Re: [ovirt-users] [oVirt 4.0] Is it possible to access oVirt through a reverse proxy
Hi, In 4.0 you can access oVirt engine only with the same FQDN that was specified during engine-setup. If you have used different FQDN, you may change it using ovirt-engine-rename tool. Martin Perina On Sunday, July 3, 2016, Yaniv Dary <ydary@redhat.com> wrote:
Yaniv Dary Technical Product Manager Red Hat Israel Ltd. 34 Jerusalem Road Building A, 4th floor Ra'anana, Israel 4350109
Tel : +972 (9) 7692306 8272306 Email: ydary@redhat.com IRC : ydary
---------- Forwarded message ---------- From: COUSIN Kevin <kevin@famillecousin.fr> Date: Thu, Jun 30, 2016 at 5:31 PM Subject: [ovirt-users] [oVirt 4.0] Is it possible to access oVirt through
a reverse proxy
To: users@ovirt.org
Hi list,
I upgraded to oVirt 4.0 and it works fine. However, I used HAProxy to access oVirt outside my LAN. It doesn't work anymore since I upgraded to 4.0. It seems the oVirt Manager URL is rewritten by the SSO engine. eg: ovirt.externaldomain.tld -> ovirtmanager.internaldomain.tld.
Is it possible to disable this behaviour and stay with ovirt.externaldomain.tld ?
Regards
-- COUSIN Kevin <kevin@famillecousin.fr>
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
Hi all If this is correct, it is a massive problem for us. We're still on RHEV v3.5 ATM but have plans to move to RHEV v4 when it looks production ready. Many of our users are external parties that access the RHEV user portal externally via a (Juniper) reverse proxy appliance. The RHEV user portal URL gets rewritten to the URL of the Juniper appliance. Should I file a bug on this, or an RFE? Thanks On Sun, Jul 3, 2016 at 5:16 PM, Martin Perina <mperina@redhat.com> wrote:
Hi, In 4.0 you can access oVirt engine only with the same FQDN that was specified during engine-setup. If you have used different FQDN, you may change it using ovirt-engine-rename tool.
Martin Perina
On Sunday, July 3, 2016, Yaniv Dary <ydary@redhat.com> wrote:
Yaniv Dary Technical Product Manager Red Hat Israel Ltd. 34 Jerusalem Road Building A, 4th floor Ra'anana, Israel 4350109
Tel : +972 (9) 7692306 8272306 Email: ydary@redhat.com IRC : ydary
---------- Forwarded message ---------- From: COUSIN Kevin <kevin@famillecousin.fr> Date: Thu, Jun 30, 2016 at 5:31 PM Subject: [ovirt-users] [oVirt 4.0] Is it possible to access oVirt
through a reverse proxy
To: users@ovirt.org
Hi list,
I upgraded to oVirt 4.0 and it works fine. However, I used HAProxy to access oVirt outside my LAN. It doesn't work anymore since I upgraded to 4.0. It seems the oVirt Manager URL is rewritten by the SSO engine. eg: ovirt.externaldomain.tld -> ovirtmanager.internaldomain.tld.
Is it possible to disable this behaviour and stay with ovirt.externaldomain.tld ?
Regards
-- COUSIN Kevin <kevin@famillecousin.fr>
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
RFE is the correct ticket type. Yaniv Dary Technical Product Manager Red Hat Israel Ltd. 34 Jerusalem Road Building A, 4th floor Ra'anana, Israel 4350109 Tel : +972 (9) 7692306 8272306 Email: ydary@redhat.com IRC : ydary On Jul 4, 2016 02:36, "Colin Coe" <colin.coe@gmail.com> wrote:
Hi all
If this is correct, it is a massive problem for us. We're still on RHEV v3.5 ATM but have plans to move to RHEV v4 when it looks production ready.
Many of our users are external parties that access the RHEV user portal externally via a (Juniper) reverse proxy appliance. The RHEV user portal URL gets rewritten to the URL of the Juniper appliance.
Should I file a bug on this, or an RFE?
Thanks
On Sun, Jul 3, 2016 at 5:16 PM, Martin Perina <mperina@redhat.com> wrote:
Hi, In 4.0 you can access oVirt engine only with the same FQDN that was specified during engine-setup. If you have used different FQDN, you may change it using ovirt-engine-rename tool.
