Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
--=-7FGTMvtERpsX2N9uBb42 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hello, I upgraded to ovirt 3.5.0 and can no longer authenticate to IPA. Starting up ovrit-engine the extension manager fails to properly load the service that handles Kerberos/LDAP. engine.log: ... 2014-11-10 11:29:25,106 INFO [org.ovirt.engine.core.dal.job.ExecutionMessageDirector] (MSC service thread 1-10) Start initializing ExecutionMessageDirector 2014-11-10 11:29:25,108 INFO [org.ovirt.engine.core.dal.job.ExecutionMessageDirector] (MSC service thread 1-10) Finished initializing ExecutionMessageDirector 2014-11-10 11:29:25,145 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Loading extension 'builtin-authn-internal' 2014-11-10 11:29:25,146 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Extension 'builtin-authn-internal' loaded 2014-11-10 11:29:25,148 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Loading extension 'internal' 2014-11-10 11:29:25,150 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Extension 'internal' loaded 2014-11-10 11:29:25,154 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Loading extension 'builtin-authn-EXAMPLE.ORG' 2014-11-10 11:29:25,215 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Extension 'builtin-authn-EXAMPLE.ORG' loaded 2014-11-10 11:29:25,218 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Loading extension 'EXAMPLE.ORG' 2014-11-10 11:29:25,264 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Extension 'EXAMPLE.ORG' loaded 2014-11-10 11:29:25,265 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Initializing extension 'EXAMPLE.ORG' 2014-11-10 11:29:25,265 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Extension 'EXAMPLE.ORG' initialized 2014-11-10 11:29:25,266 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Initializing extension 'builtin-authn-internal' 2014-11-10 11:29:25,266 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Extension 'builtin-authn-internal' initialized 2014-11-10 11:29:25,267 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Initializing extension 'builtin-authn-EXAMPLE.ORG' 2014-11-10 11:29:25,267 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Extension 'builtin-authn-EXAMPLE.ORG' initialized 2014-11-10 11:29:25,268 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Initializing extension 'internal' 2014-11-10 11:29:25,268 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Extension 'internal' initialized 2014-11-10 11:29:25,268 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Start of enabled extensions list 2014-11-10 11:29:25,269 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Instance name: 'EXAMPLE.ORG', Extension name: 'Kerberos/Ldap Authz (Built-in)', Version: 'N/A', Notes: '', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: 'N/A', Initialized: 'true' 2014-11-10 11:29:25,270 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Instance name: 'builtin-authn-internal', Extension name: 'Internal Authn (Built-in)', Version: 'N/A', Notes: '', License: 'AS L 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: 'N/A', Initialized: 'true' 2014-11-10 11:29:25,270 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Instance name: 'builtin-authn-EXAMPLE.ORG', Extension name: 'Kerberos/Ldap Authn (Built-in)', Version: 'N/A', Notes: '', Licen se: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: 'N/A', Initialized: 'true' 2014-11-10 11:29:25,271 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) Instance