June 2020 - Users - oVirt List Archives

Re: KeyCloak Integration
by Artur Socha 23 Jun '20

23 Jun '20

Anton,I managed to re-create the issue on my local environment. Previously I tested it against Keycloak 8.0.1 with users loaded from LDAP. Currently I have users/groups created via Keycloak management panel. I need to investigate it further which of the two changes is the root cause (it works fine with the old setup)Artur On Mon, 2020-06-22 at 11:05 +0000, Anton Louw wrote: > > > > Hi Artur, > > Great, thanks a lot! > 😊 > > > > > > > Anton Louw > > > Cloud Engineer: Storage and Virtualization at Vox > > > > > > > T: 087 805 0000 | D: 087 805 1572 > M: N/A > > E: anton.louw(a)voxtelecom.co.za > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > Sent: 22 June 2020 11:23 > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org > > Cc: Stephen Hutchinson <Stephen.Hutchinson(a)voxtelecom.co.za> > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > Hi Anton, > > > Thanks for the specs. I have create BZ issue for tracking: > > > https://bugzilla.redhat.com/show_bug.cgi?id=1849569 > > > Feel free to add comments/change it when needed. > > > > > > Artur > > > > > > On Fri, 2020-06-19 at 10:57 +0000, Anton Louw wrote: > > > > > Hi Artur, > > > > Please see below: > > > > ovirt-engine.noarch 4.3.10.4-1.el7 @ovirt-4.3 > > ovirt-engine-extension-aaa-misc.noarch 1.0.4-1.el7 @ovirt-4.3 > > mod_auth_openidc.x86_64 1.8.8-5.el7 @base > > > > [root@virt ~]# cat /etc/*elease > > CentOS Linux release 7.7.1908 (Core) > > NAME="CentOS Linux" > > VERSION="7 (Core)" > > ID="centos" > > ID_LIKE="rhel fedora" > > VERSION_ID="7" > > PRETTY_NAME="CentOS Linux 7 (Core)" > > ANSI_COLOR="0;31" > > CPE_NAME="cpe:/o:centos:centos:7" > > HOME_URL="https://www.centos.org/" > > BUG_REPORT_URL="https://bugs.centos.org/" > > > > CENTOS_MANTISBT_PROJECT="CentOS-7" > > CENTOS_MANTISBT_PROJECT_VERSION="7" > > REDHAT_SUPPORT_PRODUCT="centos" > > REDHAT_SUPPORT_PRODUCT_VERSION="7" > > > > CentOS Linux release 7.7.1908 (Core) > > CentOS Linux release 7.7.1908 (Core) > > > > KeyCloak – > > > > > > > > > > > > > > Server Version > > > > > > > > 10.0.1 > > > > > > > > > > > > Thanks a lot for your help Artur. Please let me know if you need anything > > else. > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > > > Sent: 19 June 2020 12:39 > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > > users(a)ovirt.org > > > > Cc: Stephen Hutchinson <Stephen.Hutchinson(a)voxtelecom.co.za> > > > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > > > > > > On Fri, 2020-06-19 at 10:21 +0000, Anton Louw wrote: > > > > > > > > Yes I didn’t get to the OVN part yet, as I first wanted to test the if the > > > token can be obtained. > > > > > > This is the first time we are testing KeyCloak in any environment, so we > > > have never been able to obtain a token for API access. > > > > > > > > > Please post the exact versions of: > > > > > > - ovirt-engine* : > > > > > > yum list --installed | grep ovirt-engine > > > > > > yum list --intalled | grep > > ovirt-engine-extension-aaa-misc > > > > > > yum list --installed | grep > > mod_auth_openidc > > > > > > - keycloak > > > > > > - OS > > > > > > cat /etc/*elease > > > > > > > > > > > > I'll submit a bug ... which, most likely, I will assign to myself anyway :) > > > > > > > > > > > > Artur > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > T: > > 087 805 0000 | > > D: 087 805 1572 > > > > M: N/A > > > > E: > > anton.louw(a)voxtelecom.co.za > > > > A: Rutherford Estate, > > 1 Scott Street, Waverley, Johannesburg > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thanks > > > > > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > > > > > > Sent: 19 June 2020 12:16 > > > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > > > users(a)ovirt.org > > > > > > Cc: Stephen Hutchinson <Stephen.Hutchinson(a)voxtelecom.co.za> > > > > > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > > > > > > > > > > > On Fri, 2020-06-19 at 10:03 +0000, Anton Louw wrote: > > > > > > > > > > > Hi Artur, > > > > > > > > Sure, please see below output: > > > > > > > > [root@virt ~]# curl -vvv -H "Accept:application/json" ' > > > > https://virt.example.co.za/ovirt-engine/sso/oauth/token?grant_type=password…' > > > > * About to connect() to > > > > virt.example.co.za port 443 (#0) > > > > * Trying > > > > 127.0.0.1... > > > > * Connected to > > > > virt.example.co.za (127.0.0.1) port 443 (#0) > > > > * Initializing NSS with certpath: sql:/etc/pki/nssdb > > > > * CAfile: /etc/pki/tls/certs/ca-bundle.crt > > > > CApath: none > > > > * SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 > > > > * Server certificate: > > > > * subject: CN=*.example.co.za,OU=Domain Control Validated > > > > * start date: Sep 25 07:46:12 2019 GMT > > > > * expire date: Oct 02 07:39:01 2020 GMT > > > > * common name: *example.co.za > > > > * issuer: CN=Starfield Secure Certificate Authority - G2,OU= > > > > http://certs.starfieldtech.com/repository/,O="Starfield Technologies, > > > > Inc.",L=Scottsdale,ST=Arizona,C=US > > > > > GET /ovirt- > > > > engine/sso/oauth/token?grant_type=password&username=myuser&password=mypa > > > > ss&scope=ovirt-app-api HTTP/1.1 > > > > > User-Agent: curl/7.29.0 > > > > > Host: > > > > virt.example.co.za > > > > > Accept:application/json > > > > > > > > > < HTTP/1.1 400 Bad Request > > > > < Date: Fri, 19 Jun 2020 09:52:11 GMT > > > > < Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips > > > > < Set-Cookie: locale=en_US; path=/; secure; HttpOnly; Max- > > > > Age=2147483647; Expires=Wed, 07-Jul-2088 13:06:18 GMT > > > > < X-XSS-PROTECTION: 1; MODE=BLOCK > > > > < X-CONTENT-TYPE-OPTIONS: NOSNIFF > > > > < X-FRAME-OPTIONS: SAMEORIGIN > > > > < Content-Type: application/json > > > > < Content-Length: 233 > > > > < Connection: close > > > > < > > > > * Closing connection 0 > > > > {"error_code":"access_denied","error":"Cannot authenticate user Invalid > > > > scopes: ovirt-app-api ovirt-ext=token-info:authz-search ovirt-ext=token- > > > > info:public-authz-search ovirt-ext=token-info:validate ovirt- > > > > ext=token:password-access."} > > > > > > > > 1) Test connection using python script (from the blog post ) using sdk. > > > > I suspect it will not work either. > > > > Testing from Python gives me the same error as well. > > > > > > > > 2) I saw some errors in the log on revoking token. Please go to keycloak > > > > admin panel, and under users kill all its active sessions. Then, please > > > > without logging in to engine admin UI, use that curl > > > > to obtain token. > > > > Tested this again, but still getting the below: > > > > {"error_code":"access_denied","error":"Cannot authenticate user Invalid > > > > scopes: ovirt-app-api ovirt-ext=token-info:authz-search ovirt-ext=token- > > > > info:public-authz-search ovirt-ext=token-info:validate > > > > ovirt-ext=token:password-access."} > > > > > > > > > > Thanks for these test ... unfortunately nothing helped > > > > > > > > > > > > > > > > > > > > > > > > > 3) Does it work without OVN integration enabled? > > > > Can you explain a bit more? How can I disable OVN integration to test > > > > this? > > > > > > > > > > > > > > > I had in mind reverting OVN vs Keycloak integration done according to > > > "Configuring OVN" chapter in > > > > > > https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope… > > > > > > > > > > > > Unless, of course, you skipped it. > > > > > > > > > > > > > > > > > > > > > Most likely you found a bug. Have you ever been able to obtain token for > > > api access with keycloak integration (even with you previous > > > environments)? > > > > > > > > > I am now trying to understand what happened and how to reproduce it before > > > submitting the bug into > > > > > > http://bugzilla.redhat.com > > > > > > > > > > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > T: > > > 087 805 0000 | > > > D: 087 805 1572 > > > > > > M: N/A > > > > > > E: > > > anton.louw(a)voxtelecom.co.za > > > > > > A: Rutherford Estate, > > > 1 Scott Street, Waverley, Johannesburg > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thanks > > > > > > > > > > > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > T: > > > > 087 805 0000 | > > > > D: 087 805 1572 > > > > > > > > M: N/A > > > > > > > > E: > > > > anton.louw(a)voxtelecom.co.za > > > > > > > > A: Rutherford Estate, > > > > 1 Scott Street, Waverley, Johannesburg > > > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > > > > > > > > > Sent: 19 June 2020 11:40 > > > > > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > > > > users(a)ovirt.org > > > > > > > > Cc: Stephen Hutchinson <Stephen.Hutchinson(a)voxtelecom.co.za> > > > > > > > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > > > > > > > > > > > > > > > > On Fri, 2020-06-19 at 08:34 +0000, Anton Louw wrote: > > > > > > > > > > > > > > Hi Artur, > > > > > > > > > > Thank you for the quick response. > > > > > > > > > > I have actually tried creating another user, but I still get the same > > > > > error. I have attached the output of curl -vvv as well as the logs the > > > > > engine and keycloak logs. > > > > > > > > > > > > > > > > > > > > This `curl -vvv ...` is actually is incorrect because it is missing -H > > > > before 'Accept' header. However, previous attempts that led to this > > > > error seemed to be fine. Could you just re-send output of > > > > the correct curl? > > > > > > > > > > > > > > > > > > > > > > > > There are few things we can test to try to narrow down the root cause: > > > > > > > > > > > > > > > > > > > > > > > > 1) Test connection using python script (from the blog post ) using sdk. > > > > I suspect it will not work either. > > > > > > > > > > > > > > > > > > > > > > > > 2) I saw some errors in the log on revoking token. Please go to keycloak > > > > admin panel, and under users kill all its active sessions. Then, please > > > > without logging in to engine admin UI, use that curl > > > > to obtain token. > > > > > > > > > > > > > > > > > > > > > > > > 3) Does it work without OVN integration enabled? > > > > > > > > > > > > > > > > > > > > > > > > Artur > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thank you > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > > > > > > > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > > > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > T: > > > > > 087 805 0000 | > > > > > D: 087 805 1572 > > > > > > > > > > M: N/A > > > > > > > > > > E: > > > > > anton.louw(a)voxtelecom.co.za > > > > > > > > > > A: Rutherford Estate, > > > > > 1 Scott Street, Waverley, Johannesburg > > > > > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > > > > > > > > > > > > Sent: 19 June 2020 10:23 > > > > > > > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > > > > > users(a)ovirt.org > > > > > > > > > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > > > > > > > > > > > > > > > > > > > > > O > > > > > > > > > > > > > > > n Fri, 2020-06-19 at 07:35 +0000, Anton Louw via Users wrote: > > > > > > > > > > > > > > > > > Hi Everybody, > > > > > > > > > > > > > > > > > > > > > > > > > Hi Anton, > > > > > > > > > > > > > > > > > So I have implemented KeyCloak into our oVirt environment, which > > > > > > works, up until a point. So WebUI access works, but when calling the > > > > > > API, using: > > > > > > > > > > > > curl -k -H "Accept: application/json" ' > > > > > > https://virt.example.co.za/ovirt-engine/sso/oauth/token?grant_type=password…' > > > > > > > > > > > > I get the below error: > > > > > > > > > > > > {"error_description":"Cannot authenticate user Invalid scopes: > > > > > > ovirt-app-api ovirt-ext=revoke:revoke-all ovirt-ext=token- > > > > > > info:authz-search ovirt-ext=token-info:public-authz-search ovirt- > > > > > > ext=token-info:validate ovirt-ext=token:password- > > > > > > access.","error":"access_denied"} > > > > > > > > > > > > If my configs are removed, and I use “admin@internal” for my > > > > > > username, then it works. > > > > > > > > > > > > I followed the below article step by step, and I double checked that > > > > > > all the scopes are added into KeyCloak (ovirt-app-api and ovirt-app- > > > > > > admin) > > > > > > > > > > > > > > > > > > https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope… > > > > > > > > > > > > Anybody have any ideas? > > > > > > > > > > > > > > > > > > > > > > > > > It is my blind shot but could create & check another user? > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > One more thing to check please use curl -vvv to check if there are any > > > > > redirects along the way. > > > > > > > > > > > > > > > > > > > > I will check keycloak settings on my setup - perhaps there is > > > > > something non-obvious that could have been missed. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Any chance to get a bit more logs from engine.log and even from > > > > > keycloak? Perhaps there is something there that could help. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Artur > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thank you > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > > > > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > T: > > > > > > 087 805 0000 | > > > > > > D: 087 805 1572 > > > > > > > > > > > > M: N/A > > > > > > > > > > > > E: > > > > > > anton.louw(a)voxtelecom.co.za > > > > > > > > > > > > A: Rutherford Estate, > > > > > > 1 Scott Street, Waverley, Johannesburg > > > > > > > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Disclaimer > > > > > > The contents of this email are confidential to the sender and the > > > > > > intended recipient. Unless the contents are clearly and entirely of > > > > > > a personal nature, they are subject to copyright > > > > > > in favour of the holding company of the Vox group of companies. Any > > > > > > recipient who receives this email in error should immediately report > > > > > > the error to the sender and permanently delete this email from all > > > > > > storage devices. > > > > > > > > > > > > > > > > > > > > > > > > This email has been scanned for viruses and malware, and may have > > > > > > been automatically archived by > > > > > > Mimecast Ltd, an innovator in Software as a Service (SaaS) for > > > > > > business. Providing a > > > > > > safer and more useful place for your human generated data. > > > > > > Specializing in; Security, archiving and compliance. To find out > > > > > > more > > > > > > Click Here. > > > > > > > > > > > > _______________________________________________ > > > > > > Users mailing list -- > > > > > > > > > > > > users(a)ovirt.org > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > To unsubscribe send an email to > > > > > > > > > > > > users-leave(a)ovirt.org > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Privacy Statement: > > > > > > > > > > > > https://www.ovirt.org/privacy-policy.html > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > oVirt Code of Conduct: > > > > > > > > > > > > https://www.ovirt.org/community/about/community-guidelines/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > List Archives: > > > > > > > > > > > > https://lists.ovirt.org/archives/list/users@ovirt.org/message/CC54IPZLYJYE2… > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

