[Users] DNS for IPA in oVirt

[Yair Zaslavsky]

Hi,
When you add a new domain - let's say example.com what happens from DNS perspective is -


a. if useDnsLookup at engine-manage-domains conf is set to "true" then
dns_lookup_realm  = true
and dns_lookup_kdc = true

Will be placed at the krb5.conf that is being created.
This will cause the internal java kerberos implementation to issue DNS srv requests per realm (for example, if you want to add the domain example.com, the realm will be EXAMPLE.COM) 
for kerberos -
the srv record query will look like _kerberos._tcp.example.com and it will return a list of KDCs for the realm.

If useDnsLookup is not set to true, 
This will cause the manage-domains utility to issue kerberos DNS srv records, and fill the krb5.conf file with information on KDCs per realm.


In return you will get a list of corresponding hosts for the ldap servers.

b. If -ldapServers was not passed - a DNS srv record will be issues to get the ldap servers for the domain -
_ldap._tcp.example.com  after the manage-domains utility performs kerberos authentication.
This is done, in order to get a URL of an ldap server to be used, to send an ldap query and get the user id for the given user at the command line utility.

So, as long as your DNS is configured properly, and the SRV records are well defined, you will get SRV records for kerberos and ldap.





----- Original Message -----
> From: "René Koch (ovido)" <r.koch at ovido.at>
> To: "ovirt-users" <users at ovirt.org>
> Sent: Friday, April 5, 2013 3:47:07 PM
> Subject: [Users] DNS for IPA in oVirt
> 
> Hi list,
> 
> I don't want to ask my question in the mail thread of Eduardo to avoid
> mixing topics.
> 
> Can you give me more detailed information on how oVirt is using DNS
> internally and how IPA users can work in the following scenario:
> 
> # engine-manage-domains -action=list
> Domain: ovido.at
> 	User name: admin at OVIDO.AT
> Manage Domains completed successfully
> 
> # cat /etc/hosts | grep engine
> 10.0.100.195 ovirt-engine.lab.ovido.at
> 
> # ip a
> 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast
> state UP qlen 1000
>     link/ether 00:1a:4a:00:64:14 brd ff:ff:ff:ff:ff:ff
>     inet 10.0.100.195/24 brd 10.0.100.255 scope global eth0
> 
> # host ovirt-engine.lab.ovido.at
> ovirt-engine.lab.ovido.at has address 10.0.100.24
> 
> # host 10.0.100.24
> 24.100.0.10.in-addr.arpa domain name pointer ovirt-engine.lab.ovido.at.
> 
> So in my case I have correct DNS settings (forward and reverse), but my
> ovirt-engine host has a totally different IP address.
> 
> I didn't test SSO with Kerberos in user portal (maybe this want work),
> but authentication with IPA user in user portal and admin portal is
> working fine even with these totally wrong DNS configuration.
> 
> 
> Regards,
> René
> 
> 
> _______________________________________________
> Users mailing list
> Users at ovirt.org
> http://lists.ovirt.org/mailman/listinfo/users
>