12:20 p.m.
Hi,
I have been trying for a week or so to be able to get a domain based on freeipa
added to my ovirt/F16 setup so that I can add users.
I started out with 3.0.0 rpms from the ovirt repos, I've since built my
own rpms from git, 3.1.0.
I've set up ipa and can log in with kinit. I get this error when I run
engine-manage-domains:
[root@barleyville ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin(a)BVTEST.ORG
Valid starting Expires Service principal
04/25/12 18:17:07 04/26/12 18:17:05 krbtgt/BVTEST.ORG(a)BVTEST.ORG
[root@barleyville ~]# engine-manage-domains -action=add -domain=bvtest.org -user=admin
-passwordFile=/root/dompass
Error: Authentication Failed. Please verify the fully qualified domain name that is used
for authentication is correct.. Problematic domain is: bvtest.org
Failure while applying Kerberos configuration. Details: Authentication Failed. Please
verify the fully qualified domain name that is used for authentication is correct.
Is there some other logs I can provide? Thanks for any help, I'm about to give up.
details:
ovirt-engine-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-dbscripts-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-jboss-deps-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-log-collector-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-tools-common-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-debuginfo-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-setup-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-image-uploader-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-config-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-userportal-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-webadmin-portal-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-genericapi-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-notification-service-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-backend-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-restapi-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-iso-uploader-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-jbossas-1.2-2.fc16.x86_64
vdsm-4.9.3.3-0.fc16.x86_64
vdsm-cli-4.9.3.3-0.fc16.noarch
vdsm-bootstrap-4.9.3.3-0.fc16.noarch
libipa_hbac-python-1.8.2-10.fc16.x86_64
freeipa-server-2.1.4-5.fc16.x86_64
freeipa-python-2.1.4-5.fc16.x86_64
freeipa-admintools-2.1.4-5.fc16.x86_64
freeipa-server-selinux-2.1.4-5.fc16.x86_64
freeipa-client-2.1.4-5.fc16.x86_64
libipa_hbac-1.8.2-10.fc16.x86_64
1:35 p.m.
Quoting Jesse Brandeburg <jesse.brandeburg(a)intel.com>:
Hi,
I have been trying for a week or so to be able to get a domain based
on freeipa
added to my ovirt/F16 setup so that I can add users.
I started out with 3.0.0 rpms from the ovirt repos, I've since built my
own rpms from git, 3.1.0.
I've set up ipa and can log in with kinit. I get this error when I run
engine-manage-domains:
[root@barleyville ~]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: admin(a)BVTEST.ORG
Valid starting Expires Service principal
04/25/12 18:17:07 04/26/12 18:17:05 krbtgt/BVTEST.ORG(a)BVTEST.ORG
[root@barleyville ~]# engine-manage-domains -action=add
-domain=bvtest.org -user=admin -passwordFile=/root/dompass
Error: Authentication Failed. Please verify the fully qualified
domain name that is used for authentication is correct.. Problematic
domain is: bvtest.org
Failure while applying Kerberos configuration. Details:
Authentication Failed. Please verify the fully qualified domain name
that is used for authentication is correct.
Is there some other logs I can provide? Thanks for any help, I'm
about to give up.
What's in your engine-manage-domains.log?
-Sharad
details:
ovirt-engine-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-dbscripts-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-jboss-deps-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-log-collector-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-tools-common-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-debuginfo-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-setup-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-image-uploader-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-config-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-userportal-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-webadmin-portal-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-genericapi-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-notification-service-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-backend-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-restapi-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-iso-uploader-3.1.0_0001-1.8.fc16.x86_64
ovirt-engine-jbossas-1.2-2.fc16.x86_64
vdsm-4.9.3.3-0.fc16.x86_64
vdsm-cli-4.9.3.3-0.fc16.noarch
vdsm-bootstrap-4.9.3.3-0.fc16.noarch
libipa_hbac-python-1.8.2-10.fc16.x86_64
freeipa-server-2.1.4-5.fc16.x86_64
freeipa-python-2.1.4-5.fc16.x86_64
freeipa-admintools-2.1.4-5.fc16.x86_64
freeipa-server-selinux-2.1.4-5.fc16.x86_64
freeipa-client-2.1.4-5.fc16.x86_64
libipa_hbac-1.8.2-10.fc16.x86_64
_______________________________________________
Users mailing list
Users(a)ovirt.org
http://lists.ovirt.org/mailman/listinfo/users
2:18 p.m.