name: 'internal', Extension name: 'Internal Authz (Built-in)', Version: 'N/A', Notes: '', License: 'ASL 2.0', Home: 'http://www.ovirt.org', Author 'The oVirt Project', Build interface Version: '0', File: 'N/A', Initialized: 'true' 2014-11-10 11:29:25,272 INFO [org.ovirt.engine.core.extensions.mgr.ExtensionsManager] (MSC service thread 1-10) End of enabled extensions list 2014-11-10 11:29:25,404 INFO [org.ovirt.engine.core.bll.aaa.DbUserCacheManager] (MSC service thread 1-10) Start initializing DbUserCacheManager 2014-11-10 11:29:25,405 INFO [org.ovirt.engine.core.bll.aaa.DbUserCacheManager] (MSC service thread 1-10) Finished initializing DbUserCacheManager 2014-11-10 11:29:25,414 INFO [org.ovirt.engine.core.bll.tasks.AsyncTaskManager] (MSC service thread 1-10) Initialization of AsyncTaskManager completed successfully. 2014-11-10 11:29:25,416 INFO [org.ovirt.engine.core.vdsbroker.ResourceManager] (MSC service thread 1-10) Start initializing ResourceManager 2014-11-10 11:29:25,458 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerberosldap.LdapBrokerCommandBase= ] (DefaultQuartzScheduler_Worker-1) Failed to run command LdapSearchUserByQ= ueryCommand. Domain is EXAMPLE.ORG. User is user1@EXAMPLE.ORG. 2014-11-10 11:29:25,459 ERROR [org.ovirt.engine.core.bll.aaa.SyncUsers] (DefaultQuartzScheduler_Worker-1) Error during user synchronization of extension EXAMPLE.ORG. Exception message is No enum constant org.ovirt.engine.extensions.aaa.bui ltin.kerberosldap.LDAPSecurityAuthentication. Trying to authenticate with user2 from IPA produces this error: engine.log: 2014-11-10 11:30:08,777 ERROR [org.ovirt.engine.extensions.aaa.builtin.kerberosldap.LdapBrokerCommandBase= ] (ajp--127.0.0.1-8702-2) Failed to run command LdapAuthenticateUserCommand= . Domain is EXAMPLE.ORG. User is user2. 2014-11-10 11:30:08,779 ERROR [org.ovirt.engine.core.bll.aaa.LoginAdminUserCommand] (ajp--127.0.0.1-8702-2) Error during CanDoActionFailure.: Class: class org.ovirt.engine.core.extensions.mgr.ExtensionInvokeCommandFailedException Input:=20 {Extkey[name=3DAAA_AUTHN_CREDENTIALS;type=3Dclass java.lang.String;uuid=3DAAA_AUTHN_CREDENTIALS[03b96485-4bb5-4592-8167-810a5= c909706];]=3D***, Extkey[name=3DEXTENSION_INVOKE_CONTEXT;type=3Dclass org.o= virt.engine.api.extensions.ExtMap;uuid=3DEXTENSION_INVOKE_CONTEXT[886d2ebb-= 312a-49ae-9cc3-e1f849834b7d];]=3D{Extkey[name=3DEXTENSION_INTERFACE_VERSION= _MAX;type=3Dclass java.lang.Integer;uuid=3DEXTENSION_INTERFACE_VERSION_MAX[= f4cff49f-2717-4901-8ee9-df362446e3e7];]=3D0, Extkey[name=3DEXTENSION_LICENS= E;type=3Dclass java.lang.String;uuid=3DEXTENSION_LICENSE[8a61ad65-054c-4e31= -9c6d-1ca4d60a4c18];]=3DASL 2.0, Extkey[name=3DEXTENSION_HOME_URL;type=3Dcl= ass java.lang.String;uuid=3DEXTENSION_HOME_URL[4ad7a2f4-f969-42d4-b399-72d1= 92e18304];]=3Dhttp://www.ovirt.org, Extkey[name=3DEXTENSION_LOCALE;type=3Dc= lass java.lang.String;uuid=3DEXTENSION_LOCALE[0780b112-0ce0-404a-b85e-8765d= 778bb29];]=3Den_US, Extkey[name=3DEXTENSION_NAME;type=3Dclass java.lang.Str= ing;uuid=3DEXTENSION_NAME[651381d3-f54f-4547-bf28-b0b01a103184];]=3DKerbero= s/Ldap Authn (Built-in), Extkey[name=3DEXTENSION_INTERFACE_VERSION_MIN;type= =3Dclass java.lang.Integer;uuid=3DEXTENSION_INTERFACE_VERSION_MIN[2b84fc91-= 305b-497b-a1d7-d961b9d2ce0b];]=3D0, Extkey[name=3DEXTENSION_CONFIGURATION;t= ype=3Dclass java.util.Properties;uuid=3DEXTENSION_CONFIGURATION[2d48ab72-f0= a1-4312-b4ae-5068a226b0fc];]=3D***, Extkey[name=3DEXTENSION_AUTHOR;type=3Dc= lass java.lang.String;uuid=3DEXTENSION_AUTHOR[ef242f7a-2dad-4bc5-9aad-e0701= 