- Users - oVirt List Archives

[ANN] oVirt Node Next Beta
by Fabian Deutsch 27 Apr '16

27 Apr '16

Hey, the just released oVirt 3.6.6rc1 release marks the first official oVirt release which is accompanied by oVirt Node Next (Beta). Since it's pre-alpha release a few weeks ago, Node has seen a lot of testing and fixes, which brought it to the beta level. If you have not yet started to test oVirt Node Next, this is the time to do so. Take a look at the quick-start guide to see the next steps [0]. What is oVirt Node? oVirt Node is a ready-to-use OS image, containing all the OS and oVirt packages needed to act as host for oVirt Engine. The image can be installed in minutes, can be administered using Cockpit [1], and provides a safe upgrade and rollback mechanism. Where can I learn more about oVirt Node? A quick-start guide, and links to additional documentation can be found on the oVirt Node Project page <http://www.ovirt.org/node/>. On behalf of the Node team - fabian -- [0] http://www.ovirt.org/node/ [1] http://cockpit-project.org/

1 0

[ANN] oVirt 3.6.6 First Release Candidate is now available for testing
by Sandro Bonazzola 27 Apr '16

27 Apr '16

The oVirt Project is pleased to announce the availability of the First Release Candidate of oVirt 3.6.6 for testing, as of April 27th, 2016 This release is available now for: * Fedora 22 * Red Hat Enterprise Linux 6.7 * CentOS Linux 6.7 (or similar) * Red Hat Enterprise Linux 7.2 or later * CentOS Linux (or similar) 7.2 or later This release supports Hypervisor Hosts running: * Red Hat Enterprise Linux 7.2 or later * CentOS Linux (or similar) 7.2 or later * Fedora 22 This release candidate includes the following updated packages: * ovirt-engine * ovirt-engine-extension-aaa-jdbc * ovirt-engine-extension-aaa-ldap * ovirt-engine-dwh-3.6.6 (git hash 33f6636) * ovirt-hosted-engine-setup-1.3.6.0 * ovirt-vmconsole v1.0.2 * vdsm v4.17.27 See the release notes [1] for installation / upgrade instructions and a list of new features and bugs fixed. Notes: * A new oVirt Live ISO is already available [2]. * A new oVirt Node Next Install ISO is already available[3] * Mirrors[4] might need up to one day to synchronize. Additional Resources: * Read more about the oVirt 3.6.6 release highlights: http://www.ovirt.org/release/3.6.6/ * Get more oVirt Project updates on Twitter: https://twitter.com/ovirt * Check out the latest project news on the oVirt blog: http://www.ovirt.org/blog/ [1] http://www.ovirt.org/release/3.6.6/ [2] http://resources.ovirt.org/pub/ovirt-3.6-pre/iso/ovirt-live/ [3] http://resources.ovirt.org/pub/ovirt-3.6-pre/iso/ovirt-node-ng-installer/ [4] http://www.ovirt.org/Repository_mirrors#Current_mirrors -- Sandro Bonazzola Better technology. Faster innovation. Powered by community collaboration. See how it works at redhat.com

