Administrace komentářů

Ahoj, snazim se zprovoznit RedHat virtualizaci (nebo Ovirt chcete-li) a napojeni na IDM.

Dostal jsem se celkem daleko, ze se zaloguji z Ovirt na IDM (FreeIpa), s LDAP uctem admina, heslo je v te LDAP DB jako hash.

Jenze ta FreeIPA je mimo jine take nastavena jako proxy na AD, takze tam jsou ucty z Kerbera. A tady je trochu potiz.

Aby to fungovalo, je v navodu toto:

On the KDC server, use the kadmin utility to create a service principal for the Apache service on the oVirt Engine. The service principal is a reference ID to the KDC for the Apache service.

# kadmin
kadmin> addprinc -randkey HTTP/fqdn-of-rhevm@REALM.COM
Generate a keytab file for the Apache service. The keytab file stores the shared secret key.

The engine-backup command includes the file /etc/httpd/http.keytab when backing up and restoring. If you use a different name for the keytab file, make sure you back up and restore it.

kadmin> ktadd -k /tmp/http.keytab HTTP/fqdn-of-rhevm@REALM.COM
kadmin> quit

Tady bych potreboval trochu pomoct, s Kerberem az tolik neumim. Pry se porusuje nejaky constraint.

[root@freeipa ~]# kadmin
Authenticating as principal kadmin/admin@TEST.LOCAL with password.
Password for kadmin/admin@TEST.LOCAL:
kadmin:
kadmin:  addprinc -randkey HTTP/rhvm.test.local@TEST.LOCAL
No policy specified for HTTP/rhvm.test.local@TEST.LOCAL; defaulting to no policy
add_principal: Kerberos database constraints violated while creating "HTTP/rhvm.test.local@TEST.LOCAL".
kadmin:

V "/var/kerberos/krb5kdc/kadm5.acl" mam:

*/admin@TEST.LOCAL     *