8b7fbcc];]=3DThe oVirt Project, Extkey[name=3DEXTENSION_INSTANCE_NAME;type= =3Dclass java.lang.String;uuid=3DEXTENSION_INSTANCE_NAME[65c67ff6-aeca-4bd5= -a245-8674327f011b];]=3Dbuiltin-authn-EXAMPLE.ORG, Extkey[name=3DEXTENSION_= BUILD_INTERFACE_VERSION;type=3Dclass java.lang.Integer;uuid=3DEXTENSION_BUI= LD_INTERFACE_VERSION[cb479e5a-4b23-46f8-aed3-56a4747a8ab7];]=3D0, Extkey[na= me=3DEXTENSION_CONFIGURATION_SENSITIVE_KEYS;type=3Dinterface java.util.Coll= ection;uuid=3DEXTENSION_CONFIGURATION_SENSITIVE_KEYS[a456efa1-73ff-4204-9f9= b-ebff01e35263];]=3D[, config.authn.user.password], Extkey[name=3DAAA_AUTHN= _CAPABILITIES;type=3Dclass java.lang.Long;uuid=3DAAA_AUTHN_CAPABILITIES[9d1= 6bee3-10fd-46f2-83f9-3d3c54cf258d];]=3D12, Extkey[name=3DEXTENSION_GLOBAL_C= ONTEXT;type=3Dclass org.ovirt.engine.api.extensions.ExtMap;uuid=3DEXTENSION= _GLOBAL_CONTEXT[9799e72f-7af6-4cf1-bf08-297bc8903676];]=3D*skip*, Extkey[na= me=3DEXTENSION_VERSION;type=3Dclass java.lang.String;uuid=3DEXTENSION_VERSI= ON[fe35f6a8-8239-4bdb-ab1a-af9f779ce68c];]=3DN/A, Extkey[name=3DEXTENSION_M= ANAGER_TRACE_LOG;type=3Dinterface org.slf4j.Logger;uuid=3DEXTENSION_MANAGER= _TRACE_LOG[863db666-3ea7-4751-9695-918a3197ad83];]=3Dorg.slf4j.impl.Slf4jLo= gger(org.ovirt.engine.core.extensions.mgr.ExtensionsManager.trace.Kerberos/= Ldap Authn (Built-in).builtin-authn-EXAMPLE.ORG), Extkey[name=3DEXTENSION_P= ROVIDES;type=3Dinterface java.util.Collection;uuid=3DEXTENSION_PROVIDES[8cf= 373a6-65b5-4594-b828-0e275087de91];]=3D[org.ovirt.engine.api.extensions.aaa= .Authn]}, Extkey[name=3DAAA_AUTHN_USER;type=3Dclass java.lang.String;uuid= =3DAAA_AUTHN_USER[1ceaba26-1bdc-4663-a3c6-5d926f9dd8f0];]=3Duser2, Extkey[n= ame=3DEXTENSION_INVOKE_COMMAND;type=3Dclass org.ovirt.engine.api.extensions= .ExtUUID;uuid=3DEXTENSION_INVOKE_COMMAND[485778ab-bede-4f1a-b823-77b262a2f2= 8d];]=3DAAA_AUTHN_AUTHENTICATE_CREDENTIALS[d9605c75-6b43-4b00-b32c-06bdfa80= 244c]} Output: {Extkey[name=3DEXTENSION_INVOKE_RESULT;type=3Dclass java.lang.Integer;uuid=3DEXTENSION_INVOKE_RESULT[0909d91d-8bde-40fb-b6c0-09= 9c772ddd4e];]=3D2, Extkey[name=3DEXTENSION_INVOKE_MESSAGE;type=3Dclass java= .lang.String;uuid=3DEXTENSION_INVOKE_MESSAGE[b7b053de-dc73-4bf7-9d26-b8bdb7= 2f5893];]=3DNo enum constant org.ovirt.engine.extensions.aaa.builtin.kerber= osldap.LDAPSecurityAuthentication.} engine-manage-domains shows the IPA domain but I cannot delete the domain or edit it. # engine-manage-domains list Domain: EXAMPLE.ORG User name: null Manage Domains completed successfully # engine-manage-domains delete --domain=3DEXAMPLE.ORG Domain example.org doesn't exist in the configuration. Any ideas on fixing? Regards, Cameron --=-7FGTMvtERpsX2N9uBb42 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABAgAGBQJUZiJKAAoJEM1PCzopIAOtj+4IAKqqzUwJopm2lptCLicVzS3O 2rdWqgA6XGTr7b0NOHRNyFk6dxgcw0Au9Nf5RMykpiw3GKxDAQ64BKvNmxncGSL2 HudZ/+iTtwFsgxU87jGOYD/l9Gq9uaxheH8VdkwY6R4sCCUGLmM9oDo33TYz2k/a my+m7CsBYdfzJFRrcNdHcaRWFtJ9GKxiuUyCPhAPYRHW1Z86EZk1BbVb6gr/hyTG 56NZAgPa5nCBXchdETm+60JVwc3G/PY/Txo0oUxpd9CrBPLpxe45jojWSZuFAtk4 FX2gw0sNMo1CCaKOXumnJONF5pVpmcPH6VVZDtnPhs7Jbk5ntNpg2urqkejOR+M= =SDGw -----END PGP SIGNATURE----- --=-7FGTMvtERpsX2N9uBb42--
Hello, is using the new structure AAA (Authentication, Authorization and Accouting) of the oVirt 3.5? -- Ao encaminhar esta mensagem, por favor: 1. Apague o meu e-mail e o meu nome. 2. Apague também os endereços dos amigos antes de reenviar 3. Use Cco ou Bcc para enviar mensagens! Dificulte a disseminação de vírus e spam.