1 0

hosted engine won't come up
by Pat Riehecky 26 Apr '16

26 Apr '16

I've just done a clean install of the 3.6 hosted engine (decided to wipe out my previous system) The install went in just fine, no errors I saw, but I'm getting interesting errors in the ovirt-hosted-engine-ha agent.log I have no idea what to do about these errors.... ----- MainThread::INFO::2016-04-25 22:28:33,842::hosted_engine::462::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(start_monitoring) Current state EngineUp (score: 3400) MainThread::INFO::2016-04-25 22:28:43,896::hosted_engine::613::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_vdsm) Initializing VDSM MainThread::INFO::2016-04-25 22:28:43,953::hosted_engine::658::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Connecting the storage MainThread::INFO::2016-04-25 22:28:43,954::storage_server::207::ovirt_hosted_engine_ha.lib.storage_server.StorageServer::(connect_storage_server) Connecting storage server MainThread::INFO::2016-04-25 22:28:43,954::storage_server::219::ovirt_hosted_engine_ha.lib.storage_server.StorageServer::(connect_storage_server) Refreshing the storage domain MainThread::INFO::2016-04-25 22:28:44,064::hosted_engine::685::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Preparing images MainThread::INFO::2016-04-25 22:28:44,064::image::126::ovirt_hosted_engine_ha.lib.image.Image::(prepare_images) Preparing images MainThread::INFO::2016-04-25 22:28:45,070::hosted_engine::688::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Reloading vm.conf from the shared storage domain MainThread::INFO::2016-04-25 22:28:45,071::config::205::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine.config::(refresh_local_conf_file) Trying to get a fresher copy of vm configuration from the OVF_STORE MainThread::WARNING::2016-04-25 22:28:45,658::ovf_store::104::ovirt_hosted_engine_ha.lib.ovf.ovf_store.OVFStore::(scan) Unable to find OVF_STORE MainThread::ERROR::2016-04-25 22:28:45,658::config::234::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine.config::(refresh_local_conf_file) Unable to get vm.conf from OVF_STORE, falling back to initial vm.conf MainThread::INFO::2016-04-25 22:28:45,744::hosted_engine::462::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(start_monitoring) Current state EngineUp (score: 3400) MainThread::INFO::2016-04-25 22:28:55,796::hosted_engine::613::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_vdsm) Initializing VDSM MainThread::INFO::2016-04-25 22:28:55,855::hosted_engine::658::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Connecting the storage MainThread::INFO::2016-04-25 22:28:55,856::storage_server::207::ovirt_hosted_engine_ha.lib.storage_server.StorageServer::(connect_storage_server) Connecting storage server MainThread::INFO::2016-04-25 22:28:55,856::storage_server::219::ovirt_hosted_engine_ha.lib.storage_server.StorageServer::(connect_storage_server) Refreshing the storage domain MainThread::INFO::2016-04-25 22:28:55,967::hosted_engine::685::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Preparing images MainThread::INFO::2016-04-25 22:28:55,967::image::126::ovirt_hosted_engine_ha.lib.image.Image::(prepare_images) Preparing images MainThread::INFO::2016-04-25 22:28:56,987::hosted_engine::688::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Reloading vm.conf from the shared storage domain MainThread::INFO::2016-04-25 22:28:56,988::config::205::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine.config::(refresh_local_conf_file) Trying to get a fresher copy of vm configuration from the OVF_STORE MainThread::WARNING::2016-04-25 22:28:57,572::ovf_store::104::ovirt_hosted_engine_ha.lib.ovf.ovf_store.OVFStore::(scan) Unable to find OVF_STORE MainThread::ERROR::2016-04-25 22:28:57,573::config::234::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine.config::(refresh_local_conf_file) Unable to get vm.conf from OVF_STORE, falling back to initial vm.conf MainThread::INFO::2016-04-25 22:28:57,661::hosted_engine::462::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(start_monitoring) Current state EngineUp (score: 3400) MainThread::INFO::2016-04-25 22:29:07,711::states::421::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(consume) Engine vm running on localhost MainThread::INFO::2016-04-25 22:29:07,716::hosted_engine::613::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_vdsm) Initializing VDSM MainThread::INFO::2016-04-25 22:29:07,774::hosted_engine::658::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Connecting the storage MainThread::INFO::2016-04-25 22:29:07,774::storage_server::207::ovirt_hosted_engine_ha.lib.storage_server.StorageServer::(connect_storage_server) Connecting storage server MainThread::INFO::2016-04-25 22:29:07,775::storage_server::219::ovirt_hosted_engine_ha.lib.storage_server.StorageServer::(connect_storage_server) Refreshing the storage domain MainThread::INFO::2016-04-25 22:29:07,883::hosted_engine::685::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Preparing images MainThread::INFO::2016-04-25 22:29:07,883::image::126::ovirt_hosted_engine_ha.lib.image.Image::(prepare_images) Preparing images MainThread::INFO::2016-04-25 22:29:08,893::hosted_engine::688::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine::(_initialize_storage_images) Reloading vm.conf from the shared storage domain MainThread::INFO::2016-04-25 22:29:08,894::config::205::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine.config::(refresh_local_conf_file) Trying to get a fresher copy of vm configuration from the OVF_STORE MainThread::WARNING::2016-04-25 22:29:09,486::ovf_store::104::ovirt_hosted_engine_ha.lib.ovf.ovf_store.OVFStore::(scan) Unable to find OVF_STORE MainThread::ERROR::2016-04-25 22:29:09,486::config::234::ovirt_hosted_engine_ha.agent.hosted_engine.HostedEngine.config::(refresh_local_conf_file) Unable to get vm.conf from OVF_STORE, falling back to initial vm.conf ----- # vdsClient -s 0 getStorageDomainsList 81f19871-4d91-4698-a97d-36452bfae281 # vgdisplay WARNING: duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy is being used from both devices /dev/mapper/36000402001f45bbe7eecc5f800000000 and /dev/sdh Found duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy: using /dev/mapper/36000402001f45bbe7eecc5f800000000 not /dev/sdh Using duplicate PV /dev/mapper/36000402001f45bbe7eecc5f800000000 from subsystem DM, ignoring /dev/sdh WARNING: duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy is being used from both devices /dev/mapper/36000402001f45bbe7eecc5f800000000 and /dev/sdg Found duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy: using /dev/mapper/36000402001f45bbe7eecc5f800000000 not /dev/sdg Using duplicate PV /dev/mapper/36000402001f45bbe7eecc5f800000000 from subsystem DM, ignoring /dev/sdg WARNING: duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy is being used from both devices /dev/mapper/36000402001f45bbe7eecc5f800000000 and /dev/sdd Found duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy: using /dev/mapper/36000402001f45bbe7eecc5f800000000 not /dev/sdd Using duplicate PV /dev/mapper/36000402001f45bbe7eecc5f800000000 from subsystem DM, ignoring /dev/sdd WARNING: duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy is being used from both devices /dev/mapper/36000402001f45bbe7eecc5f800000000 and /dev/sdc Found duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy: using /dev/mapper/36000402001f45bbe7eecc5f800000000 not /dev/sdc Using duplicate PV /dev/mapper/36000402001f45bbe7eecc5f800000000 from subsystem DM, ignoring /dev/sdc --- Volume group --- VG Name 81f19871-4d91-4698-a97d-36452bfae281 System ID Format lvm2 Metadata Areas 2 Metadata Sequence No 23 VG Access read/write VG Status resizable MAX LV 0 Cur LV 10 Open LV 3 Max PV 0 Cur PV 1 Act PV 1 VG Size 60.00 GiB PE Size 128.00 MiB Total PE 480 Alloc PE / Size 441 / 55.12 GiB Free PE / Size 39 / 4.88 GiB VG UUID 3M7kuh-FjyR-WMPL-ztl0-h1cK-EwQb-32ASCD # lvs WARNING: duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy is being used from both devices /dev/mapper/36000402001f45bbe7eecc5f800000000 and /dev/sdh Found duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy: using /dev/mapper/36000402001f45bbe7eecc5f800000000 not /dev/sdh Using duplicate PV /dev/mapper/36000402001f45bbe7eecc5f800000000 from subsystem DM, ignoring /dev/sdh WARNING: duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy is being used from both devices /dev/mapper/36000402001f45bbe7eecc5f800000000 and /dev/sdg Found duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy: using /dev/mapper/36000402001f45bbe7eecc5f800000000 not /dev/sdg Using duplicate PV /dev/mapper/36000402001f45bbe7eecc5f800000000 from subsystem DM, ignoring /dev/sdg WARNING: duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy is being used from both devices /dev/mapper/36000402001f45bbe7eecc5f800000000 and /dev/sdd Found duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy: using /dev/mapper/36000402001f45bbe7eecc5f800000000 not /dev/sdd Using duplicate PV /dev/mapper/36000402001f45bbe7eecc5f800000000 from subsystem DM, ignoring /dev/sdd WARNING: duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy is being used from both devices /dev/mapper/36000402001f45bbe7eecc5f800000000 and /dev/sdc Found duplicate PV xpHUtx05gHRcq1U33Mu1NMGLXVOtqnmy: using /dev/mapper/36000402001f45bbe7eecc5f800000000 not /dev/sdc Using duplicate PV /dev/mapper/36000402001f45bbe7eecc5f800000000 from subsystem DM, ignoring /dev/sdc LV VG Attr LSize Pool Origin Data% Meta% Move Log Cpy%Sync Convert 0593a3b8-1d75-4be3-b65b-ce9a164d0309 81f19871-4d91-4698-a97d-36452bfae281 -wi-ao---- 128.00m 07c72aa5-7fd0-4159-b83e-4d078ae9c351 81f19871-4d91-4698-a97d-36452bfae281 -wi-a----- 1.00g 93cf12c5-d5e6-4ea6-bee7-de64ee52d7a5 81f19871-4d91-4698-a97d-36452bfae281 -wi-a----- 128.00m c4244bdd-80c5-4f68-83c2-9494d9d05723 81f19871-4d91-4698-a97d-36452bfae281 -wi-ao---- 50.00g ids 81f19871-4d91-4698-a97d-36452bfae281 -wi-ao---- 128.00m inbox 81f19871-4d91-4698-a97d-36452bfae281 -wi-a----- 128.00m leases 81f19871-4d91-4698-a97d-36452bfae281 -wi-a----- 2.00g master 81f19871-4d91-4698-a97d-36452bfae281 -wi-a----- 1.00g metadata 81f19871-4d91-4698-a97d-36452bfae281 -wi-a----- 512.00m outbox 81f19871-4d91-4698-a97d-36452bfae281 -wi-a----- 128.00m # rpm -qa |grep ovirt ovirt-engine-sdk-python-3.6.3.0-1.el7 ovirt-vmconsole-1.0.0-1.el7 ovirt-vmconsole-host-1.0.0-1.el7 libgovirt-0.3.3-1.el7_2.1 ovirt-setup-lib-1.0.1-1.el7 ovirt-hosted-engine-setup-1.3.4.0-1.el7 ovirt-host-deploy-1.4.1-1.el7 ovirt-hosted-engine-ha-1.3.5.1-1.el7 # rpm -qa |grep vdsm vdsm-jsonrpc-4.17.23.2-0.el7 vdsm-4.17.23.2-0.el7 vdsm-python-4.17.23.2-0.el7 vdsm-xmlrpc-4.17.23.2-0.el7 vdsm-yajsonrpc-4.17.23.2-0.el7 vdsm-hook-vmfex-dev-4.17.23.2-0.el7 vdsm-cli-4.17.23.2-0.el7 vdsm-infra-4.17.23.2-0.el7 -- Pat Riehecky Scientific Linux developer Fermi National Accelerator Laboratory www.fnal.gov www.scientificlinux.org

