Hi,
Thanks a lot for your detailed explanation.
That mean that I don't need DNS entries (forward and reverse) for oVirt
engine anymore, only SRV records for the directory service (for sure)?
So using IP or /etc/hosts is sufficient.
Regards,
René
On Mon, 2013-04-08 at 09:55 -0400, Yair Zaslavsky wrote:
Hi,
When you add a new domain - let's say
example.com what happens from DNS perspective
is -
a. if useDnsLookup at engine-manage-domains conf is set to "true" then
dns_lookup_realm = true
and dns_lookup_kdc = true
Will be placed at the krb5.conf that is being created.
This will cause the internal java kerberos implementation to issue DNS srv requests per
realm (for example, if you want to add the domain
example.com, the realm will be
EXAMPLE.COM)
for kerberos -
the srv record query will look like
_kerberos._tcp.example.com and it will return a list
of KDCs for the realm.
If useDnsLookup is not set to true,
This will cause the manage-domains utility to issue kerberos DNS srv records, and fill
the krb5.conf file with information on KDCs per realm.
In return you will get a list of corresponding hosts for the ldap servers.
b. If -ldapServers was not passed - a DNS srv record will be issues to get the ldap
servers for the domain -
_ldap._tcp.example.com after the manage-domains utility performs kerberos
authentication.
This is done, in order to get a URL of an ldap server to be used, to send an ldap query
and get the user id for the given user at the command line utility.
So, as long as your DNS is configured properly, and the SRV records are well defined, you
will get SRV records for kerberos and ldap.
----- Original Message -----
> From: "René Koch (ovido)" <r.koch(a)ovido.at>
> To: "ovirt-users" <users(a)ovirt.org>
> Sent: Friday, April 5, 2013 3:47:07 PM
> Subject: [Users] DNS for IPA in oVirt
>
> Hi list,
>
> I don't want to ask my question in the mail thread of Eduardo to avoid
> mixing topics.
>
> Can you give me more detailed information on how oVirt is using DNS
> internally and how IPA users can work in the following scenario:
>
> # engine-manage-domains -action=list
> Domain: ovido.at
> User name: admin(a)OVIDO.AT
> Manage Domains completed successfully
>
> # cat /etc/hosts | grep engine
> 10.0.100.195 ovirt-engine.lab.ovido.at
>
> # ip a
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
> state UP qlen 1000
> link/ether 00:1a:4a:00:64:14 brd ff:ff:ff:ff:ff:ff
> inet 10.0.100.195/24 brd 10.0.100.255 scope global eth0
>
> # host ovirt-engine.lab.ovido.at
> ovirt-engine.lab.ovido.at has address 10.0.100.24
>
> # host 10.0.100.24
> 24.100.0.10.in-addr.arpa domain name pointer ovirt-engine.lab.ovido.at.
>
> So in my case I have correct DNS settings (forward and reverse), but my
> ovirt-engine host has a totally different IP address.
>
> I didn't test SSO with Kerberos in user portal (maybe this want work),
> but authentication with IPA user in user portal and admin portal is
> working fine even with these totally wrong DNS configuration.
>
>
> Regards,
> René
>
>
> _______________________________________________
> Users mailing list
> Users(a)ovirt.org
>
http://lists.ovirt.org/mailman/listinfo/users
>