- Users - oVirt List Archives

Re: [ovirt-users] oVirt 3.5.1 user permissions
by Oved Ourfali 29 Jan '15

29 Jan '15

1 0

Re: [ovirt-users] oVirt 3.5.1 user permissions
by Oved Ourfali 29 Jan '15

29 Jan '15

2 1

AAA
by Koen Vanoppen 29 Jan '15

29 Jan '15

Can somebody help me setting up AAA for ovirt 3.5.1? I'm getting this now: 2015-01-29 11:35:36,889 WARN [org.ovirt.engineextensions.aaa.ldap.AuthzExtension] (MSC service thread 1-1) [ovirt-engine-extension-aaa-ldap.authz::BRU_AIR-authz] Cannot initialize LDAP framework, deferring initialization. Error: An error occurred while attempting to query DNS in order to retrieve SRV records with name '_gc._tcp.brussels.airport': javax.naming.NameNotFoundException: DNS name not found [response code 3]; remaining name '_gc._tcp.brussels.airport' my 3 configs: *BRU_AIR-authn.properties* ovirt.engine.extension.name = BRU_AIR-authn ovirt.engine.extension.bindings.method = jbossmodule ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.ldap.AuthnExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authn ovirt.engine.aaa.authn.profile.name = BRU-AIR ovirt.engine.aaa.authn.authz.plugin = BRU_AIR-authz config.profile.file.1 = /etc/ovirt-engine/aaa/BRU_AIR.properties *BRU_AIR-authz.properties* ovirt.engine.extension.name = BRU_AIR-authz ovirt.engine.extension.bindings.method = jbossmodule ovirt.engine.extension.binding.jbossmodule.module = org.ovirt.engine-extensions.aaa.ldap ovirt.engine.extension.binding.jbossmodule.class = org.ovirt.engineextensions.aaa.ldap.AuthzExtension ovirt.engine.extension.provides = org.ovirt.engine.api.extensions.aaa.Authz config.profile.file.1 = /etc/ovirt-engine/aaa/BRU_AIR.properties *BRU_AIR.properties* include = <ad.properties> # # Active directory domain name. # vars.domain = mydomain.com # # Search user and its password. # vars.user = admin@${global:vars.domain} vars.password = *********** # # Optional DNS servers, if enterprise # DNS server cannot resolve the domain srvrecord. # vars.dns = dns://dc01.mydomain.com pool.default.serverset.type = srvrecord pool.default.serverset.srvrecord.domain = ${global:vars.domain} pool.default.auth.simple.bindDN = ${global:vars.user} pool.default.auth.simple.password = ${global:vars.password In the GUI for adding user I get this: An error occurred while attempting to query DNS in order to retrieve SRV records with name '_gc__tcp_brussels_airport': javax_naming_NameNotFoundException: DNS name not found [response code 3]; remaining name '_gc__tcp_brussels_airport' Any ideas? I ran out... Kind regards, Koen

3 18

oVirt 3.5.1 user permissions
by Nikolai Bochev 29 Jan '15

29 Jan '15

Hello, I've been running ovirt hosted engine for around a month already without any major interruptions. Last week i tied it to freeipa, to be able to give permissions to other people, but so far no success because of the following problem : All users can see all VM's. I tried clearing all permission entries ( leaving the admin only ) and the re-adding and it didn't help at all. I am attaching a few screenshots to better describe : Most of the vm's have no permissions attached to them, but they are still visible to everyone that logs from the userpanel What am i doing wrong ? Regards,

