ^/(ovirt-engine($|/)|RHEVManagerWeb/|OvirtEngineWeb/|ca.crt$|engine.ssh.ke= y.txt$|rhevm.ssh.key.txt$)> AuthType CAS Require valid-user CASAuthNHeader X-Remote-User </LocationMatch> </VirtualHost> The authn file /etc/ovirt-engine/extensions.d/apachesso-authn.properties = is : ovirt.engine.extension.name =3D apachesso-authn ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.misc.http.AuthnExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name =3D apachesso ovirt.engine.aaa.authn.authz.plugin =3D DOMAIN-authz config.artifact.name =3D HEADER config.artifact.arg =3D X-Remote-User And the authz file = /etc/ovirt-engine/extensions.d/DOMAIN-authz.properties is: ovirt.engine.extension.name =3D DOMAIN-authz ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 =3D ../aaa/DOMAIN.properties I had some difficulties with AD backend. A straightforward solution = would have been : include =3D <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D domain.com pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 # Only TLSv1.2 is secure nowadays pool.default.ssl.startTLSProtocol =3D TLSv1.2 # long time out should be avoided pool.default.connection-options.connectTimeoutMillis =3D 500 But if fails. We have a special setup with about 100 domain controlers = and only two of them can be reached from the ovirt engine. So my first = try was so defined them directly in the configuration file: pool.default.serverset.type =3D failover pool.default.serverset.failover.1.server =3D dcX.domain.com pool.default.serverset.failover.2.server =3D dcY.domain.com But that fails. Server-engine was still using a lot of unreachable = domain controler. After some digging I found that other part of the ldap = extension use a different serverset, I don=E2=80=99t know why it don=E2=80= =99t reuse the default pool. It=E2=80=99s called pool.default.dc-resolve = (it should be called pool.dc-resolve, as it=E2=80=99s not the default = but a custom one), so I added in my configuration: pool.default.dc-resolve.default.serverset.type =3D failover pool.default.dc-resolve.serverset.failover.1.server =3D dcX.domain.com pool.default.dc-resolve.serverset.failover.2.server =3D dcY.domain.com But there is a better solution. Ondra Machacek point it to me. In Active = Directory, there is something called a =E2=80=9Csite=E2=80=9D, with a = subset of all the domain controler in it. It can be found under = CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN,... To list them: ldapsearch -H ldap://somedc -b CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN = -s one -o ldif-wrap=3Dno cn The information to write down is the cn returned You get a list of all domain, just pick the right one, remove all the = serverset configuration and add : pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} The entry _sites.${domain} don=E2=80=99t exist in the DNS, so to check = that your regex is good, try instead: dig +short _ldap._tcp.GOOD_SITE._sites.${domain} srv It should return only reachable domain controlers. So the final /etc/ovirt-engine/aaa/DOMAIN.properties was : include =3D <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D domain.com pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 pool.default.ssl.startTLSProtocol =3D TLSv1.2 pool.default.connection-options.connectTimeoutMillis =3D 500 pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} With this setup, my python client = <https://github.com/fbacchella/ovirtcmd> can connect to ovirt-engine = using kerberos ticket, web users are authenticated using CAS. And there = is no need to duplicate user base. --Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D"">I have a production were hard coded password are avoided. We = prefer to use kerberos. We also provided a SSO for Web UI using <a = href=3D"http://jasig.github.io/cas/4.2.x/index.html" style=3D"color: = rgb(104, 0, 148); text-decoration: none; margin-top: auto;" = class=3D"">CAS</a>. We use ActiveDirectory for user backend.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">So I wanted a oVirt installation that will use kerberos for = API authentication. For the web ui, kerberos is not always the best = solution, so I wanted to integrated it in our CAS.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">The Apache part was easy to setup.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">I will show only subpart of the whole Apache setup and only = authentication related part<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D""># The CAS modules LoadModule authz_user_module = /usr/lib64/httpd/modules/mod_authz_user.so # Needed because auth_cas_module forget to link openssl LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so LoadModule auth_cas_module = /usr/lib64/httpd/modules/mod_auth_cas.so # For the kerberos authentication on the API LoadModule auth_gssapi_module = /usr/lib64/httpd/modules/mod_auth_gssapi.so LoadModule session_module /usr/lib64/httpd/modules/mod_session.so LoadModule session_cookie_module = /usr/lib64/httpd/modules/mod_session_cookie.so CASLoginURL <a href=3D"https://sso/cas/login" = class=3D"">https://sso/cas/login</a> CASValidateSAML On CASValidateURL <a href=3D"https://sso/cas/samlValidate" = class=3D"">https://sso/cas/samlValidate</a> <VirtualHost *:443> RequestHeader unset X-Remote-User early <LocationMatch ^/api($|/)> RewriteEngine on RewriteCond %{LA-U:REMOTE_USER} ^(.*@DOMAIN)$ RewriteRule ^(.