Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

29.3. Scenario 1: Using SSSD as Part of Migration

Important

This is a general migration procedure, but it may not work in every environment.
It is strongly recommended that you set up a test LDAP environment and test the migration process before attempting to migrate the real LDAP environment.
  1. Set up SSSD. Using SSSD allows the required Kerberos keys and server certificates to be delivered to the clients.
    1. Install SSSD on every client machine: 
      # yum install sssd
      Copy to Clipboard
    2. Configure an LDAP identity provider in SSSD to use the existing Directory Server for all functions (authentication, identity lookups, access, and password changes). This ensures every client works properly with the existing directory service.
  2. Install Identity Management, including any custom LDAP directory schema[11], on a different machine from the existing LDAP directory.
  3. Enable the IdM server to allow migration: 
    # ipa config-mod --enable-migration=TRUE
    Copy to Clipboard
  4. Disable the compat plug-in. 
    # ipa-compat-manage disable
    Copy to Clipboard
  5. Restart the IdM Directory Server instance. 
    # service dirsrv restart
    Copy to Clipboard
  6. Run the IdM migration script, ipa migrate-ds. At its most basic, this requires only the LDAP URL of the LDAP directory instance to migrate: 
    # ipa migrate-ds ldap://ldap.example.com:389
    Copy to Clipboard
    Simply passing the LDAP URL migrates all of the directory data using common default settings. The user and group data can be selectively migrated by specifying other options, as covered in Section 29.2, “Examples for Using migrate-ds”.
    Once the information is exported, the script adds all required IdM object classes and attributes and converts DNs in attributes to match the IdM directory tree.
  7. Re-enable the compat plug-in. 
    # ipa-compat-manage enable
    Copy to Clipboard
  8. Restart the IdM Directory Server instance. 
    # service dirsrv restart
    Copy to Clipboard
  9. Move clients that have SSSD installed from the LDAP backend to the Identity Management backend and enroll them as client with IdM. This downloads the required keys and certificates.
    On Red Hat Enterprise Linux clients, this can be done using the ipa-client-install command. For example: 
    # ipa-client-install --enable-dns-updates
    Copy to Clipboard
  10. Have users log into a machine with SSSD and Identity Management backend. This generates the required Kerberos keys for the user.
    To monitor the user migration process, query the existing LDAP directory to see which user accounts have a password but do not yet have a Kerberos principal key. 
    $ ldapsearch -LL -x -D 'cn=Directory Manager' -w secret -b 'ou=people,dc=example,dc=com' '(&(!(krbprincipalkey=*))(userpassword=*))' uid
    Copy to Clipboard

    Note

    Include the quotes around the filter so that it is not interpreted by the shell.
  11. Once users have been migrated over, configure non-SSSD clients to use the IdM domain, as required.
  12. When the migration of all clients and users is complete, decommission the LDAP directory.

[11] There is limited support for custom user and group schema in Identity Management.
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat