Hi!

Starting new thread instead of jacking someone else´s.

Managed to migrate from old 'engine-manage-domains' auth to aaa-ldap using:

# ovirt-engine-kerbldap-migration-tool --domain baz.foo.bar --cacert /tmp/ca.crt --apply


All OK, no errors, but cannot log in:

# ovirt-engine-extensions-tool aaa login-user --profile=baz.foo.bar-new --user-name=user:

API: <--Authn.InvokeCommands.AUTHENTICATE_CREDENTIALS result=SUCCESS

but:

API: -->Authz.InvokeCommands.FETCH_PRINCIPAL_RECORD principal='user@baz.foo.bar'
SEVERE  Cannot resolve principal 'user@baz.foo.bar'

So it fails.

# ldapsearch -x -H ldap://baz.foo.bar -D user@foo.bar -W -b DC=baz,DC=foo,DC=bar -s sub "(samAccountName=user)" userPrincipalName | grep 'userPrincipalName:'

userPrincipalName: user@foo.bar

How do you configure AAA with base 'DC=baz,DC=foo,DC=bar' when userPrincipalName ends only on '@foo.bar'?

/K