3 5

clone snapshot in ovirt-shell
by Sener ATAS 26 Apr '16

26 Apr '16

hi, I want to clone a snapshot from one datastore to other datastore in ovirt shell. But I cant find the correct command? Is there any command for cloning the snapshots? Thanks. -- Sener ATAS Sistem Yönetimi Bogazici Universitesi - Bilgi Islem Merkezi Telefon: +90 212 359 47 18 E-posta: sener.atas(a)boun.edu.tr

1 0

[hosted-engine] Dedicated LUN for hosted_engine data domain?
by Wee Sritippho 26 Apr '16

26 Apr '16

Hi, I used to install oVirt hosted-engine 3.5 using fibre channel storage. It required a dedicated LUN, which can't be used by other VMs, to host the hosted engine VM. Therefore, I have to create a small LUN (50GB) for the engine VM in addition to the LUN that I used to host other VMs. Does this still apply in 3.6.x? I'm currently using 3.6.4 and notice that I can now choose to create a new domain using the LUN reserved for the hosted engine (I didn't choose that LUN, but when I create my first data domain, 'hosted_storage' domain was created automatically and that LUN can't be selected by new domains anymore), and am able to deploy a new disk to 'hosted_storage' like any other data domain. -- Wee

2 1

ovirt java sdk: Port is invalid
by David David 26 Apr '16

26 Apr '16

hi. I have a remote server running with oVirt 3.5 I'm using ovirt-engine-sdk-java-3.5.1.0-1.fc20.noarch. there is code example: my app: ===================== package lab01; import java.io.IOException; import java.util.List; import java.util.UUID; import org.apache.http.client.ClientProtocolException; import org.ovirt.engine.sdk.*; import org.ovirt.engine.sdk.decorators.*; import org.ovirt.engine.sdk.entities.*; import org.ovirt.engine.sdk.exceptions.*; public class Hello { private static final String URL = "https://10.64.0.204/api"; private static final String crt = "/home/david/Desktop/dev/server.truststore"; private static final String user = "admin@internal"; private static final String pass = "11111111"; public static void main(String[] args) throws ClientProtocolException, ServerException, UnsecuredConnectionAttemptError, IOException { Api api = new Api(URL, user, pass, crt); } } ====================== Description of problem: While trying to start my app localy on my pc, I am getting an exception: Exception in thread "main" java.lang.IllegalArgumentException: Port is invalid at org.apache.http.util.Args.check(Args.java:36) at org.apache.http.conn.scheme.Scheme.<init>(Scheme.java:92) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createSchemeRegistry(ConnectionsPoolBuilder.java:358) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createPoolingClientConnectionManager(ConnectionsPoolBuilder.java:289) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.createDefaultHttpClient(ConnectionsPoolBuilder.java:261) at org.ovirt.engine.sdk.web.ConnectionsPoolBuilder.build(ConnectionsPoolBuilder.java:413) at org.ovirt.engine.sdk.Api.<init>(Api.java:131) at lab01.Hello.main(Hello.java:24) But I can connect to the server in https using curl or webrowser. How to fix it ?

2 2

how to disable drap file into virt-viewer in ovirt?
by CheungPaul 25 Apr '16

25 Apr '16

--_9094e293-8f98-4fe0-8224-aaaa615187ff_ Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 RGVhcnM6DQpXZSBwZXJmZXIgdXNlciBjYW4gbm90IHRyYW5zZmVyIGZpbGUgaW50byBWTSwgYnV0 IHdlIGZvdW5kIHRoYXQgdXNlciBjYW4gZHJhcCBmaWxlIGludG8gdGhlIFZNJ3MgZGVzdG9wLiAN CmhvdyB0byBkaXNhYmxlIGl0Pw0KDQoKDQoNClNpbmNlcmVseSB5b3VycywNClBhdWxDaGV1bmcN Cg0KDQogdGVsOiAxODAtODg4Mi03MTczDQogCQkgCSAgIAkJICA= --_9094e293-8f98-4fe0-8224-aaaa615187ff_ Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxzdHlsZT48IS0tDQouaG1tZXNzYWdlIFANCnsNCm1hcmdpbjowcHg7 DQpwYWRkaW5nOjBweA0KfQ0KYm9keS5obW1lc3NhZ2UNCnsNCmZvbnQtc2l6ZTogMTJwdDsNCmZv bnQtZmFtaWx5Os6iyO3RxbraDQp9DQotLT48L3N0eWxlPjwvaGVhZD4NCjxib2R5IGNsYXNzPSdo bW1lc3NhZ2UnPjxkaXYgZGlyPSdsdHInPkRlYXJzOjxkaXY+PGJyPjwvZGl2PjxkaXY+V2UgcGVy ZmVyIHVzZXIgY2FuIG5vdCB0cmFuc2ZlciBmaWxlIGludG8gVk0sIGJ1dCB3ZSBmb3VuZCB0aGF0 IHVzZXIgY2FuIGRyYXAgZmlsZSBpbnRvIHRoZSBWTSdzIGRlc3RvcC4mbmJzcDs8L2Rpdj48ZGl2 Pjxicj48L2Rpdj48ZGl2PmhvdyB0byBkaXNhYmxlIGl0Pzxicj48YnI+PGRpdj4KPGJyPjxicj5T aW5jZXJlbHkgeW91cnMsPGJyPlBhdWxDaGV1bmc8YnI+PGJyPjxicj4mbmJzcDt0ZWw6IDE4MC04 ODgyLTcxNzM8YnI+PC9kaXY+PC9kaXY+IAkJIAkgICAJCSAgPC9kaXY+PC9ib2R5Pg0KPC9odG1s Pg== --_9094e293-8f98-4fe0-8224-aaaa615187ff_--