----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: users@ovirt.org Sent: Friday, November 14, 2014 5:39:54 PM Subject: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
Hello,
I upgraded to ovirt 3.5.0 and can no longer authenticate to IPA. Starting up ovrit-engine the extension manager fails to properly load the service that handles Kerberos/LDAP.
This is probably a bug, can you please execute the following and paste result: # PGPASSWORD="@PASSWORD@" psql -U engine -d engine -c "select * from vdc_options where option_name='LDAPSecurityAuthentication'" Replace @PASSWORD@ and probably other parameters based on /etc/ovirt-engine/engine.conf.d/10-setup-database.conf It is probably empty and we should file a bug. If you are interested there is a new ldap provider in 3.5 available in snapshots repository (ovirt-engine-extension-aaa-ldap package), documentation is available here[1], this provider should be simpler and robust as it uses only ldap protocol and is fully customizable. Regards, Alon [1] http://gerrit.ovirt.org/gitweb?p=ovirt-engine-extension-aaa-ldap.git;a=blob;...
--=-BShxRVg4dZFjAWDlapKM Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, 2014-11-17 at 14:39 -0500, Alon Bar-Lev wrote:
=20 ----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: users@ovirt.org Sent: Friday, November 14, 2014 5:39:54 PM Subject: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to I= PA =20 Hello, =20 I upgraded to ovirt 3.5.0 and can no longer authenticate to IPA. Starting up ovrit-engine the extension manager fails to properly load the service that handles Kerberos/LDAP. =20 This is probably a bug, can you please execute the following and paste re= sult: =20 # PGPASSWORD=3D"@PASSWORD@" psql -U engine -d engine -c "select * from vd= c_options where option_name=3D'LDAPSecurityAuthentication'" =20
option_id | option_name | option_value | version=20 -----------+----------------------------+-------------------+--------- 165 | LDAPSecurityAuthentication | example.org:GSSAPI | general I replaced my domain name with 'example.org' Cameron --=-BShxRVg4dZFjAWDlapKM Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABAgAGBQJUamwGAAoJEM1PCzopIAOt0m4H/17bo0EjFj5ttFrYPjrbYedY wrxBROW3+WHLC33nuOrphN/tNFLtWGZz56w/O49bJnvtUULKF3tFvEALipP9OT23 JgBYKLAGU6s2ZirI+Z2JsVRwnRMgxgEToz3DaQz4UiYTbSfmxPiA+HX5JPqU+yYC 6dfj8lbsY+sqXRydGhjZutx6NEkUGnrvsQ3m3Szj3MzHAUhF5i8psM7mkALrjQNF x3TjPUw/P1QSTXzzeTQimmGRTh92eg4uiAr+CVEoBxsQWOVKbRK69WfdEzbSI1Zk 9HYnE5rZ7dhrOU4qp1af+vhIET76n+z0q+KPhzSbL/DDUx+wdtqPXOFLAlc5YMM= =yWCM -----END PGP SIGNATURE----- --=-BShxRVg4dZFjAWDlapKM--
----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: "Alon Bar-Lev" <alonbl@redhat.com> Cc: users@ovirt.org Sent: Monday, November 17, 2014 11:43:34 PM Subject: Re: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
On Mon, 2014-11-17 at 14:39 -0500, Alon Bar-Lev wrote:
----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: users@ovirt.org Sent: Friday, November 14, 2014 5:39:54 PM Subject: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
Hello,
I upgraded to ovirt 3.5.0 and can no longer authenticate to IPA. Starting up ovrit-engine the extension manager fails to properly load the service that handles Kerberos/LDAP.
This is probably a bug, can you please execute the following and paste result:
# PGPASSWORD="@PASSWORD@" psql -U engine -d engine -c "select * from vdc_options where option_name='LDAPSecurityAuthentication'"
option_id | option_name | option_value | version -----------+----------------------------+-------------------+--------- 165 | LDAPSecurityAuthentication | example.org:GSSAPI | general
I replaced my domain name with 'example.org'
I thought it will be empty... and it contains valid value. Yair? Any I truly suggest you try out the new provider... Much easier to resolve any issue, current and future, including easier to debug. Alon
=20 ----- Original Message -----
=20 ----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: users@ovirt.org Sent: Friday, November 14, 2014 5:39:54 PM Subject: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails = to IPA =20 Hello, =20 I upgraded to ovirt 3.5.0 and can no longer authenticate to IPA. Starting up ovrit-engine the extension manager fails to properly lo= ad the service that handles Kerberos/LDAP. =20 This is probably a bug, can you please execute the following and past= e result: =20 # PGPASSWORD=3D"@PASSWORD@" psql -U engine -d engine -c "select * fro= m vdc_options where option_name=3D'LDAPSecurityAuthentication'" =20 =20
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: "Alon Bar-Lev" <alonbl@redhat.com> Cc: users@ovirt.org Sent: Monday, November 17, 2014 11:43:34 PM Subject: Re: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails = to IPA =20 =20 =20 On Mon, 2014-11-17 at 14:39 -0500, Alon Bar-Lev wrote: option_id | option_name | option_value | version -----------+----------------------------+-------------------+--------- 165 | LDAPSecurityAuthentication | example.org:GSSAPI | general =20 I replaced my domain name with 'example.org' =20 =20 I thought it will be empty... and it contains valid value. Yair? =20 Looking through the vdc_options table I noticed that many of the LDAP* and Ad* settings use two different spellings for the Kerberos/LDAP domain. One in all upper case letters, EXAMPLE.ORG and one in all lower case, example.org. (I'm guessing this is to handle either spelling of
--=-ab3ttqn+JA1ntsEfrJq5 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, 2014-11-17 at 16:48 -0500, Alon Bar-Lev wrote: the domain?) I updated LDAPSecurityAuthentication and set the option_value to use both the upper case and lower case domain name, 'EXAMPLE.ORG:GSSAPI,example.org:GSSAPI'. select * from vdc_options where option_name =3D 'LDAPSecurityAuthentication'; option_id | option_name | option_value | version=20 -----------+----------------------------+----------------------------------= ---+--------- 165 | LDAPSecurityAuthentication | EXAMPLE.ORG:GSSAPI,example.org:GSSAPI | general Using both domain names I am able to authenticate, authorize and pull account information from the IPA server once again. Thanks for pointing me at the right location. Cameron --=-ab3ttqn+JA1ntsEfrJq5 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABAgAGBQJUa3H+AAoJEM1PCzopIAOthPgIAIIFVSXNKLlmHAwjqVd6qEh7 +ClBsBOhNgKAjFGX7ucV/GPsyOBGPHrMsR4S9zkHHNUy7Jm0GTMPtkR4qjAiboA/ H87Zdas2PMbAIRi7uo/T4s0A4ptxI3q9rnqsNB/SBraefOnPwBbdW2EmAWcPV0lp 8XCssnnXgd9DEW9s9Dsrx/bGP+q+a3g0gGFTtPmWN36Bj9Tt6oKQUpd59lspsaQE ez2LVGiLt9c3P/TBk0kIdlM9ZisCiNVmYfbdZev96CP9werA73brPRXweyOCSZok TatV9URortCNHRRR9r6pcQoj70u8RzgnfuJRRP0BMrb3DxLVdZMuynI25D9tIC8= =do9Z -----END PGP SIGNATURE----- --=-ab3ttqn+JA1ntsEfrJq5--
----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: "Alon Bar-Lev" <alonbl@redhat.com> Cc: "Yair Zaslavsky" <yzaslavs@redhat.com>, users@ovirt.org Sent: Tuesday, November 18, 2014 6:21:18 PM Subject: Re: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
On Mon, 2014-11-17 at 16:48 -0500, Alon Bar-Lev wrote:
----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: "Alon Bar-Lev" <alonbl@redhat.com> Cc: users@ovirt.org Sent: Monday, November 17, 2014 11:43:34 PM Subject: Re: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
On Mon, 2014-11-17 at 14:39 -0500, Alon Bar-Lev wrote:
----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: users@ovirt.org Sent: Friday, November 14, 2014 5:39:54 PM Subject: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
Hello,
I upgraded to ovirt 3.5.0 and can no longer authenticate to IPA. Starting up ovrit-engine the extension manager fails to properly load the service that handles Kerberos/LDAP.
