Re: [ovirt-users] ovirt with 389 server inactive groups

From: "Paul Robert Marino" <prmarino1(a)gmail.com&gt; To: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; Cc: "Maurice James" <mjames(a)media-node.com&gt;, users(a)ovirt.org Sent: Sunday, August 10, 2014 10:43:14 PM Subject: Re: [ovirt-users] ovirt with 389 server inactive groups Sorry for my delayed response to this I am using ovirt 3.3. I am using Kerberos 5, and all of the DNS requirements are in place. Finally 389 server is the upstream project for RHDS and one of the upstream projects for IPA. So I chose to set it as RHDS because its an identical match. User authentication works just fine my problem is adding roles to groups. I can assign a role to a group but the group always shows an inactive status; however if I assign a role directly to to a user it works fine. In addition if I drill down into a user it knows what groups in the 389 server the user is a member of. finally I can't see any error in the logs when adding a role to a group

On Sat, Aug 9, 2014 at 2:33 AM, Alon Bar-Lev <alonbl(a)redhat.com&gt; wrote: > > > ----- Original Message ----- >> From: "Maurice James" <mjames(a)media-node.com&gt; >> To: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; >> Cc: "Itamar Heim" <iheim(a)redhat.com&gt;, users(a)ovirt.org >> Sent: Saturday, August 9, 2014 3:47:04 AM >> Subject: Re: [ovirt-users] ovirt with 389 server inactive groups >> >> Does this still require the use of kerberos? Will 389-ds work on its own? > > In 3.5 we introduced pure ldap support[1], obsoleting the kerberos/ldap > mix. > > It will be great to receive feedback[2]. > > 389ds is not supported directly, I think it is similar to IPA as it uses > 389. Maybe I should rename the profile of ipa to 389 if it works properly. > > Regards, > Alon > > [1] > http://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git;a=bl... > [2] http://lists.ovirt.org/pipermail/devel/2014-August/008367.html > >> >> ----- Original Message ----- >> From: "Alon Bar-Lev" <alonbl(a)redhat.com&gt; >> To: "Itamar Heim" <iheim(a)redhat.com&gt; >> Cc: users(a)ovirt.org >> Sent: Friday, August 8, 2014 3:45:07 PM >> Subject: Re: [ovirt-users] ovirt with 389 server inactive groups >> >> >> >> ----- Original Message ----- >> > From: "Itamar Heim" <iheim(a)redhat.com&gt; >> > To: "Paul Robert Marino" <prmarino1(a)gmail.com&gt;, users(a)ovirt.org >> > Sent: Friday, August 8, 2014 10:37:11 PM >> > Subject: Re: [ovirt-users] ovirt with 389 server inactive groups >> > >> > On 08/07/2014 07:06 PM, Paul Robert Marino wrote: >> > > I have ovirt engine running and connected to a 389 server with the >> > > memberof plugin enabled and working properly. >> > > >> > > I can add users and assign them to roles without any issues. >> > > >> > > when I look at a user I can see all the LDAP groups they are a member >> > > of. >> > > >> > > when I run engine-manage-domains -action=validate it tells me the >> > > domain is valid. >> > > >> > > here is my problem when I try to assign a role to an LDAP group it >> > > looks like it works but in the general tab when under the group it >> > > tells me the status is Inactive. >> > > >> > > dose any one know how to enable the group? >> > > _______________________________________________ >> > > Users mailing list >> > > Users(a)ovirt.org >> > > http://lists.ovirt.org/mailman/listinfo/users >> > > >> > >> > 3.4 or new 3.5 Generic LDAP provider? >> >> >> On case this is 3.5 it is known issue, all groups will be seen as >> inactive, >> this field will probably be removed from UI, as groups are no longer >> fetched >> periodically. >> This field is totally ignored. >> >> Alon >> _______________________________________________ >> Users mailing list >> Users(a)ovirt.org >> http://lists.ovirt.org/mailman/listinfo/users >> > _______________________________________________ > Users mailing list > Users(a)ovirt.org > http://lists.ovirt.org/mailman/listinfo/users