1 0

All field on guest info tab are unknown
by Kevin C 25 Apr '16

25 Apr '16

--=-KnL3+aRj45s3Tmd5Gv2X Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi list, On a windows VM, all field in "Guest info" tab are "unknown". ovirt agent s= tart successfully, I can see IP adress or applications. All drivers are OK. Must I reinstall my agents ? Thanks=C2=A0 Kevin C --=-KnL3+aRj45s3Tmd5Gv2X Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Disposition: attachment; filename="smime.p7s" Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCCEeww ggXiMIIDyqADAgECAhBrp4p9CteI1lEK+Vnk57ThMA0GCSqGSIb3DQEBCwUAMH0xCzAJBgNVBAYT AklMMRYwFAYDVQQKEw1TdGFydENvbSBMdGQuMSswKQYDVQQLEyJTZWN1cmUgRGlnaXRhbCBDZXJ0 aWZpY2F0ZSBTaWduaW5nMSkwJwYDVQQDEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eTAeFw0xNTEyMTYwMTAwMDVaFw0zMDEyMTYwMTAwMDVaMHUxCzAJBgNVBAYTAklMMRYwFAYDVQQK Ew1TdGFydENvbSBMdGQuMSkwJwYDVQQLEyBTdGFydENvbSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0 eTEjMCEGA1UEAxMaU3RhcnRDb20gQ2xhc3MgMSBDbGllbnQgQ0EwggEiMA0GCSqGSIb3DQEBAQUA A4IBDwAwggEKAoIBAQC9fdr3w6J9g/Zbgv3bW1+uHht1wLUZr5gkrLtXedg17AkefMyUGwrQdvwO bhajcVmnKVxhrUwkZPXRAwZZosRHfEIi5FH7x6SV/8Sp5lZEuiMnvMFG2MzLA84J6Ws5T4NfXZ0q n4TPgnr3X2vPVS51M7Ua9nIJgn8jvTra4eyyQzxvuA/GZwKg7VQfDCmCS+kICslYYWgXOMt2xlsS slxLce0CGWRsT8EpMyt1iDflSjXZIsE7m1uTyHaKZspMLyIyz6mySu8j8BWWHpChNNeTrFuhVfrO AyDPFJVUvKZCLKBhibTLloyy+LatoWELrjdI4a8StZY8+dIR9t4APXGzAgMBAAGjggFkMIIBYDAO BgNVHQ8BAf8EBAMCAQYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMBIGA1UdEwEB/wQI MAYBAf8CAQAwMgYDVR0fBCswKTAnoCWgI4YhaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2ZzY2Eu Y3JsMGYGCCsGAQUFBwEBBFowWDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wuY29t MDAGCCsGAQUFBzAChiRodHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9jYS5jcnQwHQYDVR0O BBYEFCSBbDlhvkkPj7cbRivJKLUnSG1oMB8GA1UdIwQYMBaAFE4L7xqkQFulF2mHMMo0aEPQQa7y MD8GA1UdIAQ4MDYwNAYEVR0gADAsMCoGCCsGAQUFBwIBFh5odHRwOi8vd3d3LnN0YXJ0c3NsLmNv bS9wb2xpY3kwDQYJKoZIhvcNAQELBQADggIBAIvj94fsAYuErQ8BAluc4SMnIwS9NPBwAm5SH9uh 2NCXTq7im61g7F1LIiNI/+wq37fUuaMbz4g7VarKQTgf8ubs0p7NZWcIe7Bvem2AWaXBsxsaRTYw 5kG3DN8pd1hSEUuFoTa7DmNeFe8tiK1BrL3rbA/m48jp4AiFXgvxprJrW7izsyetOrRHPbkW4Y07 v29MdhaPv3u1JELyszXqOzjIYo4sWlC8iDQXwgSW/ntvWy2n4LuiaozlCfXl149tKeqvwlvrla2Y klue/quWp9j9ou4T/OY0CXMuY+B8wNK0ohd2D4ShgFlMSjzAFRoHGKF81snTr2d1A7Ew02oF6UQy CkC2aNNsK5cWOojBar5c7HplX9aHYUCZouxIeU28SONJAxnATgR4cJ2jrpmYSz/kliUJ46S6UpVD o/ebn9c6PaM/XtDYCCaM/7XX6wc3s++sbQ7CtCn1Ax7df6ufQbwyO0V+oFa9H0KAsjHMzcwk3EV2 B2NLatidKE/m7G+rB9m+FlVgIiSp0mGlg43QO9Kh1+JqvTCIzv2bJJkmPMLQJNuKKwHNL8F4GGp6 jbAV+WL+LDeGfVcq8DHS3LrD+xyYEXQBiqZEdiPVOMxLDSUCXsDO0uCWpaNQ8j6y6S9p0xE/Ga0p eVLadVHhqf9nXqKaxnr358VgfrxzUIrvOaOjMIIF/zCCBOegAwIBAgIQTLnfP04vlkvqxMUZU04a zjANBgkqhkiG9w0BAQsFADB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBMB4XDTE2MDIwMzA5NDQ1N1oXDTE3MDIwMzA5NDQ1N1owSDEf MB0GA1UEAwwWa2V2aW5AZmFtaWxsZWNvdXNpbi5mcjElMCMGCSqGSIb3DQEJARYWa2V2aW5AZmFt aWxsZWNvdXNpbi5mcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM7aVEpOkTQPuDSV lEcQ9J3Pjb+XrzJeE5nFDTD3uLfVZ5bXEsHlGJtgzS0AIT5dCgtyAO44QL8HQY/qOnyNU3/DSQIq 0c2BV/AJt9qrGdInhD32LfsyaIGyEUS1KYY++SfndVwWGxy2ZAtaqlwGSuR19mTwv4BCD0IqSLbo ANo8xR+Hy6A10BzHRBklNhMPerWxySzSNC4YMQXDwQWe9cWqm1TcvOZmnYh/O0HCjirbNcA5gpgq cimNC6YTHEsfvLzpnbi53QdJC4gobRaQKw5MuMDDMOgOZVNGaKe8MVrVelyDFbXo4VNk5CbTcXP2 YK3Lbeuu/krCbYIN6CxioW9obxIMVzCbjA4z+6CqFJNc1Qv389vMF/WkeghZQOJL5JE/zB0NFgrq hriPmX1IEA/kW/MSBWujjFwxkS3p7V/Kg98mioCBerDEuU4k77y5NuOif42e1ssKWweRoi54kfzp m/DHigfzBoqowo2pudiEuMc91ta3CtgOBqEZSiQBYqS8biHChCXZv3me6Gf8WPaqyN0OwnCD+lOx dGKd56yHHKZyfT0b/RSfJ89uWls7+Ou47sXAa7IjKRLyirqEKjmC4Efl+pAsxbMoV4ZgWIAr8/VM x1pzwoUFbdla2jYttvOEWog/c1Ss+1/WJM+Lre9ItC+LN8iKKrT7fZfKy0f9AgMBAAGjggG2MIIB sjALBgNVHQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAw HQYDVR0OBBYEFFZg5P1hZz/039cwy9+ThVfL+w6kMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJ KLUnSG1oMG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wu Y29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50 MS5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVu dDEuY3JsMCEGA1UdEQQaMBiBFmtldmluQGZhbWlsbGVjb3VzaW4uZnIwIwYDVR0SBBwwGoYYaHR0 cDovL3d3dy5zdGFydHNzbC5jb20vMEYGA1UdIAQ/MD0wOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEF BQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUAA4IBAQC0 QbMzgSfJicGx8BJneSYlo7ZxeMKKSWb8wXBj3rwCKrR1uiVx8fVIt5x/Hl1F3dZ6aVoF+dzTvUIA qTovD5ACumfqhu6qb1TiHRaCQr9tKBN6Cb5Du11muun5k5T17tFWD8qPi7u4iZCOGrynd3uWv9Dl T9a0LY6yL+GeIiIVwq8DyDHE7sqCiN+S9iL4Zkho7pS4l7mIW71JNqKZZgOANpzbCFw4lJc2NMhR GlcVdwdJeHpZyW5vpHxmNjWQ+ptaBfKaWOFO5r5na5wF2QOsbICq6e8IKNsliY9hlZnRzu32AzLj GXnmUfy+JF1+gOpSsxpzMGi+axBmxxV0gWCNMIIF/zCCBOegAwIBAgIQTLnfP04vlkvqxMUZU04a zjANBgkqhkiG9w0BAQsFADB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjEp MCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNVBAMTGlN0YXJ0 Q29tIENsYXNzIDEgQ2xpZW50IENBMB4XDTE2MDIwMzA5NDQ1N1oXDTE3MDIwMzA5NDQ1N1owSDEf MB0GA1UEAwwWa2V2aW5AZmFtaWxsZWNvdXNpbi5mcjElMCMGCSqGSIb3DQEJARYWa2V2aW5AZmFt aWxsZWNvdXNpbi5mcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM7aVEpOkTQPuDSV lEcQ9J3Pjb+XrzJeE5nFDTD3uLfVZ5bXEsHlGJtgzS0AIT5dCgtyAO44QL8HQY/qOnyNU3/DSQIq 0c2BV/AJt9qrGdInhD32LfsyaIGyEUS1KYY++SfndVwWGxy2ZAtaqlwGSuR19mTwv4BCD0IqSLbo ANo8xR+Hy6A10BzHRBklNhMPerWxySzSNC4YMQXDwQWe9cWqm1TcvOZmnYh/O0HCjirbNcA5gpgq cimNC6YTHEsfvLzpnbi53QdJC4gobRaQKw5MuMDDMOgOZVNGaKe8MVrVelyDFbXo4VNk5CbTcXP2 YK3Lbeuu/krCbYIN6CxioW9obxIMVzCbjA4z+6CqFJNc1Qv389vMF/WkeghZQOJL5JE/zB0NFgrq hriPmX1IEA/kW/MSBWujjFwxkS3p7V/Kg98mioCBerDEuU4k77y5NuOif42e1ssKWweRoi54kfzp m/DHigfzBoqowo2pudiEuMc91ta3CtgOBqEZSiQBYqS8biHChCXZv3me6Gf8WPaqyN0OwnCD+lOx dGKd56yHHKZyfT0b/RSfJ89uWls7+Ou47sXAa7IjKRLyirqEKjmC4Efl+pAsxbMoV4ZgWIAr8/VM x1pzwoUFbdla2jYttvOEWog/c1Ss+1/WJM+Lre9ItC+LN8iKKrT7fZfKy0f9AgMBAAGjggG2MIIB sjALBgNVHQ8EBAMCBLAwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMAkGA1UdEwQCMAAw HQYDVR0OBBYEFFZg5P1hZz/039cwy9+ThVfL+w6kMB8GA1UdIwQYMBaAFCSBbDlhvkkPj7cbRivJ KLUnSG1oMG8GCCsGAQUFBwEBBGMwYTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3Auc3RhcnRzc2wu Y29tMDkGCCsGAQUFBzAChi1odHRwOi8vYWlhLnN0YXJ0c3NsLmNvbS9jZXJ0cy9zY2EuY2xpZW50 MS5jcnQwOAYDVR0fBDEwLzAtoCugKYYnaHR0cDovL2NybC5zdGFydHNzbC5jb20vc2NhLWNsaWVu dDEuY3JsMCEGA1UdEQQaMBiBFmtldmluQGZhbWlsbGVjb3VzaW4uZnIwIwYDVR0SBBwwGoYYaHR0 cDovL3d3dy5zdGFydHNzbC5jb20vMEYGA1UdIAQ/MD0wOwYLKwYBBAGBtTcBAgQwLDAqBggrBgEF BQcCARYeaHR0cDovL3d3dy5zdGFydHNzbC5jb20vcG9saWN5MA0GCSqGSIb3DQEBCwUAA4IBAQC0 QbMzgSfJicGx8BJneSYlo7ZxeMKKSWb8wXBj3rwCKrR1uiVx8fVIt5x/Hl1F3dZ6aVoF+dzTvUIA qTovD5ACumfqhu6qb1TiHRaCQr9tKBN6Cb5Du11muun5k5T17tFWD8qPi7u4iZCOGrynd3uWv9Dl T9a0LY6yL+GeIiIVwq8DyDHE7sqCiN+S9iL4Zkho7pS4l7mIW71JNqKZZgOANpzbCFw4lJc2NMhR GlcVdwdJeHpZyW5vpHxmNjWQ+ptaBfKaWOFO5r5na5wF2QOsbICq6e8IKNsliY9hlZnRzu32AzLj GXnmUfy+JF1+gOpSsxpzMGi+axBmxxV0gWCNMYIEXjCCBFoCAQEwgYkwdTELMAkGA1UEBhMCSUwx FjAUBgNVBAoTDVN0YXJ0Q29tIEx0ZC4xKTAnBgNVBAsTIFN0YXJ0Q29tIENlcnRpZmljYXRpb24g QXV0aG9yaXR5MSMwIQYDVQQDExpTdGFydENvbSBDbGFzcyAxIENsaWVudCBDQQIQTLnfP04vlkvq xMUZU04azjANBglghkgBZQMEAgEFAKCCAaUwGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkq hkiG9w0BCQUxDxcNMTYwNDI1MTU1NTQ5WjAvBgkqhkiG9w0BCQQxIgQgctGla3YFhCzLLMywKGKD Fd2OCzvaYHVi1JlnR3Y1N+cwgZoGCSsGAQQBgjcQBDGBjDCBiTB1MQswCQYDVQQGEwJJTDEWMBQG A1UEChMNU3RhcnRDb20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRo b3JpdHkxIzAhBgNVBAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhBMud8/Ti+WS+rExRlT ThrOMIGcBgsqhkiG9w0BCRACCzGBjKCBiTB1MQswCQYDVQQGEwJJTDEWMBQGA1UEChMNU3RhcnRD b20gTHRkLjEpMCcGA1UECxMgU3RhcnRDb20gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkxIzAhBgNV BAMTGlN0YXJ0Q29tIENsYXNzIDEgQ2xpZW50IENBAhBMud8/Ti+WS+rExRlTThrOMA0GCSqGSIb3 DQEBAQUABIICABDYLDdHyhHJzcx/TqiUYqsydgbwrKZfdbnNS320vYeUFymrf1TF8Lxw+c55uk7d Yvdr+I3qt8HTktjMLDsXL/0YeMXNSUeBd871U7XbozJeX+hWROf6zxeVUvAqRb9Ki+C+zsCFYvNw prlbmzR6CiyAWxWXluav5Cy4qyuCdPp42r7XKX6SJqAUb88EXC6GkgahiKpSn67YTyW3zum/xBg0 1K+FPzIhr3ADLLdaqFaH8FzyP6wmY6+Cy8P7pi6ivUTVJoiQAMlzVChB/20OZMalaxQeeTGLf8IE RA2v3HBQEe8Lrm/AxcuCLRDh6SF/g+N5cgl1a2HFRyAlodpZV4mVg5dsQS5v3U/sMkaSgJWnlMyk qC5GJwnbitF9CqH31VnN+oXS9k0UTYkbVavaoyucRaH202UONrIv7Fs/mKKyG8xR9zifT8NaijJa n8+jizDtIgwR7FahSPMnIPrvrXga7vQll5G9Phlou07062CJJirYeKXozDE9yECp+XN6vVPvdo/D qiRpaMm0PUkWD+8c6Kt8tuDUDopN+DtJCo6UMJTboJDSKwcDEqwzJOveTWSP8WuoJynrwjUyh7VR kLL0TQw7uHTwnobL96NtLWQ/W/B6TCXNJElGBdav1Rr1OrWJjeDr7LcpOy33Aa1GjZI6H30z12FB 72Wz+2N+qWf/AAAAAAAA --=-KnL3+aRj45s3Tmd5Gv2X--

