- Users - oVirt List Archives

LDAP auth error "server_error: Cannot locate principal"
by tbural＠gmail.com 21 Jul '21

21 Jul '21

Trying to configure LDAP auth on engine. After adding user from LDAP i cannot login with this error "server_error: Cannot locate principal" Errors from engine.log 2021-06-30 17:24:23,830+05 ERROR [org.ovirt.engine.core.sso.servlets.InteractiveAuthServlet] (default task-5) [686f77b] Internal Server Error: Cannot locate principal 'Domain Reader' 2021-06-30 17:24:23,830+05 ERROR [org.ovirt.engine.core.sso.utils.SsoUtils] (default task-5) [686f77b] Cannot locate principal 'Domain Reader' 2021-06-30 17:24:23,851+05 ERROR [org.ovirt.engine.core.aaa.servlet.SsoPostLoginServlet] (default task-5) [686f77b] server_error: Cannot locate principal 'Domain Reader' How i can fix this error? ovirt 4.3.10 Config /etc/ovirt-engine/aaa/openldap_rfc.properties: include = <rfc2307-openldap.properties> vars.server = LDAP.testdom.local vars.user = CN=Domain Reader,OU=AD,OU=SERVICE,DC=testdom,DC=local vars.password = password pool.default.auth.simple.bindDN = ${global:vars.user} pool.default.auth.simple.password = ${global:vars.password} pool.default.serverset.type = single pool.default.serverset.single.server = ${global:vars.server} pool.default.ssl.startTLS = tlocale pool.default.ssl.insecure = tlocale attrmap.map-principal-record.attr.PrincipalRecord_ID.map = uid attrmap.map-principal-record.attr.PrincipalRecord_PRINCIPAL.map = cn #LDAP value changes sequence.openldap-init-vars.030.var-set.value = entryUUID, uid, cn, givenName, sn, Email sequence.openldap-init-vars.040.var-set.value = (objectClass=posixAccount)(uid=*) sequence.openldap-init-vars.050.var-set.value = entryUUID, uid sequence.openldap-init-vars.060.var-set.value = (objectClass=posixGroup) sequence.openldap-init-vars.070.var-set.value = membelocalid User attribures: ovirt-engine-extensions-tool aaa search --extension-name=openldap_rfc-authz --entity=principal --entity-name=domreader 2021-07-21 17:14:33,805+05 INFO ======================================================================== 2021-07-21 17:14:33,833+05 INFO ============================ Initialization ============================ 2021-07-21 17:14:33,833+05 INFO ======================================================================== 2021-07-21 17:14:33,878+05 INFO Loading extension 'internal-authz' 2021-07-21 17:14:33,885+05 INFO Extension 'internal-authz' loaded ------ 2021-07-21 17:14:35,885+05 INFO ======================================================================== 2021-07-21 17:14:35,886+05 INFO ============================== Execution =============================== 2021-07-21 17:14:35,886+05 INFO ======================================================================== 2021-07-21 17:14:35,886+05 INFO Iteration: 0 2021-07-21 17:14:35,891+05 INFO --- Begin QueryFilterRecord --- 2021-07-21 17:14:35,892+05 INFO AAA_AUTHZ_QUERY_FILTER_OPERATOR: 102 2021-07-21 17:14:35,892+05 INFO AAA_AUTHZ_QUERY_ENTITY: AAA_AUTHZ_QUERY_ENTITY_PRINCIPAL[1695cd36-4656-474f-b7bc-4466e12634e4] 2021-07-21 17:14:35,893+05 INFO --- Begin QueryFilterRecord --- 2021-07-21 17:14:35,893+05 INFO AAA_AUTHZ_QUERY_FILTER_OPERATOR: 0 2021-07-21 17:14:35,894+05 INFO AAA_AUTHZ_QUERY_FILTER_KEY: Extkey[name=AAA_AUTHZ_PRINCIPAL_NAME;type=class java.lang.String;uuid=AAA_AUTHZ_PRINCIPAL_NAME[a0df5bcc-6ead-40a2-8565-2f5cc8773bdd];] 2021-07-21 17:14:35,894+05 INFO AAA_AUTHZ_PRINCIPAL_NAME: domreader 2021-07-21 17:14:35,894+05 INFO --- End QueryFilterRecord --- 2021-07-21 17:14:35,895+05 INFO --- End QueryFilterRecord --- 2021-07-21 17:14:35,895+05 INFO API: -->Authz.InvokeCommands.QUERY_OPEN namespace='dc=testdom,dc=local' 2021-07-21 17:14:35,904+05 INFO API: <--Authz.InvokeCommands.QUERY_OPEN 2021-07-21 17:14:35,904+05 INFO API: -->Authz.InvokeCommands.QUERY_EXECUTE 2021-07-21 17:16:04,079+05 INFO API: <--Authz.InvokeCommands.QUERY_EXECUTE count=1 2021-07-21 17:16:04,080+05 INFO --- Begin PrincipalRecord --- 2021-07-21 17:16:04,081+05 INFO AAA_AUTHZ_PRINCIPAL_PRINCIPAL: Domain Reader 2021-07-21 17:16:04,081+05 INFO AAA_AUTHZ_PRINCIPAL_LAST_NAME: Reader 2021-07-21 17:16:04,081+05 INFO AAA_LDAP_UNBOUNDID_DN: cn=Domain Reader,ou=AD,ou=SERVICE,dc=testdom,dc=local 2021-07-21 17:16:04,082+05 INFO AAA_AUTHZ_PRINCIPAL_NAMESPACE: dc=testdom,dc=local 2021-07-21 17:16:04,082+05 INFO AAA_AUTHZ_PRINCIPAL_ID: domreader 2021-07-21 17:16:04,082+05 INFO AAA_AUTHZ_PRINCIPAL_DISPLAY_NAME: Domain Reader 2021-07-21 17:16:04,083+05 INFO AAA_AUTHZ_PRINCIPAL_NAME: domreader 2021-07-21 17:16:04,083+05 INFO AAA_AUTHZ_PRINCIPAL_FIRST_NAME: Domain 2021-07-21 17:16:04,083+05 INFO --- End PrincipalRecord --- 2021-07-21 17:16:04,084+05 INFO API: -->Authz.InvokeCommands.QUERY_EXECUTE 2021-07-21 17:16:04,084+05 INFO API: <--Authz.InvokeCommands.QUERY_EXECUTE count=END 2021-07-21 17:16:04,084+05 INFO API: -->Authz.InvokeCommands.QUERY_CLOSE 2021-07-21 17:16:04,084+05 INFO API: <--Authz.InvokeCommands.QUERY_CLOSE Trying to auth using ovirt-engine-extensions-tool: ovirt-engine-extensions-tool aaa login-user --profile=openldap_rfc --user-name=domreader 2021-07-21 17:40:47,318+05 INFO ======================================================================== 2021-07-21 17:40:47,350+05 INFO ============================ Initialization ============================ 2021-07-21 17:40:47,351+05 INFO ======================================================================== 2021-07-21 17:40:47,401+05 INFO Loading extension 'internal-authz' 2021-07-21 17:40:47,407+05 INFO Extension 'internal-authz' loaded 2021-07-21 17:40:47,409+05 INFO Loading extension 'internal-authn' 2021-07-21 17:40:47,410+05 INFO Extension 'internal-authn' loaded 2021-07-21 17:40:47,426+05 INFO Loading extension 'test_ldap' 2021-07-21 17:40:47,508+05 INFO Extension 'test_ldap' loaded 2021-07-21 17:40:47,509+05 INFO Loading extension 'test_ldap-authn' 2021-07-21 17:40:47,523+05 INFO Extension 'test_ldap-authn' loaded 2021-07-21 17:40:47,525+05 INFO Loading extension 'openldap_rfc-authz' 2021-07-21 17:40:47,538+05 INFO Extension 'openldap_rfc-authz' loaded 2021-07-21 17:40:47,540+05 INFO Loading extension 'openldap_rfc-authn' 2021-07-21 17:40:47,551+05 INFO Extension 'openldap_rfc-authn' loaded 2021-07-21 17:40:47,552+05 INFO Initializing extension 'internal-authz' 2021-07-21 17:40:47,671+05 INFO Extension 'internal-authz' initialized 2021-07-21 17:40:47,672+05 INFO Initializing extension 'internal-authn' 2021-07-21 17:40:47,685+05 INFO Extension 'internal-authn' initialized 2021-07-21 17:40:47,685+05 INFO Initializing extension 'test_ldap' 2021-07-21 17:40:47,686+05 INFO [ovirt-engine-extension-aaa-ldap.authz::test_ldap] Creating LDAP pool 'authz' 2021-07-21 17:40:47,787+05 INFO [ovirt-engine-extension-aaa-ldap.authz::test_ldap] LDAP pool 'authz' information: vendor='null' version='null' 2021-07-21 17:40:47,788+05 INFO [ovirt-engine-extension-aaa-ldap.authz::test_ldap] Available Namespaces: [dc=field,dc=example,dc=com] 2021-07-21 17:40:47,789+05 INFO Extension 'test_ldap' initialized 2021-07-21 17:40:47,789+05 INFO Initializing extension 'test_ldap-authn' 2021-07-21 17:40:47,790+05 INFO [ovirt-engine-extension-aaa-ldap.authn::test_ldap-authn] Creating LDAP pool 'authz' 2021-07-21 17:40:47,837+05 INFO [ovirt-engine-extension-aaa-ldap.authn::test_ldap-authn] LDAP pool 'authz' information: vendor='null' version='null' 2021-07-21 17:40:47,838+05 INFO [ovirt-engine-extension-aaa-ldap.authn::test_ldap-authn] Creating LDAP pool 'authn' 2021-07-21 17:40:47,849+05 INFO [ovirt-engine-extension-aaa-ldap.authn::test_ldap-authn] LDAP pool 'authn' information: vendor='null' version='null' 2021-07-21 17:40:47,849+05 INFO Extension 'test_ldap-authn' initialized 2021-07-21 17:40:47,850+05 INFO Initializing extension 'openldap_rfc-authz' 2021-07-21 17:40:47,850+05 INFO [ovirt-engine-extension-aaa-ldap.authz::openldap_rfc-authz] Creating LDAP pool 'authz' 2021-07-21 17:40:47,851+05 WARNING [ovirt-engine-extension-aaa-ldap.authz::openldap_rfc-authz] TLS/SSL insecure mode 2021-07-21 17:40:48,575+05 INFO [ovirt-engine-extension-aaa-ldap.authz::openldap_rfc-authz] LDAP pool 'authz' information: vendor='null' version='null' 2021-07-21 17:40:48,576+05 INFO [ovirt-engine-extension-aaa-ldap.authz::openldap_rfc-authz] Available Namespaces: [dc=testdom,dc=local] 2021-07-21 17:40:48,576+05 INFO Extension 'openldap_rfc-authz' initialized 2021-07-21 17:40:48,576+05 INFO Initializing extension 'openldap_rfc-authn' 2021-07-21 17:40:48,577+05 INFO [ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] Creating LDAP pool 'authz' 2021-07-21 17:40:48,577+05 WARNING [ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] TLS/SSL insecure mode 2021-07-21 17:40:49,174+05 INFO [ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] LDAP pool 'authz' information: vendor='null' version='null' 2021-07-21 17:40:49,175+05 INFO [ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] Creating LDAP pool 'authn' 2021-07-21 17:40:49,175+05 WARNING [ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] TLS/SSL insecure mode 2021-07-21 17:40:49,427+05 INFO [ovirt-engine-extension-aaa-ldap.authn::openldap_rfc-authn] LDAP pool 'authn' information: vendor='null' version='null' 2021-07-21 17:40:49,428+05 INFO Extension 'openldap_rfc-authn' initialized 2021-07-21 17:40:49,428+05 INFO Start of enabled extensions list 2021-07-21 17:40:49,429+05 INFO Instance name: 'openldap_rfc-authz', Extension name: 'ovirt-engine-extension-aaa-ldap.authz', Version: '1.3.10', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.10-1.el7', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: '/etc/ovirt-engine/extensions.d/openldap_rfc-authz.properties', Initialized: 'tlocale' 2021-07-21 17:40:49,429+05 INFO Instance name: 'test_ldap', Extension name: 'ovirt-engine-extension-aaa-ldap.authz', Version: '1.3.10', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.10-1.el7', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: '/etc/ovirt-engine/extensions.d/test_ldap.properties', Initialized: 'tlocale' 2021-07-21 17:40:49,429+05 INFO Instance name: 'internal-authn', Extension name: '"ovirt-engine-extension-aaa-jdbc".authn', Version: '"1.1.10"', Notes: 'Display name: "ovirt-engine-extension-aaa-jdbc"', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: '/etc/ovirt-engine/extensions.d/internal-authn.properties', Initialized: 'tlocale' 2021-07-21 17:40:49,430+05 INFO Instance name: 'internal-authz', Extension name: '"ovirt-engine-extension-aaa-jdbc".authz', Version: '"1.1.10"', Notes: 'Display name: "ovirt-engine-extension-aaa-jdbc"', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: '/etc/ovirt-engine/extensions.d/internal-authz.properties', Initialized: 'tlocale' 2021-07-21 17:40:49,430+05 INFO Instance name: 'openldap_rfc-authn', Extension name: 'ovirt-engine-extension-aaa-ldap.authn', Version: '1.3.10', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.10-1.el7', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: '/etc/ovirt-engine/extensions.d/openldap_rfc-authn.properties', Initialized: 'tlocale' 2021-07-21 17:40:49,430+05 INFO Instance name: 'test_ldap-authn', Extension name: 'ovirt-engine-extension-aaa-ldap.authn', Version: '1.3.10', Notes: 'Display name: ovirt-engine-extension-aaa-ldap-1.3.10-1.el7', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: '/etc/ovirt-engine/extensions.d/test_ldap-authn.properties', Initialized: 'tlocale' 2021-07-21 17:40:49,430+05 INFO End of enabled extensions list 2021-07-21 17:40:49,431+05 INFO ======================================================================== 2021-07-21 17:40:49,431+05 INFO ============================== Execution =============================== 2021-07-21 17:40:49,431+05 INFO ======================================================================== 2021-07-21 17:40:49,432+05 INFO Iteration: 0 2021-07-21 17:40:49,433+05 INFO Profile='openldap_rfc' authn='openldap_rfc-authn' authz='openldap_rfc-authz' mapping='null' 2021-07-21 17:40:49,433+05 INFO API: -->Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='openldap_rfc' user='domreader' Password: 2021-07-21 17:42:28,572+05 INFO API: <--Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS profile='openldap_rfc' result=SUCCESS 2021-07-21 17:42:28,576+05 INFO --- Begin AuthRecord --- 2021-07-21 17:42:28,577+05 INFO AAA_AUTHN_AUTH_RECORD_PRINCIPAL: Domain Reader 2021-07-21 17:42:28,577+05 INFO --- End AuthRecord --- 2021-07-21 17:42:28,578+05 INFO API: -->Authz.InvokeCommands.FETCH_PRINCIPAL_RECORD principal='Domain Reader' 2021-07-21 17:43:28,582+05 SEVERE Cannot locate principal 'Domain Reader' LDAP server working as proxy to AD. slapd.conf listnig: ### Schema includes ########################################################### include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/ad.schema ## Module paths ############################################################## modulepath /usr/lib64/openldap/ moduleload back_ldap moduleload rwm ### Logging ################################################################### logfile /var/log/slapd/slapd.log loglevel 256 # Main settings ############################################################### pidfile /var/run/openldap/slapd.pid argsfile /var/run/openldap/slapd.args TLSCipherSuite HIGH:!NULL TLSCACertificateFile /etc/pki/tls/certs/cacert.pem TLSCertificateFile /etc/pki/tls/certs/slapd.pem TLSCertificateKeyFile /etc/pki/tls/certs/slapd.pem TLSVerifyClient never # Disallow non-encrypted binds - this will refuse any connection that isn't # secured with at least 128-bit encryption security ssf=128 # Allow v2 binding for legacy clients ######################################### allow bind_v2 ### Database definition (Proxy to AD) ######################################### database ldap readonly yes protocol-version 3 rebind-as-user yes uri "ldap://testdom.local:389" suffix "dc=testdom,dc=local" idassert-bind bindmethod=simple mode=none binddn="CN=Domain Reader,OU=AD,OU=SERVICE,DC=testdom,DC=local" credentials=eOv5rgrNv3eq starttls=yes tls_cacertdir=/etc/pki/tls/certs tls_reqcert=never idassert-authzFrom "*" overlay rwm

1 0

Does anyone know How to install macOS on ovirt4.4？
by zhouhao＠vip.friendtimes.net 21 Jul '21

21 Jul '21

Does anyone know How to install macOS on ovirt4.4? I used the image--"macOS.Big.Sur.11.2.3.20D91.iso"，It can run successfully on VMware.But on ovirt，I tested the boot type by both UEFI and BIOS ,they are all cant boot

3 2

Reminder : last week for submitting an abstract for ovirt conference
by Sandro Bonazzola 21 Jul '21

21 Jul '21

Just a reminder that call for papers closes on July 25 and this is the last week! -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours. <https://mojo.redhat.com/docs/DOC-1199578>*

1 0

Reconfigure Gluster from Replica 3 to Arbiter 1/Replica 2
by David White 21 Jul '21

21 Jul '21

My current hyperconverged environment is replicating data across all 3 servers. I'm running critically low on disk space, and need to add space. To that end, I've ordered 8x 800GB ssd drives, and plan to put 4 drives in 1 server, and 4 drives in the other. What's my best option for reconfiguring the hyperconverged cluster, to change gluster storage away from Replica 3 to a Replica 2 / Arbiter model? I'd really prefer not to have to reinstall things from scratch, but I'll do that if I have to. My most important requirement is that I cannot have any downtime for my VMs (so I can only reconfigure 1 host at a time). Sent with ProtonMail Secure Email.

3 8

Automatic Shutdown / Startup for Hosted-Engine
by Eugène Ngontang 18 Jul '21

18 Jul '21

Hi, I understood we have to put hosted-engine into maintenance mode and shutdown the VMs if we want to power off the host (otherwise it will reboot). I'm setting up a process to - put the HestedEngine in global maintenance mode (*hosted-engine --set-maintenance --mode=global*) - shutdown the HostedEngine (*hosted-engine --vm-shutdown*) - PowerOff the HostedEngine (*hosted-engine --vm-poweroff*) - Power off the server (*shutdown -P*) Everything works fine and I can start the server back up, remove the HostedEngine from maintenance mode, and it will start automatically running. The issue is when bringing up hosted-engine: all VMs come up but one (*BigIP*) and I am trying to see if there is way to bring it up without having to store the engine password (using the *ovirt_vm* API). At the moment, I am having to look for the BigIP VM and then use credentials to bring it up: it will not come up with 'hosted-engine --vm-start' Is there to make this specific VM start the same time as the others VM automatically when HostedEngine starts? Thanks for your help. Regards, Eugène NG -- LesCDN <http://lescdn.com> engontang(a)lescdn.com ------------------------------------------------------------ *Aux hommes il faut un chef, et au* * chef il faut des hommes!L'habit ne fait pas le moine, mais lorsqu'on te voit on te juge!*

2 2

Browser console not available in admin portal?
by Chris Adams 16 Jul '21

16 Jul '21

Is there a reason the browser-based console is available in the VM portal but not the admin portal? -- Chris Adams <cma(a)cmadams.net>

1 0

Removing Direct Mapped LUNs
by Ryan Chewning 16 Jul '21

16 Jul '21

Hi List, We need to add and remove directly mapped LUNs to multiple VMs in our Non-Production environment. The environment is backed by an iSCSI SAN. In testing when removing a directly mapped LUN it doesn't remove the underlying multipath and devices. Several questions. 1) Is this the expected behavior? 2) Are we supposed to go to each KVM host and manually remove the underlying multipath devices? 3) Is there a technical reason that oVirt doesn't do this as part of the steps to removing the storage? This is something that was handled by the manager in the previous virtualization that we used, Oracle's Xen based Oracle VM. Thanks! Ryan

5 11

ovirt (two nodes & iscsi san)
by edp＠maddalena.it 16 Jul '21

16 Jul '21

Hi. i am trying to set up an environment with two ovirt nodes connected to a san in iscsi. every node has a direct connection to the san (with a point-to-point connection). so every node talks with the san on a different iscsi channel with a different ip. in this case (i have just tried) when I shut down ovirt-node1 the ovirt-engine cannot restart automatically on ovirt-node2. maybe this because when I have configured hosted engine I have moved the engine storage to the iscsi lun that only the node1 can see (the ovirt-engine-setup asks for the iscsi ip address). In this case how can I resovle my problem? other than moving the ovirt-engine from one node to the other I have also to publish other luns to both ovirt nodes. but if every node talks only with one channel of the iscsi san I think that this won't working. If i put a 10 gb switch between ovirt-nodes and san channels can working? what I would like to do is connect the two ovirt nodes to the switch and also the two iscsi channels of the san to the switch. in this way each node should be able to talk to the san on both ip (iscsi channels) thank you

1 1

How to limit number of snapshots per vm
by dhanaraj.ramesh＠yahoo.com 16 Jul '21

16 Jul '21

Hi Team, How do I limit snapshots to certain number within the cluster, or Global setting level. Any help appreciated

1 0

random adapter (NIC) resets on oVirt Node 4.4.6
by Tivon Häberlein 15 Jul '21

15 Jul '21

Hi, I've been trying to get oVirt Node 4.4.6 up and running on my Dell r620 hosts but am facing a strange issue where seemingly all network adapters get reset at random times after install. The interfaces reset as soon as a bit of traffic is flowing through them. Also the logs show nfs timeouts. This only happens after I have installed the host using the oVirt engine and it also only happens when the host is connected to the engine. When the host is in maintenance mode it also seems to work fine. The host and networks work fine when its by itself (I tested right after install using the ISO and also after I have removed the host from the cluster) I cant figure why this is happening. Am I missing something? I've been stuck on this for the last couple of weeks, a bit of help would be much appreciated. Thank you! My cluster is looking like this: Engine: oVirt 4.4.6 - CentOS Linux release 8.3.2011 host1: oVirt 4.4 repository on CentOS Linux release 8.4.2105 host2: oVirt 4.4 repository on CentOS Linux release 8.4.2105 host3 (this is the one I'm trying to install): oVirt node 4.4.6 -- Best regards Tivon Häberlein

4 8