Bug 1462815

Summary:	Assume the user is going to use 'Single Sing-On for Virtual Machines'
Product:	[oVirt] ovirt-engine-extension-aaa-ldap	Reporter:	Miguel Martin <mmartinv>
Component:	Setup	Assignee:	Ondra Machacek <omachace>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Gonza <grafuls>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	master	CC:	bugs, mperina
Target Milestone:	ovirt-4.1.6	Flags:	rule-engine: ovirt-4.1+
Target Release:	1.3.4
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ovirt-engine-extension-aaa-ldap-1.3.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-09-19 10:03:14 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	Infra	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Miguel Martin 2017-06-19 15:33:09 UTC

Description of problem:

By default, the 'ovirt-engine-extension-aaa-ldap-setup' script assumes that the user is not going to use 'Single Sing-On for Virtual Machines' feature. 

If the user changes his mind in the future there is no easy way to modify the configuration to make it work. 

There are two options:

1. Remove all the permissions of domain users in 'Administration Portal', rename the authorization extension with upstream tool 'ovirt-engine-kerbldap-migration-authz-rename'. Reassign the user's permissions in 'Administration Portal'.
2. Make the changes manually in profile config files and directly into the database (undocumented and not recommended of course).

As there is no functional impact I believe we should use 'Yes' as the default answer to the question 'Are you going to use Single Sing-On for Virtual Machines?', at least until we had a better implementation. 

Version-Release number of selected component (if applicable):
All

How reproducible:
Always

Steps to Reproduce:
1. Run 'ovirt-engine-extension-aaa-ldap-setup'
2. Choose the default answer of 'Are you going to use Single Sing-On for Virtual Machines?'

Actual results:
Virtual Machine SSO in user portal not working

Expected results:
Virtual Machine SSO in user portal working

Additional info:

Comment 1 Martin Perina 2017-08-03 07:46:02 UTC

Fix is contained is going to be delivered in ovirt-engine-extension-aaa-ldap-1.3.3

Comment 2 Gonza 2017-08-15 08:45:22 UTC

Verified with:
ovirt-engine-extension-aaa-ldap-setup-1.3.3-1.el7ev.noarch

"Are you going to use Single Sign-On for Virtual Machines (Yes, No) [Yes]: "

Comment 3 Martin Perina 2017-08-18 15:02:41 UTC

Retargeting to 4.1.6 as we need to withdraw release of ovirt-engine-extension-aaa-ldap-setup-1.3.3 and fix critical bug in this release

Comment 4 Martin Perina 2017-08-28 10:43:44 UTC

Fix is included in ovirt-engine-extension-aaa-ldap-1.3.4

Comment 5 Gonza 2017-09-04 11:10:17 UTC

Verified with:
ovirt-engine-extension-aaa-ldap-setup-1.3.5-0.0.master.git7230cd9.el7.centos.noarch

...
Are you going to use Single Sign-On for Virtual Machines (Yes, No) [Yes]: 
...