Martin Perina
On Sunday, July 3, 2016, Yaniv Dary <ydary@redhat.com> wrote:
Yaniv Dary Technical Product Manager Red Hat Israel Ltd. 34 Jerusalem Road Building A, 4th floor Ra'anana, Israel 4350109
Tel : +972 (9) 7692306 8272306 Email: ydary@redhat.com IRC : ydary
---------- Forwarded message ---------- From: COUSIN Kevin <kevin@famillecousin.fr> Date: Thu, Jun 30, 2016 at 5:31 PM Subject: [ovirt-users] [oVirt 4.0] Is it possible to access oVirt
through a reverse proxy
To: users@ovirt.org
Hi list,
I upgraded to oVirt 4.0 and it works fine. However, I used HAProxy to access oVirt outside my LAN. It doesn't work anymore since I upgraded to 4.0. It seems the oVirt Manager URL is rewritten by the SSO engine. eg: ovirt.externaldomain.tld -> ovirtmanager.internaldomain.tld.
Is it possible to disable this behaviour and stay with ovirt.externaldomain.tld ?
Regards
-- COUSIN Kevin <kevin@famillecousin.fr>
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
Hi, first let me explain more thoroughly how things works in 4.0. Here's a bit simplified login flow: 1. Let's assume that ovirt.example.com was set as FQDN during engine-setup 2. User tries to access http://ovirt.example.com/ovirt-engine/webadmin 3. SSO authentication filters checks if user is authenticated and if not, user is redirected to https://ovirt.example.com/ovirt-engine/sso/login.html 4. User enters its username/password and if successfully authenticated, user is redirected back to original URL: http://ovirt.example.com/ovirt-engine/webadmin Here are installation use cases which we assumed to be mostly used for oVirt (let's assume that engine is installed at host1.example.com, your proxy host is proxy1.example.com and you want you oVirt instance to accessed using alias ovirt.example.com): 1. Most users don't use any proxy, so the easiest method is to setup DNS alias ovirt.example.com pointing to host1.example.com and after that use ovirt.example.com during engine-setup as engine FQDN 2. If host1.example.com is in your internal network and you want ovirt.example.com to be accessible from both internal network and Internet you need to do the following: - For you internal clients you need to do the same steps as in 1. in your internal DNS server - For your external (Internet) clients you need to create another DNS alias ovirt.example.com pointing to your firewall (for example to host firewall.example.com) in your external DNS server and setup proper port forwarding from firewall.example.com to host1.example.com 3. If you need to use different FQDN for engine (for example you want to use proxy proxy1.example.com), then some manual config is required: - Execute engine-setup and use host1.example.com as engine FQDN - Setup you proxy in proxy1.example.com as in previous versions - Setup your DNS and add DNS alias ovirt.example.com pointing to proxy1.example.com - Go to host1.example.com and create new file /etc/ovirt-engine/engine.conf.d/99-setup-http-proxy.conf with following content ENGINE_SSO_AUTH_URL=" https://ovirt.example.com:443/ovirt-engine/sso" SSO_CALLBACK_PREFIX_CHECK=false - Restart ovirt-engine service After above steps your oVirt instance can be accessed using http://ovirt.example.com, but all traffic to it will be redirected through your proxy at proxy1.example.com. If none of above scenarios are usable for you, then please describe thoroughly your current setup. We may be help you with additional manual configuration or we will need to create an RFE bug for oVirt. Thanks Martin Perina On Mon, Jul 4, 2016 at 1:36 AM, Colin Coe <colin.coe@gmail.com> wrote:
Hi all
If this is correct, it is a massive problem for us. We're still on RHEV v3.5 ATM but have plans to move to RHEV v4 when it looks production ready.
Many of our users are external parties that access the RHEV user portal externally via a (Juniper) reverse proxy appliance. The RHEV user portal URL gets rewritten to the URL of the Juniper appliance.
Should I file a bug on this, or an RFE?
Thanks
On Sun, Jul 3, 2016 at 5:16 PM, Martin Perina <mperina@redhat.com> wrote:
Hi, In 4.0 you can access oVirt engine only with the same FQDN that was specified during engine-setup. If you have used different FQDN, you may change it using ovirt-engine-rename tool.
Martin Perina
On Sunday, July 3, 2016, Yaniv Dary <ydary@redhat.com> wrote:
Yaniv Dary Technical Product Manager Red Hat Israel Ltd. 34 Jerusalem Road Building A, 4th floor Ra'anana, Israel 4350109
Tel : +972 (9) 7692306 8272306 Email: ydary@redhat.com IRC : ydary
---------- Forwarded message ---------- From: COUSIN Kevin <kevin@famillecousin.fr> Date: Thu, Jun 30, 2016 at 5:31 PM Subject: [ovirt-users] [oVirt 4.0] Is it possible to access oVirt
through a reverse proxy
To: users@ovirt.org
Hi list,
I upgraded to oVirt 4.0 and it works fine. However, I used HAProxy to access oVirt outside my LAN. It doesn't work anymore since I upgraded to 4.0. It seems the oVirt Manager URL is rewritten by the SSO engine. eg: ovirt.externaldomain.tld -> ovirtmanager.internaldomain.tld.
Is it possible to disable this behaviour and stay with ovirt.externaldomain.tld ?