On Thu, 26 Apr 2012 14:35:32 -0400
<snmishra(a)linux.vnet.ibm.com> wrote:
What's in your engine-manage-domains.log?
hm, didn't know that log was there
2012-04-26 09:15:37,544 INFO [org.ovirt.engine.core.utils.kerberos.ManageDomains]
Creating kerberos configuration for domain(s): bvtest.org
2012-04-26 09:15:37,648 ERROR [org.ovirt.engine.core.dns.DnsSRVLocator] Error: could not
find DNS SRV record name: _kerberos._tcp.BVTEST.ORG.
Exception message is: DNS name not found [response code 3]
Possible causes: missing DNS entries in the DNS server or DNS resolving issues from
engine-core machine.
Please Ensure correct DNS entries exist in the DNS server and ensure the DNS server is
reachable from the engine-core machine.
I'll go add that _kerberos._tcp.BVTEST.ORG option to dnsmasq and let you know how it
goes!
Thanks
2:37 p.m.
----- Original Message -----
From: "Jesse Brandeburg"
<jesse.brandeburg(a)intel.com>
To: snmishra(a)linux.vnet.ibm.com
Cc: users(a)ovirt.org
Sent: Thursday, April 26, 2012 3:18:57 PM
Subject: Re: [Users] freeipa and ovirt can't add domain
On Thu, 26 Apr 2012 14:35:32 -0400
<snmishra(a)linux.vnet.ibm.com> wrote:
> What's in your engine-manage-domains.log?
hm, didn't know that log was there
2012-04-26 09:15:37,544 INFO
[org.ovirt.engine.core.utils.kerberos.ManageDomains] Creating
kerberos configuration for domain(s): bvtest.org
2012-04-26 09:15:37,648 ERROR
[org.ovirt.engine.core.dns.DnsSRVLocator] Error: could not find DNS
SRV record name: _kerberos._tcp.BVTEST.ORG.
Exception message is: DNS name not found [response code 3]
Possible causes: missing DNS entries in the DNS server or DNS
resolving issues from engine-core machine.
Please Ensure correct DNS entries exist in the DNS server and ensure
the DNS server is reachable from the engine-core machine.
I'll go add that _kerberos._tcp.BVTEST.ORG option to dnsmasq and let
you know how it goes!
Thanks
From memory you will want to do _ldap._tcp... while you are there.
Steve
3 p.m.
Quoting Steve Gordon <sgordon(a)redhat.com>:
----- Original Message -----
> From: "Jesse Brandeburg" <jesse.brandeburg(a)intel.com>
> To: snmishra(a)linux.vnet.ibm.com
> Cc: users(a)ovirt.org
> Sent: Thursday, April 26, 2012 3:18:57 PM
> Subject: Re: [Users] freeipa and ovirt can't add domain
>
> On Thu, 26 Apr 2012 14:35:32 -0400
> <snmishra(a)linux.vnet.ibm.com> wrote:
>
> > What's in your engine-manage-domains.log?
>
> hm, didn't know that log was there
> 2012-04-26 09:15:37,544 INFO
> [org.ovirt.engine.core.utils.kerberos.ManageDomains] Creating
> kerberos configuration for domain(s): bvtest.org
> 2012-04-26 09:15:37,648 ERROR
> [org.ovirt.engine.core.dns.DnsSRVLocator] Error: could not find DNS
> SRV record name: _kerberos._tcp.BVTEST.ORG.
> Exception message is: DNS name not found [response code 3]
> Possible causes: missing DNS entries in the DNS server or DNS
> resolving issues from engine-core machine.
> Please Ensure correct DNS entries exist in the DNS server and ensure
> the DNS server is reachable from the engine-core machine.
>
> I'll go add that _kerberos._tcp.BVTEST.ORG option to dnsmasq and let
> you know how it goes!
> Thanks
From memory you will want to do _ldap._tcp... while you are there.
Here is something else to try -
# nslookup
set q=srv
_ldap._tcp.ibm.com
Server: 9.42.xx.xxx
Address: 9.42.xx.xxx
Non-authoritative answer:
_ldap._tcp.ibm.com service = 0 100 389 aaaa.ibm.com.
_ldap._tcp.ibm.com service = 0 100 389 bbb.watson.ibm.com.
_ldap._tcp.ibm.com service = 0 100 389 ccc.pok.ibm.com.
_ldap._tcp.ibm.com service = 0 100 389 ddd.pok.ibm.com.
-Sharad
Steve
3:02 p.m.
