Product SiteDocumentation Site

17.2. Scenario 1: Using SSSD as Part of Migration

IMPORTANT

This is a general migration procedure, but it may not work in every environment.
It is strongly recommended that you set up a test LDAP environment and test the migration process before attempting to migrate the real LDAP environment.
  1. Set up SSSD. Using SSSD allows the required Kerberos keys and server certificates to be delivered to the clients.
    1. Install SSSD on every client machine:
      # yum install sssd
    2. Configure an LDAP identity provider in SSSD to use the existing Directory Server for all functions (authentication, identity lookups, access, and password changes). This ensures every client works properly with the existing directory service.
  2. Install FreeIPA, including any custom LDAP directory schema[3], on a different machine from the existing LDAP directory.
  3. Enable the FreeIPA server to allow migration:
    # ipa config-mod --enable-migration=TRUE
  4. Run the FreeIPA migration script, ipa migrate-ds. At its most basic, this requires only the LDAP URL of the LDAP directory instance to migrate:
    # ipa migrate-ds ldap://ldap.example.com:389
    The ipa migrate-ds command connects to the LDAP directory and binds as the Directory Manager and extracts all entries with the person object class from the ou=People subtree, by default. A different subtree can be specified using the --user-container option.
    This script also exports all entries from the ou=Groups subtree to maintain group memberships. The group can be changed using the --group-container option.
    Once the information is exported, the script adds all required FreeIPA object classes and attributes and coverts DNs in attributes to match the FreeIPA directory tree.
    For example:
    # ipa migrate-ds --user-container=ou=employees --group-container="ou=employee groups" ldap://ldap.example.com:389
  5. Move clients that have SSSD installed from the LDAP backend to the FreeIPA backend and enroll them as client with FreeIPA. This downloads the required keys and certificates.
    On Fedora clients, this can be done using the ipa-client-install command. For example:
    # ipa-client-install --enable-dns-updates
  6. Have users log into a machine with SSSD and FreeIPA backend. This generates the required Kerberos keys for the user.
    To monitor the user migration process, query the existing LDAP directory to see which user accounts have a password but do not yet have a Kerberos principal key.
    $ ldapsearch -LL -x -D 'cn=Directory Manager' -w secret -b 'ou=people,dc=example,dc=com' '(&(!(krbprincipalkey=*))(userpassword=*))' uid

    NOTE

    Include the quotes around the filter so that it is not interpreted by the shell.
  7. Once users have been migrated over, configure non-SSSD clients to use the FreeIPA domain, as required.
  8. When the migration of all clients and users is complete, decommission the LDAP directory.


[3] There is limited support for custom user and group schema in FreeIPA.