2 2

cloud-init: reverts on reboot
by Jp 23 Jun '20

23 Jun '20

cloud-init settings entered into Hosted Engine are reverting after reboot, so what's the correct workflow for using the UI form? I'd like a workflow where I can: 1. start with Template (covers most settings) 2. create VM 3. use cloud-init in the UI (for a few settings, like static IP) 4. start/reboot VM and have cloud-init settings stick How is the above possible?

5 9

Change Hosted engine VM cluster compatibility version throws error
by Ritesh Chikatwar 23 Jun '20

23 Jun '20

Hello Team, When i try to change Cluster compatible version HE it throws error As Error while executing action: HostedEngine: - There was an attempt to change Hosted Engine VM values that are locked. I am trying to change the version to 4.4 it was showing blank. Any suggestions on how I can edit. The VM other than HE is able to editi. *Ritesh*

3 6

ovirt/rhev grafana
by Markus Schaufler 22 Jun '20

22 Jun '20

Hi! I've got an existing Grafana installation and would like to integrate our ovirt/rhev infrastructure. How could I do that? Thanks for any advice, Markus

2 1

Re: KeyCloak Integration
by Artur Socha 22 Jun '20

22 Jun '20

Hi Anton,Thanks for the specs. I have create BZ issue for tracking: https://bugzilla.redhat.com/show_bug.cgi?id=1849569Feel free to add comments/change it when needed. Artur On Fri, 2020-06-19 at 10:57 +0000, Anton Louw wrote: > > > > Hi Artur, > > Please see below: > > ovirt-engine.noarch 4.3.10.4-1.el7 @ovirt-4.3 > ovirt-engine-extension-aaa-misc.noarch 1.0.4-1.el7 @ovirt-4.3 > mod_auth_openidc.x86_64 1.8.8-5.el7 @base > > [root@virt ~]# cat /etc/*elease > CentOS Linux release 7.7.1908 (Core) > NAME="CentOS Linux" > VERSION="7 (Core)" > ID="centos" > ID_LIKE="rhel fedora" > VERSION_ID="7" > PRETTY_NAME="CentOS Linux 7 (Core)" > ANSI_COLOR="0;31" > CPE_NAME="cpe:/o:centos:centos:7" > HOME_URL="https://www.centos.org/" > BUG_REPORT_URL="https://bugs.centos.org/" > > CENTOS_MANTISBT_PROJECT="CentOS-7" > CENTOS_MANTISBT_PROJECT_VERSION="7" > REDHAT_SUPPORT_PRODUCT="centos" > REDHAT_SUPPORT_PRODUCT_VERSION="7" > > CentOS Linux release 7.7.1908 (Core) > CentOS Linux release 7.7.1908 (Core) > > KeyCloak – > > > > > > > Server Version > > > > 10.0.1 > > > > > > Thanks a lot for your help Artur. Please let me know if you need anything > else. > > > > From: Artur Socha <asocha(a)redhat.com> > > > Sent: 19 June 2020 12:39 > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; users(a)ovirt.org > > Cc: Stephen Hutchinson <Stephen.Hutchinson(a)voxtelecom.co.za> > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > On Fri, 2020-06-19 at 10:21 +0000, Anton Louw wrote: > > > > > Yes I didn’t get to the OVN part yet, as I first wanted to test the if the > > token can be obtained. > > > > This is the first time we are testing KeyCloak in any environment, so we > > have never been able to obtain a token for API access. > > > > > Please post the exact versions of: > > > - ovirt-engine* : > > > yum list --installed | grep ovirt-engine > > > yum list --intalled | grep > ovirt-engine-extension-aaa-misc > > > yum list --installed | grep > mod_auth_openidc > > > - keycloak > > > - OS > > > cat /etc/*elease > > > > > > I'll submit a bug ... which, most likely, I will assign to myself anyway :) > > > > > > Artur > > > > > > > > > Anton Louw > > > Cloud Engineer: Storage and Virtualization at Vox > > > > > > > T: 087 805 0000 | D: 087 805 1572 > M: N/A > > E: anton.louw(a)voxtelecom.co.za > A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > Thanks > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > > > Sent: 19 June 2020 12:16 > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > > users(a)ovirt.org > > > > Cc: Stephen Hutchinson <Stephen.Hutchinson(a)voxtelecom.co.za> > > > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > > > > > > On Fri, 2020-06-19 at 10:03 +0000, Anton Louw wrote: > > > > > > > > Hi Artur, > > > > > > Sure, please see below output: > > > > > > [root@virt ~]# curl -vvv -H "Accept:application/json" ' > > > https://virt.example.co.za/ovirt-engine/sso/oauth/token?grant_type=password…' > > > * About to connect() to > > > virt.example.co.za port 443 (#0) > > > * Trying > > > 127.0.0.1... > > > * Connected to > > > virt.example.co.za (127.0.0.1) port 443 (#0) > > > * Initializing NSS with certpath: sql:/etc/pki/nssdb > > > * CAfile: /etc/pki/tls/certs/ca-bundle.crt > > > CApath: none > > > * SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 > > > * Server certificate: > > > * subject: CN=*.example.co.za,OU=Domain Control Validated > > > * start date: Sep 25 07:46:12 2019 GMT > > > * expire date: Oct 02 07:39:01 2020 GMT > > > * common name: *example.co.za > > > * issuer: CN=Starfield Secure Certificate Authority - G2,OU= > > > http://certs.starfieldtech.com/repository/,O="Starfield Technologies, > > > Inc.",L=Scottsdale,ST=Arizona,C=US > > > > GET /ovirt- > > > engine/sso/oauth/token?grant_type=password&username=myuser&password=mypass > > > &scope=ovirt-app-api HTTP/1.1 > > > > User-Agent: curl/7.29.0 > > > > Host: > > > virt.example.co.za > > > > Accept:application/json > > > > > > > < HTTP/1.1 400 Bad Request > > > < Date: Fri, 19 Jun 2020 09:52:11 GMT > > > < Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips > > > < Set-Cookie: locale=en_US; path=/; secure; HttpOnly; Max-Age=2147483647; > > > Expires=Wed, 07-Jul-2088 13:06:18 GMT > > > < X-XSS-PROTECTION: 1; MODE=BLOCK > > > < X-CONTENT-TYPE-OPTIONS: NOSNIFF > > > < X-FRAME-OPTIONS: SAMEORIGIN > > > < Content-Type: application/json > > > < Content-Length: 233 > > > < Connection: close > > > < > > > * Closing connection 0 > > > {"error_code":"access_denied","error":"Cannot authenticate user Invalid > > > scopes: ovirt-app-api ovirt-ext=token-info:authz-search ovirt-ext=token- > > > info:public-authz-search ovirt-ext=token-info:validate ovirt- > > > ext=token:password-access."} > > > > > > 1) Test connection using python script (from the blog post ) using sdk. I > > > suspect it will not work either. > > > Testing from Python gives me the same error as well. > > > > > > 2) I saw some errors in the log on revoking token. Please go to keycloak > > > admin panel, and under users kill all its active sessions. Then, please > > > without logging in to engine admin UI, use that curl > > > to obtain token. > > > Tested this again, but still getting the below: > > > {"error_code":"access_denied","error":"Cannot authenticate user Invalid > > > scopes: ovirt-app-api ovirt-ext=token-info:authz-search ovirt-ext=token- > > > info:public-authz-search ovirt-ext=token-info:validate > > > ovirt-ext=token:password-access."