此内容没有您所选择的语言版本。

29.4. Scenario 2: Migrating an LDAP Server Directly to Identity Management


Important

This is a general migration procedure, but it may not work in every environment.
It is strongly recommended that you set up a test LDAP environment and test the migration process before attempting to migrate the real LDAP environment.
  1. Install the IdM server, including any custom LDAP directory schema[12], on a different machine from the existing LDAP directory.
  2. Disable the compat plug-in.
    # ipa-compat-manage disable
    Copy to Clipboard Toggle word wrap
  3. Restart the IdM Directory Server instance.
    # service dirsrv restart
    Copy to Clipboard Toggle word wrap
  4. Enable the IdM server to allow migration:
    # ipa config-mod --enable-migration=TRUE
    Copy to Clipboard Toggle word wrap
  5. Run the IdM migration script, ipa migrate-ds. At its most basic, this requires only the LDAP URL of the LDAP directory instance to migrate:
    # ipa migrate-ds ldap://ldap.example.com:389
    Copy to Clipboard Toggle word wrap
    Simply passing the LDAP URL migrates all of the directory data using common default settings. The user and group data can be selectively migrated by specifying other options, as covered in Section 29.2, “Examples for Using migrate-ds”.
    Once the information is exported, the script adds all required IdM object classes and attributes and converts DNs in attributes to match the IdM directory tree.
  6. Re-enable the compat plug-in.
    # ipa-compat-manage enable
    Copy to Clipboard Toggle word wrap
  7. Restart the IdM Directory Server instance.
    # service dirsrv restart
    Copy to Clipboard Toggle word wrap
  8. Update the client configuration to use PAM_LDAP and NSS_LDAP to connect to IdM instead of connecting to an LDAP directory, NIS, or local files.
  9. Optional. Set up SSSD. Using SSSD migrates user passwords without additional user interaction, as described in Section 29.1.2, “Planning Password Migration”.
    1. Install SSSD on every client machine:
      # yum install sssd
      Copy to Clipboard Toggle word wrap
    2. Run the ipa-client-install to configure SSSD and related services to use the IdM server for identity and Kerberos authentication.
  10. Instruct users to log into IdM using either SSSD client or the migration web page if SSSD is not available on the client. Both methods automatically migrate the user password into Identity Management.
    https://ipaserver.example.com/ipa/migration
    Copy to Clipboard Toggle word wrap
  11. Optional. Reconfigure non-SSSD clients to use Kerberos authentication (pam_krb5) instead of LDAP authentication (pam_ldap).

    Note

    Use PAM_LDAP modules until all of the users have been migrated; then it is possible to use PAM_KRB5.
  12. When the migration of all clients and users is complete, decommission the LDAP directory.


[12] There is limited support for custom user and group schema in Identity Management.
返回顶部
Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

关于红帽文档

通过我们的产品和服务,以及可以信赖的内容,帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情,请参阅红帽博客.

關於紅帽

我们提供强化的解决方案,使企业能够更轻松地跨平台和环境(从核心数据中心到网络边缘)工作。

Theme

© 2025 Red Hat