4 5

Re: [ovirt-users] oVirt 3.5.1 user permissions
by Donny Davis 29 Jan '15

29 Jan '15

Setting that login permission at the system level is why they can see everything even if they can't control it. Copy the user permission role and remove all the permissions except login to system (the last box under login) create instance, and attach to storage domains. Then add it to the datacenter permission set On Jan 29, 2015 2:02 AM, Ondra Machacek <omachace(a)redhat.com> wrote: > > If you add for example 'UserRole' on VM, then your user should login to > UserPortal without any problem and see his VM. > > On 01/29/2015 09:58 AM, Nikolai Bochev wrote: > > Ok, but if i don't add "System" permissions to a user with "UserRole" > > they cannot login at all ? > > > > On Thu, Jan 29, 2015 at 10:56 AM, Ondra Machacek <omachace(a)redhat.com > > <mailto:omachace@redhat.com>> wrote: > > > > > > > > On 01/29/2015 09:35 AM, Nikolai Bochev wrote: > > > > Hello, > > > > I've been running ovirt hosted engine for around a month already > > without > > any major interruptions. Last week i tied it to freeipa, to be > > able to > > give permissions to other people, but so far no success because > > of the > > following problem : > > > > All users can see all VM's. I tried clearing all permission > > entries ( > > leaving the admin only ) and the re-adding and it didn't help at > > all. > > > > I am attaching a few screenshots to better describe : > > > > > > > > The problem is that you are assigning system permissions. > > If you assign system permissions you have permission to whole system. > > > > If you want to assign a permission to user on a specific vm(or object), > > you have to select the object, then click 'permissions' subtab, then > > click 'add', then find your user and choose the role for him. > > > > > > > > > > > > Most of the vm's have no permissions attached to them, but they are > > still visible to everyone that logs from the userpanel > > What am i doing wrong ? > > > > Regards, > > > > > > _________________________________________________ > > Users mailing list > > Users(a)ovirt.org <mailto:Users@ovirt.org> > > http://lists.ovirt.org/__mailman/listinfo/users > > <http://lists.ovirt.org/mailman/listinfo/users> > > > > > _______________________________________________ > Users mailing list > Users(a)ovirt.org > http://lists.ovirt.org/mailman/listinfo/users

1 0

Re: [ovirt-users] oVirt 3.5.1 user permissions
by Donny Davis 29 Jan '15

29 Jan '15

You are assigning permissions at too high of a level. Set the following permissions for users to be able to only see what they create Add a new set of permissions in the config menu Login to system Create instance Attach to storage domains Then assign that permission at the datacenter level, or even better the cluster level And add permissions as needed I will get you some screen shots when I get home On Jan 29, 2015 7:13 AM, Yaniv Dary <ydary(a)redhat.com> wrote: > > WebAdmin is for admin and has permissions to see anything in the system. > For power users please use the power user portal. > > On 01/29/2015 10:35 AM, Nikolai Bochev wrote: > > Hello, > > > > I've been running ovirt hosted engine for around a month already > > without any major interruptions. Last week i tied it to freeipa, to be > > able to give permissions to other people, but so far no success > > because of the following problem : > > > > All users can see all VM's. I tried clearing all permission entries ( > > leaving the admin only ) and the re-adding and it didn't help at all. > > > > I am attaching a few screenshots to better describe : > > > > > > > > > > > > > > Most of the vm's have no permissions attached to them, but they are > > still visible to everyone that logs from the userpanel > > What am i doing wrong ? > > > > Regards, > > > > > > _______________________________________________ > > Users mailing list > > Users(a)ovirt.org > > http://lists.ovirt.org/mailman/listinfo/users > > -- > Yaniv Dary > Red Hat Israel Ltd. > 34 Jerusalem Road > Building A, 4th floor > Ra'anana, Israel 4350109 > > Tel : +972 (9) 7692306 > 8272306 > Email: ydary(a)redhat.com > IRC : ydary > > _______________________________________________ > Users mailing list > Users(a)ovirt.org > http://lists.ovirt.org/mailman/listinfo/users

1 0

oVirt Node 3.5 status
by Douglas Schilling Landgraf 29 Jan '15

29 Jan '15

Hi, If you are looking for oVirt Node 3.5, we will deliver the official ISO as soon as the package which resolves the below bugzilla is available in CentOS repo. The current version of nss-softokn package is affecting the build of iso. nss-softokn prevents dracut from building the initrd https://bugzilla.redhat.com/show_bug.cgi?id=1182297 -- Cheers Douglas