This is probably a bug, can you please execute the following and paste result:
# PGPASSWORD="@PASSWORD@" psql -U engine -d engine -c "select * from vdc_options where option_name='LDAPSecurityAuthentication'"
option_id | option_name | option_value | version -----------+----------------------------+-------------------+--------- 165 | LDAPSecurityAuthentication | example.org:GSSAPI | general
I replaced my domain name with 'example.org'
I thought it will be empty... and it contains valid value. Yair?
Looking through the vdc_options table I noticed that many of the LDAP* and Ad* settings use two different spellings for the Kerberos/LDAP domain. One in all upper case letters, EXAMPLE.ORG and one in all lower case, example.org. (I'm guessing this is to handle either spelling of the domain?)
I updated LDAPSecurityAuthentication and set the option_value to use both the upper case and lower case domain name, 'EXAMPLE.ORG:GSSAPI,example.org:GSSAPI'.
select * from vdc_options where option_name = 'LDAPSecurityAuthentication'; option_id | option_name | option_value | version -----------+----------------------------+-------------------------------------+--------- 165 | LDAPSecurityAuthentication | EXAMPLE.ORG:GSSAPI,example.org:GSSAPI | general
Just so we can continue to investigate - if u would like to get your ldap and kerberos SRV records , to which domain will you send them in your setup? dig SRV _ldap._tcp.EXAMPLE.ORG or dig SRV _ldap._tcp.example.org? same goes to _kerberos._tcp.example.org and _kerberos._tcp.EXAMPLE.ORG Cheers, Yair
Using both domain names I am able to authenticate, authorize and pull account information from the IPA server once again.
Thanks for pointing me at the right location.
Cameron
----- Original Message -----
From: "Alon Bar-Lev" <alonbl@redhat.com> To: "Cameron Christensen" <cameron.christensen@uk2group.com>, "Yair Zaslavsky" <yzaslavs@redhat.com> Cc: users@ovirt.org Sent: Monday, November 17, 2014 11:48:15 PM Subject: Re: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: "Alon Bar-Lev" <alonbl@redhat.com> Cc: users@ovirt.org Sent: Monday, November 17, 2014 11:43:34 PM Subject: Re: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
On Mon, 2014-11-17 at 14:39 -0500, Alon Bar-Lev wrote:
----- Original Message -----
From: "Cameron Christensen" <cameron.christensen@uk2group.com> To: users@ovirt.org Sent: Friday, November 14, 2014 5:39:54 PM Subject: [ovirt-users] Upgrade to Ovirt 3.5.0 Authentication Fails to IPA
Hello,
I upgraded to ovirt 3.5.0 and can no longer authenticate to IPA. Starting up ovrit-engine the extension manager fails to properly load the service that handles Kerberos/LDAP.
This is probably a bug, can you please execute the following and paste result:
# PGPASSWORD="@PASSWORD@" psql -U engine -d engine -c "select * from vdc_options where option_name='LDAPSecurityAuthentication'"
option_id | option_name | option_value | version -----------+----------------------------+-------------------+--------- 165 | LDAPSecurityAuthentication | example.org:GSSAPI | general
I replaced my domain name with 'example.org'
I thought it will be empty... and it contains valid value. Yair?
No, this is fine actually.
Any I truly suggest you try out the new provider... Much easier to resolve any issue, current and future, including easier to debug.
Alon
participants (4)
-
Alon Bar-Lev -
Cameron Christensen -
Marcelo Donato -
Yair Zaslavsky