1 0

oVirt 3.5 and SSLv3
by Robert Story 25 Apr '16

25 Apr '16

--Sig_/5hzIpMGnpyZJ8h0tE1_0JkE Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Yesterday I had to re-install a host node in my 3.5.6 cluster. After a fres= h install of CentOS 7.2, attempts to re-install failed, as did removing and= re-adding the node. Here is a log excerpt from the engine: 2016-04-19 18:22:01,100 INFO [org.ovirt.vdsm.jsonrpc.client.reactors.React= orClient] (SSL Stomp Reactor) Connecting to eclipse.localdomain/10.71.10.249 2016-04-19 18:22:01,116 WARN [org.ovirt.vdsm.jsonrpc.client.utils.retry.Re= tryable] (SSL Stomp Reactor) Retry failed 2016-04-19 18:22:01,129 ERROR [org.ovirt.vdsm.jsonrpc.client.reactors.React= orClient] (DefaultQuartzScheduler_Worker-38) Exception during connection 2016-04-19 18:22:01,208 ERROR [org.ovirt.engine.core.vdsbroker.vdsbroker.Ge= tCapabilitiesVDSCommand] (DefaultQuartzScheduler_Worker-38) Command GetCapa= bilitiesVDSCommand(HostName =3D eclipse, HostId =3D 37a4a1c2-4906-489e-947c= -1ef9fb828bc5, vds=3DHost[eclipse,37a4a1c2-4906-489e-947c-1ef9fb828bc5]) ex= ecution failed. Exception: VDSNetworkException: java.net.NoRouteToHostExcep= tion: No route to host 2016-04-19 18:22:01,209 WARN [org.ovirt.engine.core.vdsbroker.VdsManager] = (DefaultQuartzScheduler_Worker-38) Host eclipse is not responding. It will = stay in Connecting state for a grace period of 120 seconds and after that a= n attempt to fence the host will be issued. 2016-04-19 18:22:01,938 ERROR [org.ovirt.engine.core.vdsbroker.VdsUpdateRun= TimeInfo] (DefaultQuartzScheduler_Worker-38) Failure to refresh Vds runtime= info: org.ovirt.engine.core.vdsbroker.vdsbroker.VDSNetworkException: java.= net.NoRouteToHostException: No route to host at org.ovirt.engine.core.vdsbroker.vdsbroker.VdsBrokerCommand.creat= eNetworkException(VdsBrokerCommand.java:126) [vdsbroker.jar:] Luckily seeing SSL+java in the log tickled my memory about java disabling S= SLv3, and google helped me find this workaround: - edit /usr/lib/jvm/java/jre/lib/security/java.security - look for jdk.tls.disabledAlgorithms - remove SSLv3 from the list - service ovirt-engine restart Google also tells me that this should be an issue for 3.5, and there is a vdsm setting, VdsmSSLProtocol, that can be set to use TLS, but I can't find how to change/set it. Anyone know the secret? Robert --=20 Senior Software Engineer @ Parsons --Sig_/5hzIpMGnpyZJ8h0tE1_0JkE Content-Type: application/pgp-signature Content-Description: OpenPGP digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iEYEARECAAYFAlcXeHIACgkQ7/fVLLY1mnimKgCeL1PD9TRtKtdxC07VPjs3A3eh a4sAnieFpARV2TUY6Ot0PbZoFI5PNgBm =NjWI -----END PGP SIGNATURE----- --Sig_/5hzIpMGnpyZJ8h0tE1_0JkE--

3 4

advanced users authentication, using kerberos, CAS SSO and Active Directory
by Fabrice Bacchella 25 Apr '16

