Hi,

first let me explain more thoroughly how things works in 4.0. Here's a bit simplified login flow:

1. Let's assume that ovirt.example.com was set as FQDN during engine-setup

2. User tries to access http://ovirt.example.com/ovirt-engine/webadmin

3. SSO authentication filters checks if user is authenticated and if not, user is redirected to https://ovirt.example.com/ovirt-engine/sso/login.html

4. User enters its username/password and if successfully authenticated, user is redirected back to original URL: http://ovirt.example.com/ovirt-engine/webadmin

Here are installation use cases which we assumed to be mostly used for oVirt (let's assume that engine is installed at host1.example.com, your proxy host is proxy1.example.com and you want you oVirt instance to accessed using alias ovirt.example.com):

1. Most users don't use any proxy, so the easiest method is to setup DNS alias ovirt.example.com pointing to host1.example.com and after that use ovirt.example.com during engine-setup as engine FQDN

2. If host1.example.com is in your internal network and you want ovirt.example.com to be accessible from both internal network and Internet you need to do the following:

- For you internal clients you need to do the same steps as in 1. in your internal DNS server

- For your external (Internet) clients you need to create another DNS alias ovirt.example.com pointing to your firewall (for example to host firewall.example.com) in your external DNS server and setup proper port forwarding from firewall.example.com to host1.example.com

3. If you need to use different FQDN for engine (for example you want to use proxy proxy1.example.com), then some manual config is required:

- Execute engine-setup and use host1.example.com as engine FQDN

- Setup you proxy in proxy1.example.com as in previous versions

- Setup your DNS and add DNS alias ovirt.example.com pointing to proxy1.example.com

- Go to host1.example.com and create new file /etc/ovirt-engine/engine.conf.d/99-setup-http-proxy.conf with following content

ENGINE_SSO_AUTH_URL="https://ovirt.example.com:443/ovirt-engine/sso"

SSO_CALLBACK_PREFIX_CHECK=false

- Restart ovirt-engine service

After above steps your oVirt instance can be accessed using http://ovirt.example.com, but all traffic to it will be redirected through your proxy at proxy1.example.com.

If none of above scenarios are usable for you, then please describe thoroughly your current setup. We may be help you with additional manual configuration or we will need to create an RFE bug for oVirt.

Thanks

Martin Perina

On Mon, Jul 4, 2016 at 1:36 AM, Colin Coe <colin.coe@gmail.com> wrote:

Hi all

If this is correct, it is a massive problem for us. We're still on RHEV v3.5 ATM but have plans to move to RHEV v4 when it looks production ready.

Many of our users are external parties that access the RHEV user portal externally via a (Juniper) reverse proxy appliance. The RHEV user portal URL gets rewritten to the URL of the Juniper appliance.

Should I file a bug on this, or an RFE?

Thanks

On Sun, Jul 3, 2016 at 5:16 PM, Martin Perina <mperina@redhat.com> wrote:
Hi,
In 4.0 you can access oVirt engine only with the same FQDN that was specified during engine-setup. If you have used different FQDN, you may change it using ovirt-engine-rename tool.

Martin Perina

On Sunday, July 3, 2016, Yaniv Dary <ydary@redhat.com> wrote:
>
> Yaniv Dary
> Technical Product Manager
> Red Hat Israel Ltd.
> 34 Jerusalem Road
> Building A, 4th floor
> Ra'anana, Israel 4350109
>
> Tel : +972 (9) 7692306
> 8272306
> Email: ydary@redhat.com
> IRC : ydary

>
> ---------- Forwarded message ----------
> From: COUSIN Kevin <kevin@famillecousin.fr>
> Date: Thu, Jun 30, 2016 at 5:31 PM
> Subject: [ovirt-users] [oVirt 4.0] Is it possible to access oVirt through a reverse proxy
> To: users@ovirt.org
>
>
> Hi list,
>
> I upgraded to oVirt 4.0 and it works fine. However, I used HAProxy to
> access oVirt outside my LAN. It doesn't work anymore since I upgraded
> to 4.0. It seems the oVirt Manager URL is rewritten by the SSO engine.
> eg: ovirt.externaldomain.tld -> ovirtmanager.internaldomain.tld.
>
> Is it possible to disable this behaviour and stay with
> ovirt.externaldomain.tld ?
>
> Regards
>
> --
> COUSIN Kevin <kevin@famillecousin.fr>
>
> _______________________________________________
> Users mailing list
> Users@ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>
>

_______________________________________________
Users mailing list
Users@ovirt.org
http://lists.ovirt.org/mailman/listinfo/users