*)$ - [L,P,E=3DREMOTE_USER:%1] RequestHeader set X-Remote-User %{REMOTE_USER}s AuthType GSSAPI AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:.../httpd.keytab Require valid-user GssapiUseSessions On Session On SessionCookieName ovirt_gssapi_session = path=3D/private;httponly;secure; </LocationMatch> <LocationMatch = ^/(ovirt-engine($|/)|RHEVManagerWeb/|OvirtEngineWeb/|ca.crt$|engine.ssh.ke= y.txt$|rhevm.ssh.key.txt$)> AuthType CAS Require valid-user CASAuthNHeader X-Remote-User </LocationMatch> </VirtualHost> </code></pre>The authn file <code style=3D"font-size: 12px; = font-family: Menlo, Monaco, 'Courier New', monospace; word-wrap: = break-word; white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">/etc/ovirt-engine/extensions.d/apachesso-authn.properties</code= > is :<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">ovirt.engine.extension.name =3D apachesso-authn ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.misc.http.AuthnExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name =3D apachesso ovirt.engine.aaa.authn.authz.plugin =3D DOMAIN-authz config.artifact.name =3D HEADER config.artifact.arg =3D X-Remote-User </code></pre>And the authz file <code style=3D"font-size: 12px; = font-family: Menlo, Monaco, 'Courier New', monospace; word-wrap: = break-word; white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">/etc/ovirt-engine/extensions.d/DOMAIN-authz.properties</code>&n= bsp;is:<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">ovirt.engine.extension.name =3D DOMAIN-authz ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 =3D ../aaa/DOMAIN.properties </code></pre>I had some difficulties with AD backend. A straightforward = solution would have been :<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">include =3D = <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D <a href=3D"http://domain.com" class=3D"">domain.com</a> pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 # Only TLSv1.2 is secure nowadays pool.default.ssl.startTLSProtocol =3D TLSv1.2 # long time out should be avoided pool.default.connection-options.connectTimeoutMillis =3D 500 </code></pre>But if fails. We have a special setup with about 100 domain = controlers and only two of them can be reached from the ovirt engine. So = my first try was so defined them directly in the configuration = file:<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.serverset.type =3D failover pool.default.serverset.failover.1.server =3D <a = href=3D"http://dcX.domain.com" class=3D"">dcX.domain.com</a> pool.default.serverset.failover.2.server =3D <a = href=3D"http://dcY.domain.com" class=3D"">dcY.domain.com</a> </code></pre>But that fails. Server-engine was still using a lot of = unreachable domain controler. After some digging I found that other part = of the ldap extension use a different serverset, I don=E2=80=99t know = why it don=E2=80=99t reuse the default pool. It=E2=80=99s = called <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">pool.default.dc-resolve</code> (it should be = called <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px;" = class=3D"">pool.dc-resolve</code>, as it=E2=80=99s not the default but a = custom one), so I added in my configuration:<pre style=3D"font-family:= Menlo, Monaco, 'Courier New', monospace; word-wrap: normal; = white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.dc-resolve.default.serverset.type =3D failover pool.default.dc-resolve.serverset.failover.1.server =3D <a = href=3D"http://dcX.domain.com" class=3D"">dcX.domain.com</a> pool.default.dc-resolve.serverset.failover.2.server =3D <a = href=3D"http://dcY.domain.com" class=3D"">dcY.domain.com</a> </code></pre>But there is a better solution. Ondra Machacek point it to = me. In Active Directory, there is something called a =E2=80=9Csite=E2=80=9D= , with a subset of all the domain controler in it. It can be found = under <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN,...</code><p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">To list them:<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">ldapsearch -H <a = href=3D"ldap://somedc" class=3D"">ldap://somedc</a> -b = CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN -s one -o ldif-wrap=3Dno cn </code></pre>The information to write down is the cn returned<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">You get a list of all domain, just pick the right one, remove = all the serverset configuration and add :<pre style=3D"font-family: = Menlo, Monaco, 'Courier New', monospace; word-wrap: normal; white-space: = pre-wrap; padding: 0.6em 0.8em; -webkit-margin-before-collapse: = collapse; -webkit-margin-after-collapse: collapse; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.serverset.srvrecord.domain-conversion.type =3D = regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} </code></pre>The entry <code style=3D"font-size: 12px; font-family: = Menlo, Monaco, 'Courier New', monospace; word-wrap: break-word; = white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">_sites.${domain}</code> don=E2=80=99t exist in the DNS, = so to check that your regex is good, try instead:<pre = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">dig +short = _ldap._tcp.GOOD_SITE._sites.${domain} srv </code></pre>It should return only reachable domain controlers.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">So the final /etc/ovirt-engine/aaa/DOMAIN.properties was = :<pre style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">include =3D = <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D <a href=3D"http://domain.com" class=3D"">domain.com</a> pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 pool.default.ssl.startTLSProtocol =3D TLSv1.2 pool.default.connection-options.connectTimeoutMillis =3D 500 pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} </code></pre>With this setup, my <a = href=3D"https://github.com/fbacchella/ovirtcmd" style=3D"color: rgb(104, = 0, 148); text-decoration: none; margin-top: auto;" class=3D"">python = client</a> can connect to ovirt-engine using kerberos ticket, web = users are authenticated using CAS. And there is no need to duplicate = user base.<div class=3D""> </div></body></html>= --Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205--