On Thu, 26 Apr 2012 12:18:57 -0700
Jesse Brandeburg <jesse.brandeburg(a)intel.com> wrote:
On Thu, 26 Apr 2012 14:35:32 -0400
<snmishra(a)linux.vnet.ibm.com> wrote:
> What's in your engine-manage-domains.log?
hm, didn't know that log was there
2012-04-26 09:15:37,544 INFO [org.ovirt.engine.core.utils.kerberos.ManageDomains]
Creating kerberos configuration for domain(s): bvtest.org
2012-04-26 09:15:37,648 ERROR [org.ovirt.engine.core.dns.DnsSRVLocator] Error: could not
find DNS SRV record name: _kerberos._tcp.BVTEST.ORG.
Exception message is: DNS name not found [response code 3]
Possible causes: missing DNS entries in the DNS server or DNS resolving issues from
engine-core machine.
Please Ensure correct DNS entries exist in the DNS server and ensure the DNS server is
reachable from the engine-core machine.
I'll go add that _kerberos._tcp.BVTEST.ORG option to dnsmasq and let you know how it
goes!
I did all the _*. stuff that was in the ipa template.
well that put me in the right direction now moving onto this:
2012-04-26 12:26:21,014 INFO [org.ovirt.engine.core.utils.kerberos.ManageDomains]
Creating kerberos configuration for domain(s): bvtest.org
2012-04-26 12:26:21,044 INFO [org.ovirt.engine.core.utils.kerberos.ManageDomains]
Successfully created kerberos configuration for domain(s): bvtest.org
2012-04-26 12:26:21,044 INFO [org.ovirt.engine.core.utils.kerberos.ManageDomains] Testing
kerberos configuration for domain: bvtest.org
so thats good, but I get this back from command line:
[root]# engine-manage-domains -action=add -domain=bvtest.org -user=admin
-passwordFile=/root/dompass
No user in Directory was found for admin(a)BVTEST.ORG. Trying next LDAP server in list
Failure while testing domain bvtest.org. Details: No user information was found for user
I'm now trying to figure out how to run ldapsearch to check my ldap config.
4:33 p.m.
Quoting Jesse Brandeburg <jesse.brandeburg(a)intel.com>:
On Thu, 26 Apr 2012 12:18:57 -0700
Jesse Brandeburg <jesse.brandeburg(a)intel.com> wrote:
> On Thu, 26 Apr 2012 14:35:32 -0400
> <snmishra(a)linux.vnet.ibm.com> wrote:
>
> > What's in your engine-manage-domains.log?
>
> hm, didn't know that log was there
> 2012-04-26 09:15:37,544 INFO
> [org.ovirt.engine.core.utils.kerberos.ManageDomains] Creating
> kerberos configuration for domain(s): bvtest.org
> 2012-04-26 09:15:37,648 ERROR
> [org.ovirt.engine.core.dns.DnsSRVLocator] Error: could not find DNS
> SRV record name: _kerberos._tcp.BVTEST.ORG.
> Exception message is: DNS name not found [response code 3]
> Possible causes: missing DNS entries in the DNS server or DNS
> resolving issues from engine-core machine.
> Please Ensure correct DNS entries exist in the DNS server and
> ensure the DNS server is reachable from the engine-core machine.
>
> I'll go add that _kerberos._tcp.BVTEST.ORG option to dnsmasq and
> let you know how it goes!
I did all the _*. stuff that was in the ipa template.
well that put me in the right direction now moving onto this:
2012-04-26 12:26:21,014 INFO
[org.ovirt.engine.core.utils.kerberos.ManageDomains] Creating
kerberos configuration for domain(s): bvtest.org
2012-04-26 12:26:21,044 INFO
[org.ovirt.engine.core.utils.kerberos.ManageDomains] Successfully
created kerberos configuration for domain(s): bvtest.org
2012-04-26 12:26:21,044 INFO
[org.ovirt.engine.core.utils.kerberos.ManageDomains] Testing
kerberos configuration for domain: bvtest.org
so thats good, but I get this back from command line:
[root]# engine-manage-domains -action=add -domain=bvtest.org
-user=admin -passwordFile=/root/dompass
No user in Directory was found for admin(a)BVTEST.ORG. Trying next
LDAP server in list
Failure while testing domain bvtest.org. Details: No user
information was found for user
I'm now trying to figure out how to run ldapsearch to check my ldap config.
I would run nslookup to see all the ldap servers it found in the
domain and then run ldapsearch on each one to verify your config.
-Sharad
4376
days inactive
4376
days old
6 comments
3 participants
participants (3)
-
Jesse Brandeburg -
snmishra＠linux.vnet.ibm.com -
Steve Gordon