Red Hat SummitEste conteúdo não está disponível no idioma selecionado.
Chapter 6. Migrating from synchronization to trust automatically by using ipa-winsync-migrate
In RHEL 8, the synchronization approach to integrating RHEL systems into Active Directory (AD) indirectly is deprecated. Red Hat recommends migrating to the approach based on a trust between Identity Management (IdM) and AD instead. This chapter describes how to migrate from synchronization to trust automatically, by using the ipa-winsync-migrate utility.
6.1. Automatic migration from synchronization to trust by using ipa-winsync-migrate
The ipa-winsync-migrate utility migrates all synchronized users from an AD forest, while preserving the existing configuration in the Winsync environment and transferring it into the AD trust. For each AD user created by the Winsync agreement, ipa-winsync-migrate creates an ID override in the Default Trust View.
After the migration completes:
The ID overrides for the AD users have the following attributes copied from the original entry in Winsync:
-
Login name (
uid) -
UID number (
uidnumber) -
GID number (
gidnumber) -
Home directory (
homedirectory) -
GECOS entry (
gecos)
-
Login name (
The user accounts in the AD trust keep their original configuration in IdM, which includes:
- POSIX attributes
- User groups
- Role-based access control rules
- Host-based access control rules
- SELinux membership
-
sudorules
- The new AD users are added as members of an external IdM group.
- The original Winsync replication agreement, the original synchronized user accounts, and all local copies of the user accounts are removed.
6.2. Migrating from synchronization to trust by using ipa-winsync-migrate
Prerequisites
- On RHEL 7, you configured synchronisation between RHEL Identity Management (IdM) and AD.
Procedure
Back up your IdM setup using the
ipa-backuputility. See Backing up and restoring IdM.- NOTE
- The migration affects a significant part of the IdM configuration and many user accounts. Creating a backup enables you to restore your original setup if necessary.
- Create a trust with the synchronized domain. See For details, see Installing trust between IdM and AD.
Run
ipa-winsync-migrateand specify the AD realm and the host name of the AD domain controller:ipa-winsync-migrate --realm example.com --server ad.example.com
# ipa-winsync-migrate --realm example.com --server ad.example.comCopy to Clipboard Copied! Toggle word wrap Toggle overflow If a conflict occurs in the overrides created by
ipa-winsync-migrate, information about the conflict is displayed, but the migration continues.- Uninstall the Password Sync service from the AD server. This removes the synchronization agreement from the AD domain controllers.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}