Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

39.3. Migrating an LDAP Server to Identity Management

Important
This is a general migration procedure, but it may not work in every environment.
It is strongly recommended that you set up a test LDAP environment and test the migration process before attempting to migrate the real LDAP environment. To verify that the migration has been completed correctly:
  • Create a test user on IdM using the ipa user-add command and compare the output of migrated users to the test user. Make sure that the migrated users contain the minimal set of attributes and object classes present on the test user. 
    $ ipa user-add TEST_USER
    Copy to Clipboard
  • Compare the output of migrated users (seen on IdM) to the source users (seen on the original LDAP server). Make sure that imported attributes are not doubled and do have expected values. 
    $ ipa user-show --all TEST_USER
    Copy to Clipboard
  1. Install the IdM server, including any custom LDAP directory schema, on a different machine from the existing LDAP directory.
    Note
    Custom user or group schemas have limited support in IdM. They can cause problems during the migration because of incompatible object definitions.
  2. Disable the compat plug-in. 
    [root@server ~]# ipa-compat-manage disable
    Copy to Clipboard
    This step is not necessary if the data provided by the compat tree is required during the migration.
  3. Restart the IdM Directory Server instance. 
    [root@server ~]# systemctl restart dirsrv.target
    Copy to Clipboard
  4. Configure the IdM server to allow migration: 
    [root@server ~]# ipa config-mod --enable-migration=TRUE
    Copy to Clipboard
  5. Run the IdM migration script, ipa migrate-ds. At its most basic, this requires only the LDAP URL of the LDAP directory instance to migrate: 
    [root@server ~]# ipa migrate-ds ldap://ldap.example.com:389
    Copy to Clipboard
    Simply passing the LDAP URL migrates all of the directory data using common default settings. The user and group data can be selectively migrated by specifying other options, as covered in Section 39.2, “Examples for Using ipa migrate-ds”.
    If the compat plug-in was not disabled in the previous step, pass the --with-compat option to ipa migrate-ds.
    Once the information is exported, the script adds all required IdM object classes and attributes and converts DNs in attributes to match the IdM directory tree, if the naming context differs. For example: uid=user,ou=people,dc=ldap,dc=example,dc=com is migrated to uid=user,ou=people,dc=idm,dc=example,dc=com.
  6. Re-enable the compat plug-in, if it was disabled before the migration. 
    [root@server ~]# ipa-compat-manage enable
    Copy to Clipboard
  7. Restart the IdM Directory Server instance. 
    [root@server ~]# systemctl restart dirsrv.target
    Copy to Clipboard
  8. Disable the migration mode: 
    [root@server ]# ipa config-mod --enable-migration=FALSE
    Copy to Clipboard
  9. Optional. Reconfigure non-SSSD clients to use Kerberos authentication (pam_krb5) instead of LDAP authentication (pam_ldap). Use PAM_LDAP modules until all of the users have been migrated; then it is possible to use PAM_KRB5. For further information, see Configuring a Kerberos Client in the System-Level Authentication Guide.
  10. There are two ways for users to generate their hashed Kerberos password. Both migrate the users password without additional user interaction, as described in Section 39.1.2, “Planning Password Migration”.
    1. Using SSSD:
      1. Move clients that have SSSD installed from the LDAP back end to the IdM back end, and enroll them as clients with IdM. This downloads the required keys and certificates.
        On Red Hat Enterprise Linux clients, this can be done using the ipa-client-install command. For example: 
        [root@server ~]# ipa-client-install --enable-dns-update
        Copy to Clipboard
    2. Using the IdM migration web page:
      1. Instruct users to log into IdM using the migration web page: 
        https://ipaserver.example.com/ipa/migration
        Copy to Clipboard
  11. To monitor the user migration process, query the existing LDAP directory to see which user accounts have a password but do not yet have a Kerberos principal key. 
    [user@server ~]$ ldapsearch -LL -x -D 'cn=Directory Manager' -w secret -b 'cn=users,cn=accounts,dc=example,dc=com' '(&(!(krbprincipalkey=*))(userpassword=*))' uid
    Copy to Clipboard
    Note
    Include the single quotes around the filter so that it is not interpreted by the shell.
  12. When the migration of all clients and users is complete, decommission the LDAP directory.
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat