Re: [Users] I don't know how to add AD users

On Tue, Nov 20, 2012 at 9:58 AM, Itamar Heim <iheim(a)redhat.com&gt; wrote: > On 11/20/2012 09:56 AM, Cristian Falcas wrote: > >> >> >> >> On Tue, Nov 20, 2012 at 9:42 AM, Yair Zaslavsky <yzaslavs(a)redhat.com >> <mailto:yzaslavs@redhat.com>> wrote: >> >> >> >> On 11/20/2012 09:05 AM, Cristian Falcas wrote: >> >> >> >> >> On Tue, Nov 20, 2012 at 8:36 AM, Yair Zaslavsky >> <yzaslavs(a)redhat.com <mailto:yzaslavs@redhat.com> >> <mailto:yzaslavs@redhat.com <mailto:yzaslavs@redhat.com>>> >> wrote: >> >> >> >> On 11/20/2012 12:39 AM, Cristian Falcas wrote: >> >> >> >> On Mon, Nov 19, 2012 at 10:53 PM, Itamar Heim >> <iheim(a)redhat.com <mailto:iheim@redhat.com> >> <mailto:iheim@redhat.com <mailto:iheim@redhat.com>> >> <mailto:iheim@redhat.com <mailto:iheim@redhat.com> >> <mailto:iheim@redhat.com <mailto:iheim@redhat.com>>>> wrote: >> >> On 11/19/2012 11:29 AM, Vinzenz Feenstra wrote: >> >> On 11/19/2012 10:01 AM, Cristian Falcas wrote: >> >> Hi, >> >> I'm trying to add some users to ovirt >> using an AD. >> >> This is the configuration I used for a >> mediawiki >> site, which is >> working correctly: >> $wgAuth = new LdapAuthenticationPlugin(); >> $wgLDAPUseLocal = true; >> $wgLDAPDomainNames = array( "a_domain"); >> $wgLDAPServerNames = array( >> "a_domain"=>"site.example.com <http://site.example.com> >> <http://site.example.com> >> <http://site.example.com> >> <http://site.example.com>"); >> >> $wgLDAPEncryptionType = array( >> "a_domain"=>"clear"); >> $wgLDAPSearchStrings = array( >> "a_domain"=>"rom_domain\\USER-** >> ______NAME"); >> $wgLDAPBaseDNs = array( >> "a_domain"=>"dc=company,dc=___**___com"); >> >> >> >> >> Those are the commands I tried using: >> engine-manage-domains -action=add >> -domain=site.example.com <http://site.example.com> >> <http://site.example.com> >> <http://site.example.com> >> <http://site.example.com> >> -provider=ActiveDirectory >> -user=user.name <http://user.name> >> <http://user.name> <http://user.name> >> <http://user.name> -interactive >> >> >> engine-manage-domains -action=add >> -domain=a_domain >> -provider=ActiveDirectory >> -user=user.name(a)company.com >> <mailto:user.name@company.com> <mailto:user.name@company.com >> <mailto:user.name@company.com>**> >> <mailto:user.name@company.com >> <mailto:user.name@company.com> >> <mailto:user.name@company.com >> <mailto:user.name@company.com>**>__> >> <mailto:user.name@company.com >> <mailto:user.name@company.com> >> <mailto:user.name@company.com >> <mailto:user.name@company.com>**> >> >> <mailto:user.name@company.com >> <mailto:user.name@company.com> >> <mailto:user.name@company.com >> <mailto:user.name@company.com>**>__>__> -interactive >> >> >> engine-manage-domains -action=add >> -domain=a_domain >> -provider=ActiveDirectory >> -user=user.name(a)site.example._**_____com >> >> <mailto:user.name@site. >> <mailto:user.name@site.>__exam**p__le.com <http://examp__le.com>< >> http://example.com> >> <mailto:user.name@site.__examp**le.com<http://example.com> >> <mailto:user.name@site.**example.com<user.name@site.example.com> >> >>> >> <mailto:user.name@site >> <mailto:user.name@site>. >> <mailto:user.name@site >> <mailto:user.name@site>.>__exa**m__p__le.com<http://exam__p__le.com> >> <http://examp__le.com> <http://example.com> >> >> >> >> <mailto:user.name@site. >> <mailto:user.name@site.>__exam**p__le.com <http://examp__le.com>< >> http://example.com> >> <mailto:user.name@site.__examp**le.com<http://example.com> >> <mailto:user.name@site.**example.com<user.name@site.example.com>>>>> >> -interactive >> >> >> You don't add an user this way. You add the >> domain. You >> have to >> pass the >> domain admin user and the domain admin >> password. >> >> >> any domain user will do, doesn't have to be an >> admin. >> what does the log say? >> >> >> Then you can use the domain within the engine. >> e.g. search >> users, add >> access rights for vms etc. >> Even login to the engine and assigning rights >> within >> the engine >> you can >> handle from the engine itself. >> >> Regards, >> >> And the output on all tries: >> Enter password: >> >> Error: Authentication Failed. Please >> verify the fully >> qualified domain >> name that is used for authentication is >> correct.. >> Problematic domain >> is: domain_used_in_command >> Failure while applying Kerberos >> configuration. Details: >> Authentication >> Failed. Please verify the fully qualified >> domain >> name that >> is used for >> authentication is correct. >> >> Can someone help me with the correct >> parameters? >> >> >> Best regards, >> Cristian Falcas >> >> >> >> ______________________________**_______________________ >> >> Users mailing list >> Users(a)ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org >> <mailto:Users@ovirt.org>> <mailto:Users@ovirt.org >> <mailto:Users@ovirt.org> >> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>>> >> http://lists.ovirt.org/______**mailman/listinfo/users<http://lists.ovi... >> <http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> > >> >> <http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> >> >> >> >> >> <http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> > >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> <http://lists.ovirt.org/**mailman/listinfo/users<http://lists.ovirt.org... >> >>> >> >> >> >> -- >> Regards, >> >> Vinzenz Feenstra | Senior Software Engineer >> RedHat Engineering Virtualization R & D >> Phone: +420 532 294 625 >> <tel:%2B420%20532%20294%20625> <tel:%2B420%20532%20294%20625> >> <tel:%2B420%20532%20294%20625> >> >> IRC: vfeenstr or evilissimo >> >> Better technology. Faster innovation. Powered >> by community >> collaboration. >> See how it works at redhat.com >> <http://redhat.com> <http://redhat.com> >> <http://redhat.com> >> >> >> >> >> ______________________________**_______________________ >> >> Users mailing list >> Users(a)ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org >> <mailto:Users@ovirt.org>> <mailto:Users@ovirt.org >> <mailto:Users@ovirt.org> >> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>>> >> http://lists.ovirt.org/______**mailman/listinfo/users<http://lists.ovi... >> <http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> > >> >> <http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> >> >> >> <http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> > >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> <http://lists.ovirt.org/**mailman/listinfo/users<http://lists.ovirt.org... >> >>> >> >> >> >> ______________________________** >> _______________________ >> >> Users mailing list >> Users(a)ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org >> <mailto:Users@ovirt.org>> <mailto:Users@ovirt.org >> <mailto:Users@ovirt.org> >> <mailto:Users@ovirt.org <mailto:Users@ovirt.org>>> >> http://lists.ovirt.org/______**mailman/listinfo/users<http://lists.ovi... >> <http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> > >> <http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> >> >> >> >> <http://lists.ovirt.org/____** >> mailman/listinfo/users<http://lists.ovirt.org/____mailman/listinfo/use... >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> > >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> <http://lists.ovirt.org/**mailman/listinfo/users<http://lists.ovirt.org... >> >>> >> >> >> >> >> Hi, >> >> This is the command I used (the same error is with >> -interactive >> parameter): >> >> engine-manage-domains -action=add -domain=example.com >> <http://example.com> >> <http://example.com> >> <http://example.com> -provider=ActiveDirectory >> -user=user.name@a_domain >> >> -passwordFile=/tmp/pass >> >> [root@localhost ~]# cat /tmp/pass >> qwerty[root@localhost ~]# >> >> This is the log: >> >> 2012-11-20 00:30:40,443 INFO >> >> [org.ovirt.engine.core.utils._**___kerberos.ManageDomains] >> Creating >> >> >> kerberos >> configuration for domain(s): example.com >> <http://example.com> <http://example.com> >> <http://example.com> >> >> 2012-11-20 00:30:40,525 INFO >> >> [org.ovirt.engine.core.utils._**___kerberos.ManageDomains] >> >> Successfully >> >> created kerberos configuration for domain(s): >> example.com <http://example.com> >> <http://example.com> >> <http://example.com> >> >> 2012-11-20 00:30:40,526 INFO >> >> [org.ovirt.engine.core.utils._**___kerberos.ManageDomains] >> Testing >> >> >> kerberos >> configuration for domain: example.com >> <http://example.com> <http://example.com> >> <http://example.com> >> >> 2012-11-20 00:30:40,830 ERROR >> >> [org.ovirt.engine.core.utils._**___kerberos.** >> KerberosConfigCheck] >> >> Error: >> >> exception message: Cannot locate KDC >> 2012-11-20 00:30:40,851 ERROR >> >> [org.ovirt.engine.core.utils._**___kerberos.ManageDomains] >> Failure >> >> while >> >> testing domain example.com <http://example.com> >> <http://example.com> >> <http://example.com>;. Details: Kerberos >> >> error. Please check log for further details. >> >> >> Hi, the error indicates you don't have kerberos configured. >> manage-domains validates by default using GSSAPI/Kerberos >> (if I >> understand correctly, this is equivalent to run ldapsearch >> with -Y >> gssapi option). >> I wonder if -x (simple authentication) will work for you as >> well (as >> manage-domains contains code for simple authentication as >> well). >> >> >> >> This is the ldapsearch command that works (it retrieves >> users) >> from the >> same machine: >> >> >> >> ldapsearch -H ldap://example.com <http://example.com> >> <http://example.com> >> <http://example.com> -b >> >> dc=example,dc=com -D user.name@a_domain -w qwerty >> >> >> Best regards, >> Cristian Falcas >> >> >> >> ______________________________**_____________________ >> Users mailing list >> Users(a)ovirt.org <mailto:Users@ovirt.org> <mailto:Users@ovirt.org >> <mailto:Users@ovirt.org>> >> http://lists.ovirt.org/____**mailman/listinfo/users<http://lists.ovirt... >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> > >> <http://lists.ovirt.org/__**mailman/listinfo/users<http://lists.ovirt.o... >> <http://lists.ovirt.org/**mailman/listinfo/users<http://lists.ovirt.org... >> >> >> >> >> >> >> Hi, >> >> I used "-x" for ldapsearch and the result is the same: list >> retrieved. >> Is there any equivalent for engine-manage-domains? >> >> Cristian >> >> Hi Christian, there is no code allowing to add simple-authentication >> domains to Manage-Domains. >> In the past we did have the ability to do that, but there are >> several problematic issues. >> What ldap server are you working against? Maybe I missed that >> >> >> >> >> Hi, >> >> The server is a Microfost AD 2003. >> >> Best regards, >> Cristian Falcas >> > > this should work, is the AD also the DNS server for the ovirt engine > machine? > > yes