Regards
-- COUSIN Kevin <kevin@famillecousin.fr>
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
Hi all I've logged case 01662585 with GSS. I see that RHEV 4.0 beta is in the customer support portal, I'm going to see if we can upgrade our current DEV RHEV environment to 4.0 BETA so we can start testing early. Thanks On Mon, Jul 4, 2016 at 5:39 PM, Martin Perina <mperina@redhat.com> wrote:
Hi,
first let me explain more thoroughly how things works in 4.0. Here's a bit simplified login flow:
1. Let's assume that ovirt.example.com was set as FQDN during engine-setup 2. User tries to access http://ovirt.example.com/ovirt-engine/webadmin 3. SSO authentication filters checks if user is authenticated and if not, user is redirected to https://ovirt.example.com/ovirt-engine/sso/login.html 4. User enters its username/password and if successfully authenticated, user is redirected back to original URL: http://ovirt.example.com/ovirt-engine/webadmin
Here are installation use cases which we assumed to be mostly used for oVirt (let's assume that engine is installed at host1.example.com, your proxy host is proxy1.example.com and you want you oVirt instance to accessed using alias ovirt.example.com):
1. Most users don't use any proxy, so the easiest method is to setup DNS alias ovirt.example.com pointing to host1.example.com and after that use ovirt.example.com during engine-setup as engine FQDN
2. If host1.example.com is in your internal network and you want ovirt.example.com to be accessible from both internal network and Internet you need to do the following: - For you internal clients you need to do the same steps as in 1. in your internal DNS server - For your external (Internet) clients you need to create another DNS alias ovirt.example.com pointing to your firewall (for example to host firewall.example.com) in your external DNS server and setup proper port forwarding from firewall.example.com to host1.example.com
3. If you need to use different FQDN for engine (for example you want to use proxy proxy1.example.com), then some manual config is required: - Execute engine-setup and use host1.example.com as engine FQDN - Setup you proxy in proxy1.example.com as in previous versions - Setup your DNS and add DNS alias ovirt.example.com pointing to proxy1.example.com - Go to host1.example.com and create new file /etc/ovirt-engine/engine.conf.d/99-setup-http-proxy.conf with following content ENGINE_SSO_AUTH_URL=" https://ovirt.example.com:443/ovirt-engine/sso" SSO_CALLBACK_PREFIX_CHECK=false
- Restart ovirt-engine service
After above steps your oVirt instance can be accessed using http://ovirt.example.com, but all traffic to it will be redirected through your proxy at proxy1.example.com.
If none of above scenarios are usable for you, then please describe thoroughly your current setup. We may be help you with additional manual configuration or we will need to create an RFE bug for oVirt.
Thanks
Martin Perina
On Mon, Jul 4, 2016 at 1:36 AM, Colin Coe <colin.coe@gmail.com> wrote:
Hi all
If this is correct, it is a massive problem for us. We're still on RHEV v3.5 ATM but have plans to move to RHEV v4 when it looks production ready.
Many of our users are external parties that access the RHEV user portal externally via a (Juniper) reverse proxy appliance. The RHEV user portal URL gets rewritten to the URL of the Juniper appliance.
Should I file a bug on this, or an RFE?
Thanks
On Sun, Jul 3, 2016 at 5:16 PM, Martin Perina <mperina@redhat.com> wrote:
Hi, In 4.0 you can access oVirt engine only with the same FQDN that was specified during engine-setup. If you have used different FQDN, you may change it using ovirt-engine-rename tool.
Martin Perina
On Sunday, July 3, 2016, Yaniv Dary <ydary@redhat.com> wrote:
Yaniv Dary Technical Product Manager Red Hat Israel Ltd. 34 Jerusalem Road Building A, 4th floor Ra'anana, Israel 4350109
Tel : +972 (9) 7692306 8272306 Email: ydary@redhat.com IRC : ydary
---------- Forwarded message ---------- From: COUSIN Kevin <kevin@famillecousin.fr> Date: Thu, Jun 30, 2016 at 5:31 PM Subject: [ovirt-users] [oVirt 4.0] Is it possible to access oVirt
through a reverse proxy
To: users@ovirt.org
Hi list,
I upgraded to oVirt 4.0 and it works fine. However, I used HAProxy to access oVirt outside my LAN. It doesn't work anymore since I upgraded to 4.0. It seems the oVirt Manager URL is rewritten by the SSO engine. eg: ovirt.externaldomain.tld -> ovirtmanager.internaldomain.tld.
Is it possible to disable this behaviour and stay with ovirt.externaldomain.tld ?
Regards
-- COUSIN Kevin <kevin@famillecousin.fr>
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
_______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users
participants (3)
-
Colin Coe -
Martin Perina -
Yaniv Dary