1 0

Re: [ovirt-users] AAA
by Donny Davis 29 Jan '15

29 Jan '15

Use /etc/hosts and add this to your .properties pool.default.socketfactory.type = java On Jan 29, 2015 5:50 AM, Alon Bar-Lev wrote: > > > > ----- Original Message ----- > > From: "Koen Vanoppen" > > To: "Alon Bar-Lev" > > Cc: users(a)ovirt.org > > Sent: Thursday, January 29, 2015 2:41:52 PM > > Subject: Re: [ovirt-users] AAA > > > > Yes We have: > > > > [root@ovirtmgmt01prod ~]# dig @srvdc03.mydomain.com SRV _gc._ > > tcp.mydomain.com > > > > ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.23.rc1.el6_5.1 <<>> @srvdc03.mydomain.com > > SRV _gc._tcp.mydomain.com > > ; (1 server found) > > ;; global options: +cmd > > ;; Got answer: > > ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 33340 > > ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 > > > > ;; QUESTION SECTION: > > ;_gc._tcp.mydomain.com. IN SRV > > this ^^^^^^^ means that you do not have srv record. are you sure you replace mydomain.com with your actual active directory domain name? > have you tried to look into your dns manager for this information as well? > > > > > ;; AUTHORITY SECTION: > > mydomain.com. 3600 IN SOA srvdc03.mydomain.com. > > hostmaster.airport. 1398582 900 600 86400 3600 > > > > ;; Query time: 12 msec > > ;; SERVER: 10.110.3.123#53(10.110.3.123) > > ;; WHEN: Thu Jan 29 13:40:41 2015 > > ;; MSG SIZE rcvd: 98 > > > > > > > > 2015-01-29 13:33 GMT+01:00 Alon Bar-Lev : > > > > > > > > > > > ----- Original Message ----- > > > > From: "Koen Vanoppen" > > > > To: "Alon Bar-Lev" , users(a)ovirt.org > > > > Sent: Thursday, January 29, 2015 2:19:32 PM > > > > Subject: Re: [ovirt-users] AAA > > > > > > > > Big thanks for your help, but still the same: > > > > > > > > # > > > > # Active directory domain name. > > > > # > > > > vars.domain = mydomain.com > > > > > > > > # > > > > # Search user and its password. > > > > # > > > > vars.user = admin@${global:vars.domain} > > > > vars.password = ***** > > > > > > > > # > > > > # Optional DNS servers, if enterprise > > > > # DNS server cannot resolve the domain srvrecord. > > > > # > > > > vars.dns = dns://srvdc03.${global:vars.domain} > > > > dns://srvdc04.${global:vars.domain} > > > > > > > > pool.default.serverset.type = srvrecord > > > > pool.default.serverset.srvrecord.domain = ${global:vars.domain} > > > > pool.default.auth.simple.bindDN = ${global:vars.user} > > > > pool.default.auth.simple.password = ${global:vars.password} > > > > > > > > # Uncomment if using custom DNS > > > > > > > pool.default.serverset.srvrecord.jndi-properties.java.naming.provider.url = > > > > ${global:vars.dns} > > > > pool.default.socketfactory.resolver.uRL = ${global:vars.dns} > > > > > > > > > > > > > > > > [ovirt-engine-extension-aaa-ldap.authz::BRU_AIR-authz] Cannot initialize > > > > LDAP framework, deferring initialization. Error: No DNS SRV records were > > > > found with record name '_gc._tcp.brussels.airport'. > > > > > > > > And I can't put '_gc._tcp.mydomain.com in the dns... Isn't there another > > > > way it just resolves the dns servers I gave him? > > > > > > > > > > Microsoft Domain controller must have gc service entry within DNS to work > > > properly. > > > 1. Are you sure you have Microsoft DNS installed on srvdc03.mydomain.com ? > > > 2. Can you please execute: > > > $ dig @srvdc03.mydomain.com SRV _gc._tcp.mydomain.com > > > 3. Can you please open the DNS manager within your domain and search for > > > srv records? Maybe you have DNS installed only on few servers, using the > > > DNS manager you can also see which. > > > > > > > > > > > 2015-01-29 13:02 GMT+01:00 Alon Bar-Lev : > > > > > > > > > > > > > > > > > > > ----- Original Message ----- > > > > > > From: "Ondra Machacek" > > > > > > To: "Koen Vanoppen" , users(a)ovirt.org > > > > > > Sent: Thursday, January 29, 2015 1:49:00 PM > > > > > > Subject: Re: [ovirt-users] AAA > > > > > > > > > > > > > > > > > > On 01/29/2015 12:30 PM, Koen Vanoppen wrote: > > > > > > > No, I don't. and I wouldn't know how he got to this name... > > > > > > > > > > > > Well, then you have to, if you want to use > > > 'pool.default.serverset.type > > > > > > = srvrecord'. > > > > > > > > > > > > It just need to know where your global catalog is running, since it's > > > > > > needed for new provider. > > > > > > > > > > > > It searches for global catalog like this: > > > > > > dig @${vars.dns} -t SRV _gc._tcp.${vars.domain} > > > > > > > > > > > > So you need to have this SRV record in DNS, if you want to use > > > srvrecord > > > > > > serverset type. Or you don't have to if you use single server type. > > > > > > > > > > active directory will not work without access to global catalog. > > > > > please set one or more of the domain controllers as dns server, for > > > > > example: > > > > > > > > > > vars.dns = dns://dc1.${global:vars.domain} > > > dns://dc2.