25 Apr '16

--Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I have a production were hard coded password are avoided. We prefer to = use kerberos. We also provided a SSO for Web UI using CAS = <http://jasig.github.io/cas/4.2.x/index.html>. We use ActiveDirectory = for user backend. So I wanted a oVirt installation that will use kerberos for API = authentication. For the web ui, kerberos is not always the best = solution, so I wanted to integrated it in our CAS. The Apache part was easy to setup. I will show only subpart of the whole Apache setup and only = authentication related part # The CAS modules LoadModule authz_user_module = /usr/lib64/httpd/modules/mod_authz_user.so # Needed because auth_cas_module forget to link openssl LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so LoadModule auth_cas_module = /usr/lib64/httpd/modules/mod_auth_cas.so # For the kerberos authentication on the API LoadModule auth_gssapi_module = /usr/lib64/httpd/modules/mod_auth_gssapi.so LoadModule session_module /usr/lib64/httpd/modules/mod_session.so LoadModule session_cookie_module = /usr/lib64/httpd/modules/mod_session_cookie.so CASLoginURL https://sso/cas/login CASValidateSAML On CASValidateURL https://sso/cas/samlValidate <VirtualHost *:443> RequestHeader unset X-Remote-User early <LocationMatch ^/api($|/)> RewriteEngine on RewriteCond %{LA-U:REMOTE_USER} ^(.*@DOMAIN)$ RewriteRule ^(.*)$ - [L,P,E=3DREMOTE_USER:%1] RequestHeader set X-Remote-User %{REMOTE_USER}s AuthType GSSAPI AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:.../httpd.keytab Require valid-user GssapiUseSessions On Session On SessionCookieName ovirt_gssapi_session = path=3D/private;httponly;secure; </LocationMatch> <LocationMatch = ^/(ovirt-engine($|/)|RHEVManagerWeb/|OvirtEngineWeb/|ca.crt$|engine.ssh.ke= y.txt$|rhevm.ssh.key.txt$)> AuthType CAS Require valid-user CASAuthNHeader X-Remote-User </LocationMatch> </VirtualHost> The authn file /etc/ovirt-engine/extensions.d/apachesso-authn.properties = is : ovirt.engine.extension.name =3D apachesso-authn ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.misc.http.AuthnExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name =3D apachesso ovirt.engine.aaa.authn.authz.plugin =3D DOMAIN-authz config.artifact.name =3D HEADER config.artifact.arg =3D X-Remote-User And the authz file = /etc/ovirt-engine/extensions.d/DOMAIN-authz.properties is: ovirt.engine.extension.name =3D DOMAIN-authz ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 =3D ../aaa/DOMAIN.properties I had some difficulties with AD backend. A straightforward solution = would have been : include =3D <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D domain.com pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 # Only TLSv1.2 is secure nowadays pool.default.ssl.startTLSProtocol =3D TLSv1.2 # long time out should be avoided pool.default.connection-options.connectTimeoutMillis =3D 500 But if fails. We have a special setup with about 100 domain controlers = and only two of them can be reached from the ovirt engine. So my first = try was so defined them directly in the configuration file: pool.default.serverset.type =3D failover pool.default.serverset.failover.1.server =3D dcX.domain.com pool.default.serverset.failover.2.server =3D dcY.domain.com But that fails. Server-engine was still using a lot of unreachable = domain controler. After some digging I found that other part of the ldap = extension use a different serverset, I don=E2=80=99t know why it don=E2=80= =99t reuse the default pool. It=E2=80=99s called pool.default.dc-resolve = (it should be called pool.dc-resolve, as it=E2=80=99s not the default = but a custom one), so I added in my configuration: pool.default.dc-resolve.default.serverset.type =3D failover pool.default.dc-resolve.serverset.failover.1.server =3D dcX.domain.com pool.default.dc-resolve.serverset.failover.2.server =3D dcY.domain.com But there is a better solution. Ondra Machacek point it to me. In Active = Directory, there is something called a =E2=80=9Csite=E2=80=9D, with a = subset of all the domain controler in it. It can be found under = CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN,... To list them: ldapsearch -H ldap://somedc -b CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN = -s one -o ldif-wrap=3Dno cn The information to write down is the cn returned You get a list of all domain, just pick the right one, remove all the = serverset configuration and add : pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} The entry _sites.${domain} don=E2=80=99t exist in the DNS, so to check = that your regex is good, try instead: dig +short _ldap._tcp.GOOD_SITE._sites.${domain} srv It should return only reachable domain controlers. So the final /etc/ovirt-engine/aaa/DOMAIN.properties was : include =3D <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D domain.com pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 pool.default.ssl.startTLSProtocol =3D TLSv1.2 pool.default.connection-options.connectTimeoutMillis =3D 500 pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} With this setup, my python client = <https://github.com/fbacchella/ovirtcmd> can connect to ovirt-engine = using kerberos ticket, web users are authenticated using CAS. And there = is no need to duplicate user base. --Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html = charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" = class=3D"">I have a production were hard coded password are avoided. We = prefer to use kerberos. We also provided a SSO for Web UI using <a = href=3D"http://jasig.github.io/cas/4.2.x/index.html" style=3D"color: = rgb(104, 0, 148); text-decoration: none; margin-top: auto;" = class=3D"">CAS</a>. We use ActiveDirectory for user backend.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">So I wanted a oVirt installation that will use kerberos for = API authentication. For the web ui, kerberos is not always the best = solution, so I wanted to integrated it in our CAS.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">The Apache part was easy to setup.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">I will show only subpart of the whole Apache setup and only = authentication related part<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D""># The CAS modules LoadModule authz_user_module = /usr/lib64/httpd/modules/mod_authz_user.so # Needed because auth_cas_module forget to link openssl LoadModule ssl_module /usr/lib64/httpd/modules/mod_ssl.so LoadModule auth_cas_module = /usr/lib64/httpd/modules/mod_auth_cas.so # For the kerberos authentication on the API LoadModule auth_gssapi_module = /usr/lib64/httpd/modules/mod_auth_gssapi.so LoadModule session_module /usr/lib64/httpd/modules/mod_session.so LoadModule session_cookie_module = /usr/lib64/httpd/modules/mod_session_cookie.so CASLoginURL <a href=3D"https://sso/cas/login" = class=3D"">https://sso/cas/login</a> CASValidateSAML On CASValidateURL <a href=3D"https://sso/cas/samlValidate" = class=3D"">https://sso/cas/samlValidate</a> <VirtualHost *:443> RequestHeader unset X-Remote-User early <LocationMatch ^/api($|/)> RewriteEngine on RewriteCond %{LA-U:REMOTE_USER} ^(.*@DOMAIN)$ RewriteRule ^(.