[Users] oVirt and IPA
Hi, I found an issue with IPA (and DNS) and oVirt. If I have hosted IPA server in ovirt and have enabled login thru IPA to oVirt and I stop IPA VM, I can not do anything in oVirt. I can not even log in to oVirt, because login dialog is grayed out (I think it waits on reaching IPA server). Of course I use IPA as primary DNS server for oVirt. After some time oVirt lets me input local admin credentials and waits on something. I have more ipa servers, so I think login authentication should fall back to another IPA server, but it does not.
Be sure to have a mirror IPA server _NOT_on the same ovirt host AND you need to be using at least 2 DNS servers AND they both must be able to point kerberos lookups to all IPA servers. I have my main IPA server as a vm and a secondary on a physical system I run backups from. On Wed, Nov 6, 2013 at 12:49 PM, Jakub Bittner <j.bittner@nbu.cz> wrote:
Hi,
I found an issue with IPA (and DNS) and oVirt. If I have hosted IPA server in ovirt and have enabled login thru IPA to oVirt and I stop IPA VM, I can not do anything in oVirt. I can not even log in to oVirt, because login dialog is grayed out (I think it waits on reaching IPA server). Of course I use IPA as primary DNS server for oVirt. After some time oVirt lets me input local admin credentials and waits on something.
I have more ipa servers, so I think login authentication should fall back to another IPA server, but it does not. _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
-- -- James P. Kinney III Every time you stop a school, you will have to build a jail. What you gain at one end you lose at the other. It's like feeding a dog on his own tail. It won't fatten the dog. - Speech 11/23/1900 Mark Twain *http://heretothereideas.blogspot.com/ <http://heretothereideas.blogspot.com/>*
This is a multi-part message in MIME format. --------------010203040703010306000907 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Dne 6.11.2013 19:04, Jim Kinney napsal(a):
Be sure to have a mirror IPA server _NOT_on the same ovirt host AND you need to be using at least 2 DNS servers AND they both must be able to point kerberos lookups to all IPA servers. I have my main IPA server as a vm and a secondary on a physical system I run backups from.
On Wed, Nov 6, 2013 at 12:49 PM, Jakub Bittner <j.bittner@nbu.cz <mailto:j.bittner@nbu.cz>> wrote:
Hi,
I found an issue with IPA (and DNS) and oVirt. If I have hosted IPA server in ovirt and have enabled login thru IPA to oVirt and I stop IPA VM, I can not do anything in oVirt. I can not even log in to oVirt, because login dialog is grayed out (I think it waits on reaching IPA server). Of course I use IPA as primary DNS server for oVirt. After some time oVirt lets me input local admin credentials and waits on something.
I have more ipa servers, so I think login authentication should fall back to another IPA server, but it does not. _______________________________________________ Users mailing list Users@ovirt.org <mailto:Users@ovirt.org> http://lists.ovirt.org/mailman/listinfo/users
-- -- James P. Kinney III //// ////Every time you stop a school, you will have to build a jail. What you gain at one end you lose at the other. It's like feeding a dog on his own tail. It won't fatten the dog. - Speech 11/23/1900 Mark Twain //// http://heretothereideas.blogspot.com/ ////
I have more IPA servers, but it does not fail over to second IPA server. Next server was online and reachable. Maybe problem is that oVirt authentication system has only one IPA server, but the question is how to add another one or where to look on config files. --------------010203040703010306000907 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">Dne 6.11.2013 19:04, Jim Kinney napsal(a):<br> </div> <blockquote cite="mid:CAEo=5PxWpbx1TA6K3Ovq7v7tPFT2F+hn9omN0Ng1fO91c20ZyQ@mail.gmail.com" type="cite"> <div dir="ltr"> <div>Be sure to have a mirror IPA server _NOT_on the same ovirt host AND you need to be using at least 2 DNS servers AND they both must be able to point kerberos lookups to all IPA servers. I have my main IPA server as a vm and a secondary on a physical system I run backups from.<br> <br> </div> <br> </div> <div class="gmail_extra"><br> <br> <div class="gmail_quote">On Wed, Nov 6, 2013 at 12:49 PM, Jakub Bittner <span dir="ltr"><<a moz-do-not-send="true" href="mailto:j.bittner@nbu.cz" target="_blank">j.bittner@nbu.cz</a>></span> wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br> <br> I found an issue with IPA (and DNS) and oVirt. If I have hosted IPA server in ovirt and have enabled login thru IPA to oVirt and I stop IPA VM, I can not do anything in oVirt. I can not even log in to oVirt, because login dialog is grayed out (I think it waits on reaching IPA server). Of course I use IPA as primary DNS server for oVirt. After some time oVirt lets me input local admin credentials and waits on something.<br> <br> I have more ipa servers, so I think login authentication should fall back to another IPA server, but it does not.<br> _______________________________________________<br> Users mailing list<br> <a moz-do-not-send="true" href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br> <a moz-do-not-send="true" href="http://lists.ovirt.org/mailman/listinfo/users" target="_blank">http://lists.ovirt.org/mailman/listinfo/users</a><br> </blockquote> </div> <br> <br clear="all"> <br> -- <br> <div dir="ltr">-- <br> James P. Kinney III<br> <i><i><i><i><br> </i></i></i></i>Every time you stop a school, you will have to build a jail. What you gain at one end you lose at the other. It's like feeding a dog on his own tail. It won't fatten the dog.<br> - Speech 11/23/1900 Mark Twain<br> <i><i><i><i><br> <a moz-do-not-send="true" href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a><br> </i></i></i></i></div> </div> </blockquote> <br> I have more IPA servers, but it does not fail over to second IPA server. Next server was online and reachable. Maybe problem is that oVirt authentication system has only one IPA server, but the question is how to add another one or where to look on config files.<br> </body> </html> --------------010203040703010306000907--
On 11/06/2013 07:49 PM, Jakub Bittner wrote:
Hi,
I found an issue with IPA (and DNS) and oVirt. If I have hosted IPA server in ovirt and have enabled login thru IPA to oVirt and I stop IPA VM, I can not do anything in oVirt. I can not even log in to oVirt, because login dialog is grayed out (I think it waits on reaching IPA server). Of course I use IPA as primary DNS server for oVirt. After some time oVirt lets me input local admin credentials and waits on something.
I have more ipa servers, so I think login authentication should fall back to another IPA server, but it does not. _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
if the login dialog is stuck becasue your IPA server is down, it would be a bug. but i don't see a reason for the two to be related. the login dialog shows the list of domains from the config, not from polling them.
participants (3)
-
Itamar Heim -
Jakub Bittner -
Jim Kinney