${global:vars.domain} > > > > > > > > > > please also uncomment/add these lines to make vars.dns effective. > > > > > > > > > > > > > pool.default.serverset.srvrecord.jndi-properties.java.naming.provider.url > > > > > = ${global:vars.dns} > > > > > pool.default.socketfactory.resolver.uRL = ${global:vars.dns} > > > > > > > > > > Thanks! > > > > > > > > > > > > > > > > > > > > > > > > > Thanks for the reply! > > > > > > > > > > > > > > 2015-01-29 11:53 GMT+01:00 Ondra Machacek > > > > > > >: > > > > > > > > > > > > > > On 01/29/2015 11:41 AM, Koen Vanoppen wrote: > > > > > > > > > > > > > > Can somebody help me setting up AAA for ovirt 3.5.1? > > > > > > > > > > > > > > I'm getting this now: > > > > > > > > > > > > > > 2015-01-29 11:35:36,889 WARN > > > > > > > [org.ovirt.engineextensions.__aaa.ldap.AuthzExtension] (MSC > > > > > > > service thread > > > > > > > 1-1) > > > [ovirt-engine-extension-aaa-__ldap.authz::BRU_AIR-authz] > > > > > > > Cannot > > > > > > > initialize LDAP framework, deferring initialization. > > > Error: An > > > > > > > error > > > > > > > occurred while attempting to query DNS in order to > > > retrieve SRV > > > > > > > records > > > > > > > with name '_gc._tcp.brussels.airport': > > > > > > > javax.naming.__NameNotFoundException: DNS name not found > > > > > > > [response code > > > > > > > 3]; remaining name '_gc._tcp.brussels.airport' > > > > > > > > > > > > > > > > > > > > > Do you have this '_gc._tcp.brussels.airport' SRV record in DNS > > > ? > > > > > > > > > > > > > > > > > > > > > my 3 configs: > > > > > > > _*BRU_AIR-authn.properties*_ > > > > > > > ovirt.engine.extension.name < > > > > > http://ovirt.engine.extension.name> > > > > > > > > > > > > > > = > > > > > > > BRU_AIR-authn > > > > > > > ovirt.engine.extension.__bindings.method = jbossmodule > > > > > > > ovirt.engine.extension.__binding.jbossmodule.module = > > > > > > > org.ovirt.engine-extensions.__aaa.ldap > > > > > > > ovirt.engine.extension.__binding.jbossmodule.class = > > > > > > > org.ovirt.engineextensions.__aaa.ldap.AuthnExtension > > > > > > > ovirt.engine.extension.__provides = > > > > > > > org.ovirt.engine.api.__extensions.aaa.Authn > > > > > > > ovirt.engine.aaa.authn.__profile.name > > > > > > > > > > > > > > > > > > > > > = BRU-AIR > > > > > > > ovirt.engine.aaa.authn.authz.__plugin = BRU_AIR-authz > > > > > > > config.profile.file.1 = > > > > > /etc/ovirt-engine/aaa/BRU_AIR.__properties > > > > > > > > > > > > > > _*BRU_AIR-authz.properties*_ > > > > > > > ovirt.engine.extension.name < > > > > > http://ovirt.engine.extension.name> > > > > > > > > > > > > > > = > > > > > > > BRU_AIR-authz > > > > > > > ovirt.engine.extension.__bindings.method = jbossmodule > > > > > > > ovirt.engine.extension.__binding.jbossmodule.module = > > > > > > > org.ovirt.engine-extensions.__aaa.ldap > > > > > > > ovirt.engine.extension.__binding.jbossmodule.class = > > > > > > > org.ovirt.engineextensions.__aaa.ldap.AuthzExtension > > > > > > > ovirt.engine.extension.__provides = > > > > > > > org.ovirt.engine.api.__extensions.aaa.Authz > > > > > > > config.profile.file.1 = > > > > > /etc/ovirt-engine/aaa/BRU_AIR.__properties > > > > > > > > > > > > > > _*BRU_AIR.properties*_ > > > > > > > include = > > > > > > > > > > > > > > # > > > > > > > # Active directory domain name. > > > > > > > # > > > > > > > vars.domain = mydomain.com > > > > > > > > > > > > > > > > > > > > > # > > > > > > > # Search user and its password. > > > > > > > # > > > > > > > vars.user = admin@${global:vars.domain} > > > > > > > vars.password = *********** > > > > > > > > > > > > > > # > > > > > > > # Optional DNS servers, if enterprise > > > > > > > # DNS server cannot resolve the domain srvrecord. > > > > > > > # > > > > > > > vars.dns = dns://dc01.mydomain.com < > > > http://dc01.mydomain.com> > > > > > > > > > > > > > > > > > > > > > pool.default.serverset.type = srvrecord > > > > > > > pool.default.serverset.__srvrecord.domain = > > > > > ${global:vars.domain} > > > > > > > pool.default.auth.simple.__bindDN = ${global:vars.user} > > > > > > > pool.default.auth.simple.__password = > > > ${global:vars.password > > > > > > > > > > > > > > In the GUI for adding user I get this: > > > > > > > > > > > > > > An error occurred while attempting to query DNS in order to > > > > > > > retrieve SRV > > > > > > > records with name '_gc__tcp_brussels_airport': > > > > > > > javax_naming___NameNotFoundException: DNS name not found > > > > > > > [response code > > > > > > > 3]; remaining name '_gc__tcp_brussels_airport' > > > > > > > > > > > > > > Any ideas? I ran out... > > > > > > > > > > > > > > Kind regards, > > > > > > > > > > > > > > Koen > > > > > > > > > > > > > > > > > > > > > _________________________________________________ > > > > > > > Users mailing list > > > > > > > Users(a)ovirt.org > > > > > > > http://lists.ovirt.org/__mailman/listinfo/users > > > > > > > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > > > > > > Users mailing list > > > > > > Users(a)ovirt.org > > > > > > http://lists.ovirt.org/mailman/listinfo/users > > > > > > > > > > > > > > > > > > > > > _______________________________________________ > Users mailing list > Users(a)ovirt.org > http://lists.ovirt.org/mailman/listinfo/users

