<html> <head> <meta content="text/html; charset=utf-8" http-equiv="Content-Type"> </head> <body text="#000000" bgcolor="#FFFFFF"> Gianluca's method not working for me, always get this error Error: Idm client exception: control not found and also try using this: <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/HowTo/vsphere5_integration#Permission_Update">http://www.freeipa.org/page/HowTo/vsphere5_integration#Permission_Update</a> <div class="moz-cite-prefix">On 3/6/15 7:49 PM, Martin Kosek wrote: </div> <blockquote cite="mid:54F9A253.2090403@redhat.com" type="cite">I am glad you have it working. However, I would like to discourage from this another method as this way, you would need to maintain uniqueMember attribute yourself. FreeIPA only maintains the "member" attribute. I would recommend using the Gianluca's method in <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/HowTo/vsphere5_integration">http://www.freeipa.org/page/HowTo/vsphere5_integration</a> with taking users and groups from compat tree. This way, you will have uniqueMember populated when you do changes to the group using FreeIPA CLI or UI. If it was not working for you in the past, note that we identified a change today that needs to be done with FreeIPA 4.0+: <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/HowTo/vsphere5_integration#Permission_Update">http://www.freeipa.org/page/HowTo/vsphere5_integration#Permission_Update</a> Martin On 03/06/2015 12:11 PM, Herwono W Wijaya wrote: <blockquote type="cite">Now all works well, I use another method *FreeIPA:** **Users:* - admin - herwono (member of "ssogroups" group) - vcadmin (member of "ssogroups" group) *Group**s:** **Only one group for vCenter SSO.* - ssogroups *Modif "ssogroups" using ldif file* <pre> dn: cn=ssogroups,cn=groups,cn=accounts,dc=server,dc=local changetype: modify add: objectClass objectClass: groupOfUniqueNames - add: uniqueMember uniqueMember: uid=herwono,cn=users,cn=accounts,dc=server,dc=local uniqueMember: uid=vcadmin,cn=users,cn=accounts,dc=server,dc=local - </pre> *vCenter Identity Source Config:* Name: IPA Base DN for users: cn=users,cn=accounts,dc=server,dc=local Domain name: server.local Base DN for groups: cn=groups,cn=accounts,dc=server,dc=local Primary server url: <a class="moz-txt-link-freetext" href="ldap://identity.server.local:389">ldap://identity.server.local:389</a> Username: uid=admin,cn=users,cn=accounts,dc=server,dc=local Password: ****** *FreeIPA users and groups for vCenter with Administrator permission:* User: herwono (SERVER.LOCAL\herwono) Group: ssogroups (SERVER.LOCAL\ssogroups) On 3/6/15 3:37 PM, Gianluca Cecchi wrote: <blockquote type="cite">On Fri, Mar 6, 2015 at 8:34 AM, Martin Kosek <<a class="moz-txt-link-abbreviated" href="mailto:mkosek@redhat.com">mkosek@redhat.com</a> <a class="moz-txt-link-rfc2396E" href="mailto:mkosek@redhat.com"><mailto:mkosek@redhat.com></a>> wrote: On 03/06/2015 04:38 AM, Herwono W Wijaya wrote: Problems with FreeIPA 4.1.3 for vCenter 5.5u2b SSO, only the admin user can be used and always get an error for other users. You mean admin user from vCenter, not admin user from FreeIPA, right? Did you follow this HOWTO: <a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/HowTo/vsphere5_integration">http://www.freeipa.org/page/HowTo/vsphere5_integration</a> Note that the vSphere integration topic is being discussed this week, CCing also Gialunca (author of the HOWTO), he may have some ideas where the problem is too. Martin The logs that let us know the kind of queries generated b vSPhere are in /var/log/dirsrv/slapd-REALM-NAME/ (at least for 3.3.3) Also, searching through my e-mails I found one direct contact using vSphere 5.5 and that was doing some tests with VMware support connected to his systems. It seems they found out that it almost all worked correctly when using accounts instead of compat BUT you can't log in. An action was the to add objectclass=groupOfUniqueNames to a single test group and they were able to login I asked more information about his setup if still in place and to eventually share with others. Stay tuned... Gianluca </blockquote> -- Regards, Herwono W Wijaya <a class="moz-txt-link-freetext" href="https://linuxcoding.org">https://linuxcoding.org</a> | *VMware vExpert 2014, 2015 <a class="moz-txt-link-rfc2396E" href="https://communities.vmware.com/vexpert.jspa?src=vmw_so_vex_hwija_769&username=herwonowr"><https://communities.vmware.com/vexpert.jspa?src=vmw_so_vex_hwija_769&username=herwonowr></a>* </blockquote> </blockquote> <div class="moz-signature">-- Regards, Herwono W Wijaya <a class="moz-txt-link-freetext" href="https://linuxcoding.org">https://linuxcoding.org</a> | <a href="https://communities.vmware.com/vexpert.jspa?src=vmw_so_vex_hwija_769&username=herwonowr">VMware vExpert 2014, 2015</a> </div> </body> </html>