<div dir="ltr">Sorry for the delay. Did anyone help out on this yet? If not, I can look now.<div><br></div><div>Greg</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Oct 24, 2016 at 8:52 AM, Martin Perina <span dir="ltr"><<a href="mailto:mperina@redhat.com" target="_blank">mperina@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Alex/Greg, could you please take a look?<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Thanks<span class="HOEnZb"><font color="#888888"><br><br></font></span></div><span class="HOEnZb"><font color="#888888"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Martin<br><br></div></font></span></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Oct 24, 2016 at 2:02 PM, Baptiste Agasse <span dir="ltr"><<a href="mailto:baptiste.agasse@lyra-network.com" target="_blank">baptiste.agasse@lyra-network.<wbr>com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-family:arial,helvetica,sans-serif;font-size:12pt;color:#000000"><div>Hi,<br></div><div><br></div><div><span id="m_-9203100326600061929m_9032670009760378103zwchr">----- Le 24 Oct 16, à 11:25, Martin Perina <<a href="mailto:mperina@redhat.com" target="_blank">mperina@redhat.com</a>> a écrit :<br></span></div><div><blockquote style="border-left:2px solid #1010ff;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt"><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Oct 24, 2016 at 11:18 AM, Baptiste Agasse <span dir="ltr"><<a href="mailto:baptiste.agasse@lyra-network.com" target="_blank">baptiste.agasse@lyra-network.<wbr>com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid #cccccc;padding-left:1ex">Hi Ondra,<br><br> ----- Le 24 Oct 16, à 10:36, Ondra Machacek <a href="mailto:omachace@redhat.com" target="_blank">omachace@redhat.com</a> a écrit :<br><br> > On 10/21/2016 12:00 PM, Baptiste Agasse wrote:<br> >> Hi all,<br> >><br> >> We use ovirt 4.0.4 with FreeIPA as external provider. The external provider was<br> >> configured via the 'ovirt-engine-extension-aaa-ld<wbr>ap-setup' command. The<br> >> authentication works fine, but in the webui, when you go on the 'Active User<br> >> Sessions', all users uuid is showed as '00000000-0000-0000-0000-00000<wbr>0000000'.<br> >> Other problem, maybe related, when a user create a VM, by default a permission<br> >> is created with the role of 'UserVmManager'. On the 'Permissions' pane, we see<br> >> a line with no value for User, Authorization provider, Namespace. The only<br> >> value set on this line is the role (UserVmManager in that case). When we try to<br> >> remove this line, an exception occurs in the webui that prevent deletion of<br> >> this line.<br> ><br> > I've never see such issue with FreeIPA. Can you please share what's<br> > your IPA version?<br> ><br> > Can you also please share the log of error which occurs, when you try<br> > to remove the permission?<br><br> We have multiple ovirt envs, all ovirt version are the same as described, but FreeIPA servers are in different versions on these envs. We have one env with FreeIPA on CentOS 6 (ipa-server-3.0.0-42.el6.cento<wbr>s.x86_64) and the other on FreeIPA on CentOS 7 (ipa-server-4.2.0-15.0.1.el7.c<wbr>entos.6.1.x86_64). The both envs have the same problem. On our envs, the role mapping in oVirt is done on user groups and not on individual users.<br><br> For the permission problem, the problem only occurs when the VM is created via the user webui. Creating VM with API or admin webui is OK. When we try to remove the permission, an UI exception occurs and no logs on the engine.log side. I've attached screenshots and ui.log.<br></blockquote><div><br><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;display:inline">Unfortunately by default UI code is obfuscated, so we cannot find exact issue. Could you please perform following steps and send us new ui.log?<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;display:inline">1. Install UI debug packages<br> yum install ovirt-engine-webadmin-portal-d<wbr>ebuginfo ovirt-engine-userportal-debugi<wbr>nfo</div><br><br><div style="font-family:arial,helvetica,sans-serif" class="gmail_default">2. Restart ovirt-engine<br></div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default"> systemctl restart ovirt-engine<br><br></div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default">3. Reproduce the error and share up-to-date ui.log with use<br><br></div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default">If needed more info about UI logs can be found at <a href="http://www.ovirt.org/develop/developer-guide/engine/engine-debug-obfuscated-ui/" target="_blank">http://www.ovirt.org/develop/d<wbr>eveloper-guide/engine/engine-d<wbr>ebug-obfuscated-ui/</a></div></div></div></div></div></blockquote><div><br></div><div>I've reproduced the error, see attached engine.log at VM creation time and the ui.log when trying to remove inconsistent permission.<br></div><div><br></div><div>Thanks.<br></div><div><br></div><blockquote style="border-left:2px solid #1010ff;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default"><br><br></div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default">Thanks<br><br></div><div style="font-family:arial,helvetica,sans-serif" class="gmail_default">Martin Perina<br></div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid #cccccc;padding-left:1ex"><br> ><br> >><br> >> This behavior is verified on all our oVirt environments (oVirt 4.0.4 + FreeIPA)<br> >><br> >> Someone hit the same problem ?<br> >><br> >> Have a nice day.<br> >><br> >> Regards.<br><br> Regards.<span class="m_-9203100326600061929HOEnZb"><font color="#888888"><br><span class="m_-9203100326600061929m_9032670009760378103gmail-HOEnZb"><span style="color:#888888" color="#888888"><br> --<br> Baptiste AGASSE<br> </span></span><br>______________________________<wbr>_________________<br> Users mailing list<br><a href="mailto:Users@ovirt.org" target="_blank">Users@ovirt.org</a><br><a href="http://lists.ovirt.org/mailman/listinfo/users" rel="noreferrer" target="_blank">http://lists.ovirt.org/mailman<wbr>/listinfo/users</a><br><br></font></span></blockquote></div></div></div><span class="m_-9203100326600061929HOEnZb"><font color="#888888"><br></font></span></blockquote></div><span class="m_-9203100326600061929HOEnZb"><font color="#888888"><div><br></div><div>-- <br></div><div>Baptiste AGASSE<br></div></font></span></div></div></blockquote></div><br></div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>Greg Sheremeta, MBA<br>Red Hat, Inc.<br>Sr. Software Engineer<br><a href="mailto:gshereme@redhat.com" target="_blank">gshereme@redhat.com</a><br></div></div></div>
</div>