} > > > > > > > Thanks for these test ... unfortunately nothing helped > > > > > > > > > > > > > > > > > 3) Does it work without OVN integration enabled? > > > Can you explain a bit more? How can I disable OVN integration to test > > > this? > > > > > > > > > > I had in mind reverting OVN vs Keycloak integration done according to > > "Configuring OVN" chapter in > > > > https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope… > > > > > > > > Unless, of course, you skipped it. > > > > > > > > > > > > > > Most likely you found a bug. Have you ever been able to obtain token for api > > access with keycloak integration (even with you previous environments)? > > > > > > I am now trying to understand what happened and how to reproduce it before > > submitting the bug into > > > > http://bugzilla.redhat.com > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > T: > > 087 805 0000 | > > D: 087 805 1572 > > > > M: N/A > > > > E: > > anton.louw(a)voxtelecom.co.za > > > > A: Rutherford Estate, > > 1 Scott Street, Waverley, Johannesburg > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thanks > > > > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > T: > > > 087 805 0000 | > > > D: 087 805 1572 > > > > > > M: N/A > > > > > > E: > > > anton.louw(a)voxtelecom.co.za > > > > > > A: Rutherford Estate, > > > 1 Scott Street, Waverley, Johannesburg > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > > > > > > Sent: 19 June 2020 11:40 > > > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > > > users(a)ovirt.org > > > > > > Cc: Stephen Hutchinson <Stephen.Hutchinson(a)voxtelecom.co.za> > > > > > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > > > > > > > > > > > On Fri, 2020-06-19 at 08:34 +0000, Anton Louw wrote: > > > > > > > > > > > Hi Artur, > > > > > > > > Thank you for the quick response. > > > > > > > > I have actually tried creating another user, but I still get the same > > > > error. I have attached the output of curl -vvv as well as the logs the > > > > engine and keycloak logs. > > > > > > > > > > > > > > > This `curl -vvv ...` is actually is incorrect because it is missing -H > > > before 'Accept' header. However, previous attempts that led to this error > > > seemed to be fine. Could you just re-send output of > > > the correct curl? > > > > > > > > > > > > > > > > > > There are few things we can test to try to narrow down the root cause: > > > > > > > > > > > > > > > > > > 1) Test connection using python script (from the blog post ) using sdk. I > > > suspect it will not work either. > > > > > > > > > > > > > > > > > > 2) I saw some errors in the log on revoking token. Please go to keycloak > > > admin panel, and under users kill all its active sessions. Then, please > > > without logging in to engine admin UI, use that curl > > > to obtain token. > > > > > > > > > > > > > > > > > > 3) Does it work without OVN integration enabled? > > > > > > > > > > > > > > > > > > Artur > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Thank you > > > > > > > > > > > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > T: > > > > 087 805 0000 | > > > > D: 087 805 1572 > > > > > > > > M: N/A > > > > > > > > E: > > > > anton.louw(a)voxtelecom.co.za > > > > > > > > A: Rutherford Estate, > > > > 1 Scott Street, Waverley, Johannesburg > > > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > From: Artur Socha <asocha(a)redhat.com> > > > > > > > > > > > > Sent: 19 June 2020 10:23 > > > > > > > > To: Anton Louw <Anton.Louw(a)voxtelecom.co.za>; > > > > users(a)ovirt.org > > > > > > > > Subject: Re: [ovirt-users] KeyCloak Integration > > > > > > > > > > > > > > > > > > > > O > > > > > > > > > > > > n Fri, 2020-06-19 at 07:35 +0000, Anton Louw via Users wrote: > > > > > > > > > > > > > > Hi Everybody, > > > > > > > > > > > > > > > > > > > > Hi Anton, > > > > > > > > > > > > > > So I have implemented KeyCloak into our oVirt environment, which > > > > > works, up until a point. So WebUI access works, but when calling the > > > > > API, using: > > > > > > > > > > curl -k -H "Accept: application/json" ' > > > > > https://virt.example.co.za/ovirt-engine/sso/oauth/token?grant_type=password…' > > > > > > > > > > I get the below error: > > > > > > > > > > {"error_description":"Cannot authenticate user Invalid scopes: ovirt- > > > > > app-api ovirt-ext=revoke:revoke-all ovirt-ext=token-info:authz-search > > > > > ovirt-ext=token-info:public-authz-search ovirt-ext=token-info:validate > > > > > ovirt-ext=token:password-access.","error":"access_denied"} > > > > > > > > > > If my configs are removed, and I use “admin@internal” for my username, > > > > > then it works. > > > > > > > > > > I followed the below article step by step, and I double checked that > > > > > all the scopes are added into KeyCloak (ovirt-app-api and ovirt-app- > > > > > admin) > > > > > > > > > > > > > > > https://blogs.ovirt.org/2019/01/federate-ovirt-engine-authentication-to-ope… > > > > > > > > > > Anybody have any ideas? > > > > > > > > > > > > > > > > > > > > It is my blind shot but could create & check another user? > > > > > > > > > > > > > > > > > > > > > > > > One more thing to check please use curl -vvv to check if there are any > > > > redirects along the way. > > > > > > > > > > > > > > > > I will check keycloak settings on my setup - perhaps there is something > > > > non-obvious that could have been missed. > > > > > > > > > > > > > > > > > > > > > > > > Any chance to get a bit more logs from engine.log and even from > > > > keycloak? Perhaps there is something there that could help. > > > > > > > > > > > > > > > > > > > > > > > > Artur > > > > > > > > > > > > > > > > > > > > > > > > > > Thank you > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Anton Louw > > > > > > > > > > > > > > > > > > > > > > > > > Cloud Engineer: Storage and Virtualization > > > > > at Vox > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > T: > > > > > 087 805 0000 | > > > > > D: 087 805 1572 > > > > > > > > > > M: N/A > > > > > > > > > > E: > > > > > anton.louw(a)voxtelecom.co.za > > > > > > > > > > A: Rutherford Estate, > > > > > 1 Scott Street, Waverley, Johannesburg > > > > > > > > > > www.vox.co.za > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Disclaimer > > > > > The contents of this email are confidential to the sender and the > > > > > intended recipient. Unless the contents are clearly and entirely of a > > > > > personal nature, they are subject to copyright > > > > > in favour of the holding company of the Vox group of companies. Any > > > > > recipient who receives this email in error should immediately report > > > > > the error to the sender and permanently delete this email from all > > > > > storage devices. > > > > > > > > > > > > > > > > > > > > This email has been scanned for viruses and malware, and may have been > > > > > automatically archived by > > > > > Mimecast Ltd, an innovator in Software as a Service (SaaS) for > > > > > business. Providing a > > > > > safer and more useful place for your human generated data. > > > > > Specializing in; Security, archiving and compliance. To find out more > > > > > Click Here. > > > > > > > > > > _______________________________________________ > > > > > Users mailing list -- > > > > > > > > > > users(a)ovirt.org > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > To unsubscribe send an email to > > > > > > > > > > users-leave(a)ovirt.org > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > Privacy Statement: > > > > > > > > > > https://www.ovirt.org/privacy-policy.html > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > oVirt Code of Conduct: > > > > > > > > > > https://www.ovirt.org/community/about/community-guidelines/ > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > List Archives: > > > > > > > > > > https://lists.ovirt.org/archives/list/users@ovirt.org/message/CC54IPZLYJYE2… > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >

2 1

Re: oVirt noVNC
by Strahil Nikolov 22 Jun '20

22 Jun '20

It's the client's browser settings , but I think it's easier to either change the certificate to something that will be trusted, or to just import it. Best Regards, Strahil Nikolov На 22 юни 2020 г. 11:29:20 GMT+03:00, Anton Louw via Users <users(a)ovirt.org> написа: >Hi All, > >So I managed to get the noVNC console to work. The last item I am still >struggling with however is to open the console without importing the CA >certificate from the below screen: > >[cid:image001.png@01D6487F.FC012BF0] > >Anybody have any idea what settings I can change for the console to >display without first importing the CA cert? > >Thanks > > >Anton Louw >Cloud Engineer: Storage and Virtualization >______________________________________ >D: 087 805 1572 | M: N/A >A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg >anton.louw(a)voxtelecom.co.za > >www.vox.co.za > > > >From: Anton Louw via Users <users(a)ovirt.org> >Sent: 17 June 2020 06:58 >To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk>; users(a)ovirt.org >Subject: [ovirt-users] Re: oVirt noVNC > > >Hi Paul, > >Apologies for the late response. > >So we only have a cert bundle on the one that is currently not working. >The env that is working still has all the default certs. > >Thanks > > >Anton Louw >Cloud Engineer: Storage and Virtualization at Vox >________________________________ >T: 087 805 0000 | D: 087 805 1572 >M: N/A >E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> >A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg >www.vox.co.za<http://www.vox.co.za> > >[F]<https://www.facebook.com/voxtelecomZA> > >[T]<https://www.twitter.com/voxtelecom> > >[I]<https://www.instagram.com/voxtelecomza> > >[L]<https://www.linkedin.com/company/voxtelecom> > >[Y]<https://www.youtube.com/user/VoxTelecom> > > >From: Staniforth, Paul ><P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> >Sent: 12 June 2020 13:13 >To: Anton Louw ><Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; >users(a)ovirt.org<mailto:users@ovirt.org> >Subject: Re: oVirt noVNC > >Sorry Anton, > I'm trying to get a lot of things sorted before the weekend. > >This seems the wrong way round, if you follow the documentation you >shouldn't have the symbolic link on the working system unless you >replaced the file it was pointing to. > >Do you have certificate bundles for both systems? > >Regards, > Paul S. > >________________________________ >From: Anton Louw ><Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> >Sent: 12 June 2020 11:44 >To: Staniforth, Paul ><P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; >users(a)ovirt.org<mailto:users@ovirt.org> ><users(a)ovirt.org<mailto:users@ovirt.org>> >Subject: RE: oVirt noVNC > > >Caution External Mail: Do not click any links or open any attachments >unless you trust the sender and know that the content is safe. > > >Thanks Paul, > > > >So the symbolic link has then been removed, as per the below. Not quite >sure where to go from here. > > > >Anton Louw >Cloud Engineer: Storage and Virtualization at Vox >________________________________ >T: 087 805 0000 | D: 087 805 1572 >M: N/A >E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> >A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg >www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> > >[F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> > >[T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> > >[I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> > >[L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> > >[Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> > > > >From: Staniforth, Paul ><P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> >Sent: 12 June 2020 12:30 >To: Anton Louw ><Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; >users(a)ovirt.org<mailto:users@ovirt.org> >Subject: Re: oVirt noVNC > > > >Yes Anton, > > I think it's in the documentation it's > > > >Steps 2 & 3 > >• > >• The Engine has been configured to use >/etc/pki/ovirt-engine/apache-ca.pem, which is symbolically linked to >/etc/pki/ovirt-engine/ca.pem. Remove the symbolic link. > > # rm /etc/pki/ovirt-engine/apache-ca.pem > >• Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem. > > # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem > >Regards, > > Paul S. > >________________________________ > >From: Anton Louw ><Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> >Sent: 12 June 2020 11:06 >To: Staniforth, Paul ><P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; >users(a)ovirt.org<mailto:users@ovirt.org> ><users(a)ovirt.org<mailto:users@ovirt.org>> >Subject: RE: oVirt noVNC > > > >Caution External Mail: Do not click any links or open any attachments >unless you trust the sender and know that the content is safe. > > > >Hi Paul, > > > >Double checked the permissions as well. All seems to be fine. The only >thing that does look different between the environments are the below: > > > >ENV1 (Not working) > >[cid:image007.png@01D6487F.FC012BF0] > > > >ENV2 (Working) > > > >[cid:image008.png@01D6487F.FC012BF0] > > > >It seems that on the working environment, there is a shortcut file >(apached-ca.pem) which points to the ca.pem file, but on the >environment that is not working, the apache-ca.pem file is not a >shortcut. Could this perhaps be an issue? > > > >Thanks > > > > > >Anton Louw > >Cloud Engineer: Storage and Virtualization at Vox > >________________________________ > >T: 087 805 0000 | D: 087 805 1572 >M: N/A >E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> >A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg >www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> > > > >[F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> > > > >[T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> > > > >[I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> > > > >[L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> > > > >[Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> > > > > > >From: Staniforth, Paul ><P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> >Sent: 12 June 2020 10:44 >To: Anton Louw ><Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; >users(a)ovirt.org<mailto:users@ovirt.org> >Subject: Re: oVirt noVNC > > > > > >No worries, > > If all is pointing to the correct files I would check permissions. > > > > > >Regards, > > Paul S. > > > >________________________________ > >From: Anton Louw ><Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> >Sent: 12 June 2020 09:34 >To: Staniforth, Paul ><P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; >users(a)ovirt.org<mailto:users@ovirt.org> ><users(a)ovirt.org<mailto:users@ovirt.org>> >Subject: RE: oVirt noVNC > > > >Caution External Mail: Do not click any links or open any attachments >unless you trust the sender and know that the content is safe. > > > >Hi Paul, > > > >Thanks for the reply. Apologies, I should have added that I have >installed our own certificates. The main problem I am facing is that >the noVNC console just refuses to open, I get the attached error with >any VM I try and access. I should have perhaps started with this issue >in my first mail, apologies 😊 > > > >Thanks > > > > > >Anton Louw > >Cloud Engineer: Storage and Virtualization at Vox > >________________________________ > >T: 087 805 0000 | D: 087 805 1572 >M: N/A >E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> >A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg >www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> > > > >[F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> > > > >[T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> > > > >[I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> > > > >[L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> > > > >[Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> > > > > > >From: Staniforth, Paul ><P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> >Sent: 12 June 2020 10:29 >To: users(a)ovirt.org<mailto:users@ovirt.org>; Anton Louw ><Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> >Subject: Re: oVirt noVNC > > > >Hello Anton, > >if your organisation has it's own CA you can install your own >certificates or get certificates from a trusted CA. > > > > > >https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> > > > > > > > >Paul S. > > > >________________________________ > >From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> >Sent: 12 June 2020 08:56 >To: users(a)ovirt.org<mailto:users@ovirt.org> ><users(a)ovirt.org<mailto:users@ovirt.org>> >Subject: [ovirt-users] oVirt noVNC > > > >Caution External Mail: Do not click any links or open any attachments >unless you trust the sender and know that the content is safe. > > > >Hi Everybody, > > > >With regards to noVNC, is it a requirement to install the CA into your >local browser? I would like users to access their VM console, but with >no additional work from their side, ie. Downloading the CA and >importing it. > > > >Thank you > > > >Anton Louw > >Cloud Engineer: Storage and Virtualization at Vox > >________________________________ > >T: 087 805 0000 | D: 087 805 1572 >M: N/A >E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> >A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg >www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> > > > >[F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> > > > >[T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> > > > >[I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> > > > >[L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> > > > >[Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> > > > > > >[#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> > >Disclaimer > >The contents of this email are confidential to the sender and the >intended recipient. Unless the contents are clearly and entirely of a >personal nature, they are subject to copyright in favour of the holding >company of the Vox group of companies. Any recipient who receives this >email in error should immediately report the error to the sender and >permanently delete this email from all storage devices. > >This email has been scanned for viruses and malware, and may have been >automatically archived by Mimecast Ltd, an innovator in Software as a >Service (SaaS) for business. Providing a safer and more useful place >for your human generated data. Specializing in; Security, archiving and >compliance. To find out more Click >Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. > > > >To view the terms under which this email is distributed, please go to:- >http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> > > > >To view the terms under which this email is distributed, please go to:- >http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> > > > >To view the terms under which this email is distributed, please go to:- >http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> > >To view the terms under which this email is distributed, please go to:- >http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/>