*)$ - [L,P,E=3DREMOTE_USER:%1] RequestHeader set X-Remote-User %{REMOTE_USER}s AuthType GSSAPI AuthName "GSSAPI Single Sign On Login" GssapiCredStore keytab:.../httpd.keytab Require valid-user GssapiUseSessions On Session On SessionCookieName ovirt_gssapi_session = path=3D/private;httponly;secure; </LocationMatch> <LocationMatch = ^/(ovirt-engine($|/)|RHEVManagerWeb/|OvirtEngineWeb/|ca.crt$|engine.ssh.ke= y.txt$|rhevm.ssh.key.txt$)> AuthType CAS Require valid-user CASAuthNHeader X-Remote-User </LocationMatch> </VirtualHost> </code></pre>The authn file <code style=3D"font-size: 12px; = font-family: Menlo, Monaco, 'Courier New', monospace; word-wrap: = break-word; white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">/etc/ovirt-engine/extensions.d/apachesso-authn.properties</code= > is :<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">ovirt.engine.extension.name =3D apachesso-authn ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.misc ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.misc.http.AuthnExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name =3D apachesso ovirt.engine.aaa.authn.authz.plugin =3D DOMAIN-authz config.artifact.name =3D HEADER config.artifact.arg =3D X-Remote-User </code></pre>And the authz file <code style=3D"font-size: 12px; = font-family: Menlo, Monaco, 'Courier New', monospace; word-wrap: = break-word; white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">/etc/ovirt-engine/extensions.d/DOMAIN-authz.properties</code>&n= bsp;is:<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">ovirt.engine.extension.name =3D DOMAIN-authz ovirt.engine.extension.bindings.method =3D jbossmodule ovirt.engine.extension.binding.jbossmodule.module =3D = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class =3D = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides =3D = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 =3D ../aaa/DOMAIN.properties </code></pre>I had some difficulties with AD backend. A straightforward = solution would have been :<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">include =3D = <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D <a href=3D"http://domain.com" class=3D"">domain.com</a> pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 # Only TLSv1.2 is secure nowadays pool.default.ssl.startTLSProtocol =3D TLSv1.2 # long time out should be avoided pool.default.connection-options.connectTimeoutMillis =3D 500 </code></pre>But if fails. We have a special setup with about 100 domain = controlers and only two of them can be reached from the ovirt engine. So = my first try was so defined them directly in the configuration = file:<pre style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre-wrap; padding: 0.6em = 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.serverset.type =3D failover pool.default.serverset.failover.1.server =3D <a = href=3D"http://dcX.domain.com" class=3D"">dcX.domain.com</a> pool.default.serverset.failover.2.server =3D <a = href=3D"http://dcY.domain.com" class=3D"">dcY.domain.com</a> </code></pre>But that fails. Server-engine was still using a lot of = unreachable domain controler. After some digging I found that other part = of the ldap extension use a different serverset, I don=E2=80=99t know = why it don=E2=80=99t reuse the default pool. It=E2=80=99s = called <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">pool.default.dc-resolve</code> (it should be = called <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px;" = class=3D"">pool.dc-resolve</code>, as it=E2=80=99s not the default but a = custom one), so I added in my configuration:<pre style=3D"font-family:= Menlo, Monaco, 'Courier New', monospace; word-wrap: normal; = white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.dc-resolve.default.serverset.type =3D failover pool.default.dc-resolve.serverset.failover.1.server =3D <a = href=3D"http://dcX.domain.com" class=3D"">dcX.domain.com</a> pool.default.dc-resolve.serverset.failover.2.server =3D <a = href=3D"http://dcY.domain.com" class=3D"">dcY.domain.com</a> </code></pre>But there is a better solution. Ondra Machacek point it to = me. In Active Directory, there is something called a =E2=80=9Csite=E2=80=9D= , with a subset of all the domain controler in it. It can be found = under <code style=3D"font-size: 12px; font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: break-word; white-space: pre-wrap; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; display: inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN,...</code><p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">To list them:<pre style=3D"font-family: Menlo, Monaco, = 'Courier New', monospace; word-wrap: normal; white-space: pre-wrap; = padding: 0.6em 0.8em; -webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; box-sizing: = border-box; overflow: auto; position: relative;" class=3D""><code = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">ldapsearch -H <a = href=3D"ldap://somedc" class=3D"">ldap://somedc</a> -b = CN=3DSites,CN=3DConfiguration,DC=3DDOMAIN -s one -o ldif-wrap=3Dno cn </code></pre>The information to write down is the cn returned<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">You get a list of all domain, just pick the right one, remove = all the serverset configuration and add :<pre style=3D"font-family: = Menlo, Monaco, 'Courier New', monospace; word-wrap: normal; white-space: = pre-wrap; padding: 0.6em 0.8em; -webkit-margin-before-collapse: = collapse; -webkit-margin-after-collapse: collapse; = border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" = class=3D"">pool.default.serverset.srvrecord.domain-conversion.type =3D = regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} </code></pre>The entry <code style=3D"font-size: 12px; font-family: = Menlo, Monaco, 'Courier New', monospace; word-wrap: break-word; = white-space: pre-wrap; border-top-left-radius: 3px; = border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: white; = -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; = box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px 0px; display: = inline-block; padding: 1px 4px; margin-top: auto;" = class=3D"">_sites.${domain}</code> don=E2=80=99t exist in the DNS, = so to check that your regex is good, try instead:<pre = style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">dig +short = _ldap._tcp.GOOD_SITE._sites.${domain} srv </code></pre>It should return only reachable domain controlers.<p = style=3D"-webkit-margin-before-collapse: collapse; = -webkit-margin-after-collapse: collapse; margin-top: 15px; = margin-bottom: 15px; font-family: caption, sans-serif; font-size: 13px;" = class=3D"">So the final /etc/ovirt-engine/aaa/DOMAIN.properties was = :<pre style=3D"font-family: Menlo, Monaco, 'Courier New', monospace; = word-wrap: normal; white-space: pre-wrap; padding: 0.6em 0.8em; = -webkit-margin-before-collapse: collapse; -webkit-margin-after-collapse: = collapse; border-top-left-radius: 3px; border-top-right-radius: 3px; = border-bottom-right-radius: 3px; border-bottom-left-radius: 3px; = background-color: white; -webkit-box-shadow: rgba(0, 0, 0, 0.0980392) = 0px 0.5px 1px 0px; box-shadow: rgba(0, 0, 0, 0.0980392) 0px 0.5px 1px = 0px; box-sizing: border-box; overflow: auto; position: relative;" = class=3D""><code style=3D"font-family: Menlo, Monaco, 'Courier New', = monospace; word-wrap: normal; white-space: pre; border-top-left-radius: = 3px; border-top-right-radius: 3px; border-bottom-right-radius: 3px; = border-bottom-left-radius: 3px; background-color: transparent; = -webkit-box-shadow: none; box-shadow: none; display: inline; padding: = 0px; border: none; margin-top: auto;" class=3D"">include =3D = <ad.properties> vars.domain =3D DOMAIN vars.user =3D BINDDN vars.password =3D BINDPWD vars.forest =3D <a href=3D"http://domain.com" class=3D"">domain.com</a> pool.default.auth.simple.bindDN =3D ${global:vars.user} pool.default.auth.simple.password =3D ${global:vars.password} pool.default.serverset.type =3D srvrecord pool.default.serverset.srvrecord.domain =3D ${global:vars.domain} pool.default.ssl.startTLS =3D true pool.default.ssl.truststore.file =3D .../domain.jks pool.default.ssl.truststore.password =3D=20 pool.default.ssl.startTLSProtocol =3D TLSv1.2 pool.default.connection-options.connectTimeoutMillis =3D 500 pool.default.serverset.srvrecord.domain-conversion.type =3D regex pool.default.serverset.srvrecord.domain-conversion.regex.pattern =3D = ^(?<domain>.*)$ pool.default.serverset.srvrecord.domain-conversion.regex.replacement =3D = GOOD_SITE._sites.${domain} </code></pre>With this setup, my <a = href=3D"https://github.com/fbacchella/ovirtcmd" style=3D"color: rgb(104, = 0, 148); text-decoration: none; margin-top: auto;" class=3D"">python = client</a> can connect to ovirt-engine using kerberos ticket, web = users are authenticated using CAS. And there is no need to duplicate = user base.<div class=3D""> </div></body></html>= --Apple-Mail=_835E50DB-6781-44B0-B308-2F94E2910205--

1 0