1 0

Re: [ovirt-users] Unable to install CentOS 6.7 on ovirt 3.5/.6
by Yaniv Kaul 25 Apr '16

25 Apr '16

The checksum looks correct. From a bit of Googling around, might be a (known?) issue - can you try the workaround mentioned @ https://bugzilla.redhat.com/show_bug.cgi?id=632811 ? Y. On Fri, Apr 22, 2016 at 6:37 AM, Gene Fontanilla <ginofontanilla(a)gmail.com> wrote: > follow up attachment. > > everything freezes here. > > regards, > Gene > > On Fri, Apr 22, 2016 at 10:57 AM, Gene Fontanilla < > ginofontanilla(a)gmail.com> wrote: > >> Hi, >> >> md5sum: 9381a24b8bee2fed0c26896141a64b69 >> >> please see attached screenshots, i didn't find any error logs on >> engine.log. >> >> weird thing is that windows installations work like a charm. >> >> regards, >> Gene >> >> >> >> On Thu, Apr 21, 2016 at 8:12 PM, Yaniv Kaul <ykaul(a)redhat.com> wrote: >> >>> >>> >>> On Thu, Apr 21, 2016 at 5:18 AM, Gene Fontanilla < >>> ginofontanilla(a)gmail.com> wrote: >>> >>>> Hi, >>>> >>>> Anyone having issues on using CentOS 6.6 iso on oVirt 3.5 and 3.6? >>>> >>>> I have two environments for testing (oVirt 3.5 and 3.6) and I can't >>>> install centos 6.6 iso on the vms. >>>> >>>> it after anaconda installer starts. >>>> >>> >>> Can you provide a bit more information? Can you ensure the ISO is not >>> corrupted (check its MD5/SHA sum) ? >>> Y. >>> >>> >>>> >>>> regards. >>>> Gene >>>> >>>> _______________________________________________ >>>> Users mailing list >>>> Users(a)ovirt.org >>>> http://lists.ovirt.org/mailman/listinfo/users >>>> >>>> >>> >> >

2 3

Hosted Engine installation fails while deploying in hyper-converged configuration
by Stefano Stagnaro 24 Apr '16

24 Apr '16

Hi, while deploying Hosted Engine in hyper-converged configuration, installation fails with following error: [ ERROR ] Failed to execute stage 'Environment customization': <Fault 1: "<type 'exceptions.TypeError'>:cannot marshal None unless allow_none is enabled"> I followed Ramesh post: http://blogs-ramesh.blogspot.it/2016/01/ovirt-and-gluster-hyperconvergence.… My setup includes 3 hosts with: - ovirt 3.6.3 - glusterfs 3.7.8 - vdsm 4.17.23.2 - replica 3 gluster volume - no firewall - selinux enforcing - 1 network for management, 1 network for gluster I've uploaded logs on pastebin: - hosted-engine --deploy http://pastebin.com/aZwwdt51 - ovirt-hosted-engine-setup.log http://pastebin.com/114zfbAB - rhev-data-center-mnt-glusterSD-h4gfs.newvirt:_engine.log http://pastebin.com/GL4yyT95 - vdsm.log http://pastebin.com/WjSm0cHQ Thank you very much for your help. -- Stefano Stagnaro Prisma Telecom Testing S.r.l. Via Petrocchi, 4 20127 Milano – Italy Tel. 02 26113507 int 339 e-mail: stefanos(a)prismatelecomtesting.com skype: stefano.stagnaro

3 7

Procedure to upgrade single-host datacenter from el6 to el7
by Rik Theys 24 Apr '16

24 Apr '16

Hi, I'm looking for the best procedure to upgrade a host from CentOS 6 to CentOS 7. The host is the only host in the oVirt data center (the engine is running on another machine and manages multiple data centers). For datacenters with multiple hosts I followed the following steps: - Add new cluster - Put host in maintenance - Remove host from old cluster - Reinstall host - Add host to new cluster - repeat for all hosts until old cluster is empty This worked OK and the data center was never "non operational". Is the procedure identical for a data center with only one host? Should I also remove the host from the (only) cluster in the data center, or should I reinstall it and select the "reinstall" option in the oVirt web interface? Since there is only one host in the cluster there's no need to create a new cluster? Is there any state on the host that I should keep when performing the reinstall with CentOS 7? The host is using FC storage (local disks configured as FC through multipath). Regards, Rik -- Rik Theys System Engineer KU Leuven - Dept. Elektrotechniek (ESAT) Kasteelpark Arenberg 10 bus 2440 - B-3001 Leuven-Heverlee +32(0)16/32.11.07 ---------------------------------------------------------------- <<Any errors in spelling, tact or fact are transmission errors>>

2 3