2 1

Re: oVirt noVNC
by Anton Louw 22 Jun '20

22 Jun '20

Hi All, So I managed to get the noVNC console to work. The last item I am still struggling with however is to open the console without importing the CA certificate from the below screen: [cid:image001.png@01D6487F.FC012BF0] Anybody have any idea what settings I can change for the console to display without first importing the CA cert? Thanks Anton Louw Cloud Engineer: Storage and Virtualization ______________________________________ D: 087 805 1572 | M: N/A A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg anton.louw(a)voxtelecom.co.za www.vox.co.za From: Anton Louw via Users <users(a)ovirt.org> Sent: 17 June 2020 06:58 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk>; users(a)ovirt.org Subject: [ovirt-users] Re: oVirt noVNC Hi Paul, Apologies for the late response. So we only have a cert bundle on the one that is currently not working. The env that is working still has all the default certs. Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<http://www.vox.co.za> [F]<https://www.facebook.com/voxtelecomZA> [T]<https://www.twitter.com/voxtelecom> [I]<https://www.instagram.com/voxtelecomza> [L]<https://www.linkedin.com/company/voxtelecom> [Y]<https://www.youtube.com/user/VoxTelecom> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 13:13 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; users(a)ovirt.org<mailto:users@ovirt.org> Subject: Re: oVirt noVNC Sorry Anton, I'm trying to get a lot of things sorted before the weekend. This seems the wrong way round, if you follow the documentation you shouldn't have the symbolic link on the working system unless you replaced the file it was pointing to. Do you have certificate bundles for both systems? Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 11:44 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Thanks Paul, So the symbolic link has then been removed, as per the below. Not quite sure where to go from here. Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 12:30 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; users(a)ovirt.org<mailto:users@ovirt.org> Subject: Re: oVirt noVNC Yes Anton, I think it's in the documentation it's Steps 2 & 3 • • The Engine has been configured to use /etc/pki/ovirt-engine/apache-ca.pem, which is symbolically linked to /etc/pki/ovirt-engine/ca.pem. Remove the symbolic link. # rm /etc/pki/ovirt-engine/apache-ca.pem • Save your CA certificate as /etc/pki/ovirt-engine/apache-ca.pem. # cp /tmp/3rd-party-ca-cert.pem /etc/pki/ovirt-engine/apache-ca.pem Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 11:06 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Double checked the permissions as well. All seems to be fine. The only thing that does look different between the environments are the below: ENV1 (Not working) [cid:image007.png@01D6487F.FC012BF0] ENV2 (Working) [cid:image008.png@01D6487F.FC012BF0] It seems that on the working environment, there is a shortcut file (apached-ca.pem) which points to the ca.pem file, but on the environment that is not working, the apache-ca.pem file is not a shortcut. Could this perhaps be an issue? Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:44 To: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>>; users(a)ovirt.org<mailto:users@ovirt.org> Subject: Re: oVirt noVNC No worries, If all is pointing to the correct files I would check permissions. Regards, Paul S. ________________________________ From: Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Sent: 12 June 2020 09:34 To: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>>; users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: RE: oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Paul, Thanks for the reply. Apologies, I should have added that I have installed our own certificates. The main problem I am facing is that the noVNC console just refuses to open, I get the attached error with any VM I try and access. I should have perhaps started with this issue in my first mail, apologies 😊 Thanks Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> From: Staniforth, Paul <P.Staniforth(a)leedsbeckett.ac.uk<mailto:P.Staniforth@leedsbeckett.ac.uk>> Sent: 12 June 2020 10:29 To: users(a)ovirt.org<mailto:users@ovirt.org>; Anton Louw <Anton.Louw(a)voxtelecom.co.za<mailto:Anton.Louw@voxtelecom.co.za>> Subject: Re: oVirt noVNC Hello Anton, if your organisation has it's own CA you can install your own certificates or get certificates from a trusted CA. https://www.ovirt.org/documentation/admin-guide/appe-oVirt_and_SSL.html<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ovirt…> Paul S. ________________________________ From: Anton Louw via Users <users(a)ovirt.org<mailto:users@ovirt.org>> Sent: 12 June 2020 08:56 To: users(a)ovirt.org<mailto:users@ovirt.org> <users(a)ovirt.org<mailto:users@ovirt.org>> Subject: [ovirt-users] oVirt noVNC Caution External Mail: Do not click any links or open any attachments unless you trust the sender and know that the content is safe. Hi Everybody, With regards to noVNC, is it a requirement to install the CA into your local browser? I would like users to access their VM console, but with no additional work from their side, ie. Downloading the CA and importing it. Thank you Anton Louw Cloud Engineer: Storage and Virtualization at Vox ________________________________ T: 087 805 0000 | D: 087 805 1572 M: N/A E: anton.louw(a)voxtelecom.co.za<mailto:anton.louw@voxtelecom.co.za> A: Rutherford Estate, 1 Scott Street, Waverley, Johannesburg www.vox.co.za<https://eur02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.vox.co…> [F]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.faceb…> [T]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.twitt…> [I]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.insta…> [L]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linke…> [Y]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.youtu…> [#VoxBrand]<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.vox.c…> Disclaimer The contents of this email are confidential to the sender and the intended recipient. Unless the contents are clearly and entirely of a personal nature, they are subject to copyright in favour of the holding company of the Vox group of companies. Any recipient who receives this email in error should immediately report the error to the sender and permanently delete this email from all storage devices. This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more Click Here<https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.voxte…>. To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/> To view the terms under which this email is distributed, please go to:- http://leedsbeckett.ac.uk/disclaimer/email/<http://leedsbeckett.ac.uk/disclaimer/email/>

