<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Great to hear it's working for you as expected!<br><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Martin<br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, May 1, 2017 at 12:50 PM, Lloyd Kamara <span dir="ltr"><<a href="mailto:l.kamara@imperial.ac.uk" target="_blank">l.kamara@imperial.ac.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi, Martin, you wrote:<br>
<br>
> there is no reason to have different authz providers for both authn<br>
> providers, because authz part is the same for both kerberos and LDAP.<br>
> Just edit for example kerberos authn configuration file in<br>
> /etc/ovirt-engine/extension.d/ and change<br>
> 'ovirt.engine.aaa.authn.authz.<wbr>plugin' option to the name of your LDAP<br>
> authz provider.<br>
> When done please restart ovirt-engine to apply changes.<br>
<br>
<br>
Thank you for the above succinct and clear explanation.<br>
I changed the configuration accordingly and can confirm that<br>
it resolved the issue. When I log in via a Kerberos Ticket<br>
Granting Ticket and interactively via the LDAP-backed oVirt login<br>
web form, I am mapped to a single authentication domain.<br>
<br>
<br>
Best wishes,<br>
Lloyd<br>
</blockquote></div><br></div>