1 0

Network setup for load balance
by Carlos Ibrahim Arias 29 Jan '15

29 Jan '15

Hello, I'm writing after a few weeks of trying to deploy the installation I had in mind without success. I'm a newbie using orvit and my problem may sound odd to some but I haven't been able to find a solution yet... I've searched all the Web. I have a server with two NICs (em1 and em2) and I want to bond them for load balancing. I installed oVirt 3.5.1 using the hosted-engine option with CentOS 7 on the hosted-engine and the host, and gluster on the host for the domain storage. Everything was fine during the installation and the system seems to work properly. ovirtmgmt is linked to em1. The problem is that now I can't bond em1 and em2 using the web GUI. I set up the bonding manually, it works but vdsmd is not starting afterwards. Should I have done the bond before installing oVirt? Is there any workaround to bond my NICs so that oVirt can use them for load balance? Shall I use other network setup for load balance (VLANs..)? Thanks in advanced, -- Carlos Ibrahim Arias *Consultor & Ingeniero en Informática* Braimtec - Smart IT E: carlos(a)braimtec.com M: +34 600 457 497

2 1

Unable to reactivate host after reboot due to failed Gluster probe
by Jan Siml 29 Jan '15

29 Jan '15

Hello, we have a strange behavior within an oVirt cluster. Version is 3.5.1, engine is running on EL6 machine and hosts are using EL7 as operating system. The cluster uses a GlusterFS backed storage domain amongst others. Three of four hosts are peers in the Gluster cluster (3 bricks, 3 replica). When all hosts are restarted (maybe due to power outage), engine can't activate them again, because Gluster probe fails. The message given in UI is: "Gluster command [gluster peer node-03] failed on server node-03." Checking Gluster peer and volume status on each host confirms that Gluster peers are known to each other and volume is up. node-03:~ $ gluster peer status Number of Peers: 2 Hostname: node-02 Uuid: 3fc36f55-d3a2-4efc-b2f0-31f83ed709d9 State: Peer in Cluster (Connected) Hostname: node-01 Uuid: 18027b35-971b-4b21-bb3d-df252b4dd525 State: Peer in Cluster (Connected) node-03:~ $ gluster volume status Status of volume: glusterfs-1 Gluster process Port Online Pid ------------------------------------------------------------------------------ Brick node-01:/export/glusterfs/brick 49152 Y 12409 Brick node-02:/export/glusterfs/brick 49153 Y 9978 Brick node-03:/export/glusterfs/brick 49152 Y 10001 Self-heal Daemon on localhost N/A Y 10003 Self-heal Daemon on node-01 N/A Y 11590 Self-heal Daemon on node-02 N/A Y 9988 Task Status of Volume glusterfs-1 ------------------------------------------------------------------------------ There are no active volume tasks Storage domain in oVirt UI is fine (active and green) and usable. But neither Gluster volume nor any brick is visible in UI. If I try the command which is shown in UI it returns: root@node-03:~ $ gluster peer probe node-03 peer probe: success. Probe on localhost not needed root@node-03:~ $ gluster --mode=script peer probe node-03 --xml <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <cliOutput> <opRet>0</opRet> <opErrno>1</opErrno> <opErrstr>(null)</opErrstr> <output>Probe on localhost not needed</output> </cliOutput> Is this maybe just an engine side parsing error? -- Kind regards Jan Siml

2 3