1 0

Multiple Gluster ACL issues with oVirt
by Strahil Nikolov 21 Jun '20

21 Jun '20

Hello Sahina, Sandro, I have noticed that the ACL issue with Gluster (https://github.com/gluster/glusterfs/issues/876) is happening to multiple oVirt users (so far at least 5) and I think that this issue needs greater attention. Did anyone from the RHHI team managed to reproduce the bug ? Best Regards, Strahil Nikolov

3 2

Adding iSCSI Target IP Address to Existing Storage Data Domain
by jrbdeguzman05＠gmail.com 21 Jun '20

21 Jun '20

Hi! Do you have suggestions if we can add a new iSCSI target IP address to an existing Storage Data Domain? Earlier, we had an issue where the storage device unexpectedly rebooted. It has 3 IP addresses used for iSCSI connections. For oVirt, we're connected to that storage device using 1 iSCSI Target IP address. The problem is that the adapters are down for that IP. What we're trying to do is to add the other IP addresses to connect to the LUNs/devices. Do you think simply logging in to the target will help? I've checked on previous threads and it was suggested that the storage data domain should be detached first then re-add using the new IP address. Thank you very much

2 1

[ANN] oVirt 4.4.1 Fifth Release Candidate is now available for testing
by Sandro Bonazzola 19 Jun '20

19 Jun '20

oVirt 4.4.1 Fifth Release Candidate is now available for testing The oVirt Project is pleased to announce the availability of oVirt 4.4.1 Fifth Release Candidate for testing, as of June 19th, 2020. This update is the first in a series of stabilization updates to the 4.4 series. Important notes before you try it Please note this is a pre-release build. The oVirt Project makes no guarantees as to its suitability or usefulness. This pre-release must not be used in production. Important changes from previous versions - Wildfly has been updated to version 19.1 Final - oVirt Node has been rebased on top of CentOS 8.2.2004 - oVirt Node UEFI support has been re-introduced - Advanced Virtualization and openvswitch 2.11 have been updated to latest version available for CentOS 8.2.2004 Installation instructions For the engine: either use appliance or: - Install CentOS Linux 8.2 minimal from http://centos.mirror.garr.it/centos/8/isos/x86_64/CentOS-8.2.2004-x86_64-dv… - dnf install https://resources.ovirt.org/pub/yum-repo/ovirt-release44-pre.rpm - dnf update (reboot if needed) - dnf module enable -y javapackages-tools pki-deps postgresql:12 - dnf install ovirt-engine - engine-setup For the nodes: Either use oVirt Node ISO or: - Install CentOS Linux 8 from http://centos.mirror.garr.it/centos/8/isos/x86_64/CentOS-8.2.2004-x86_64-dv… ; select minimal installation - dnf install https://resources.ovirt.org/pub/yum-repo/ovirt-release44-pre.rpm - dnf update (reboot if needed) - Attach the host to engine and let it be deployed. This release is available now on x86_64 architecture for: * Red Hat Enterprise Linux 8.2 or newer * CentOS Linux (or similar) 8.2 or newer This release supports Hypervisor Hosts on x86_64 and ppc64le architectures for: * Red Hat Enterprise Linux 8.2 or newer * CentOS Linux (or similar) 8.2 or newer * oVirt Node 4.4.1 based on CentOS Linux 8.2 (available for x86_64 only) See the release notes [1] for installation instructions and a list of new features and bugs fixed. Notes: - oVirt Appliance is not yet available due to outage on Fedora infrastructure occurred during the build. - oVirt Node NG is already available. Additional Resources: * Read more about the oVirt 4.4.1 release highlights: http://www.ovirt.org/release/4.4.1/ * Get more oVirt project updates on Twitter: https://twitter.com/ovirt * Check out the latest project news on the oVirt blog: http://www.ovirt.org/blog/ [1] http://www.ovirt.org/release/4.4.1/ [2] http://resources.ovirt.org/pub/ovirt-4.4-pre/iso/ -- Sandro Bonazzola MANAGER, SOFTWARE ENGINEERING, EMEA R&D RHV Red Hat EMEA <https://www.redhat.com/> sbonazzo(a)redhat.com <https://www.redhat.com/> *Red Hat respects your work life balance. Therefore there is no need to answer this email out of your office hours. <https://mojo.redhat.com/docs/DOC-1199578>*

1 1