Migrating to Identity Management on RHEL 8 Red Hat Enterprise Linux 8 Upgrading a RHEL 7 IdM environment to RHEL 8 and migrating FreeIPA or external LDAP solutions to IdM Red Hat Customer Content Services

Commands:
ipa config-show | grep "CA renewal" IPA CA renewal master: rhel7.example.com
yum update ipa- *
ntpstat synchronised to NTP server ( ntp.example.com ) at stratum 3 time correct to within 42 ms polling server every 1024 s
ipa-client-install --mkhomedir --ntp-server ntp.example.com
yum update ipa- *
ipa server-role-find --status enabled --server rhel7.example.com ---------------------- 3 server roles matched ---------------------- Server name: rhel7.example.com Role name: CA server Role status: enabled Server name: rhel7.example.com Role name: DNS server Role status: enabled Server name: rhel7.example.com Role name: NTP server Role status: enabled [... output truncated ...]
ipa dnsserver-show rhel7.example.com ----------------------------- 1 DNS server matched ----------------------------- Server name: rhel7.example.com SOA mname: rhel7.example.com. Forwarders: 192.0.2.20 Forward policy: only -------------------------------------------------- Number of entries returned 1 --------------------------------------------------
ipa-replica-install --setup-ca --ip-address 192.0.2.1 --setup-dns --forwarder 192.0.2.20
ipactl status Directory Service: RUNNING [... output truncated ...] ipa: INFO: The ipactl command was successful
[root@rhel8 ~]USD kinit admin [root@rhel8 ~]USD ipa server-role-find --status enabled --server rhel8.example.com ---------------------- 2 server roles matched ---------------------- Server name: rhel8.example.com Role name: CA server Role status: enabled Server name: rhel8.example.com Role name: DNS server Role status: enabled
ipa-csreplica-manage list --verbose rhel8.example.com Directory Manager password: rhel7.example.com last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2019-02-13 13:55:13+00:00
id aduser@ad.domain
chronyc tracking Reference ID : CB00710F ( ntp.example.com ) Stratum : 3 Ref time (UTC) : Tue Nov 16 09:49:17 2021 [... output truncated ...]
ipa config-mod --ca-renewal-master-server rhel8.example.com IPA masters: rhel7.example.com, rhel8.example.com IPA CA servers: rhel7.example.com, rhel8.example.com IPA NTP servers: rhel7.example.com, rhel8.example.com IPA CA renewal master: rhel8.example.com
[user@rhel8 ~]USD ipactl restart
ca.certStatusUpdateInterval=0
[user@rhel7 ~]USD ipactl restart
ipa-crlgen-manage status CRL generation: enabled Last CRL update: 2019-10-31 12:00:00 Last CRL Number: 6 The ipa-crlgen-manage command was successful
ipa-crlgen-manage disable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable. The ipa-crlgen-manage command was successful
ipa-crlgen-manage status
ipa-crlgen-manage enable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd Forcing CRL update CRL generation enabled on the local host. Please make sure to have only a single CRL generation master. The ipa-crlgen-manage command was successful
ipa-crlgen-manage status CRL generation: enabled Last CRL update: 2019-10-31 12:10:00 Last CRL Number: 7 The ipa-crlgen-manage command was successful
ipa user-add random_user First name: random Last name: user
ipa user-find random_user -------------- 1 user matched -------------- User login: random_user First name: random Last name: user
ipa user-add another_random_user First name: another Last name: random_user
ipa idrange-find ---------------- 3 ranges matched ---------------- Range name: EXAMPLE.COM_id_range First Posix ID of the range: 196600000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range
ipa-replica-manage dnarange-show rhel7.example.com: 196600026-196799999 rhel8.example.com: No range set
ipa-replica-manage dnarange-set rhel7.example.com 196600026-196699999
ipa-replica-manage dnarange-set rhel8.example.com 196700000-196799999
ipactl stop Stopping CA Service Stopping pki-ca: [ OK ] Stopping HTTP Service Stopping httpd: [ OK ] Stopping MEMCACHE Service Stopping ipa_memcached: [ OK ] Stopping DNS Service Stopping named: . [ OK ] Stopping KPASSWD Service Stopping Kerberos 5 Admin Server: [ OK ] Stopping KDC Service Stopping Kerberos 5 KDC: [ OK ] Stopping Directory Service Shutting down dirsrv: EXAMPLE-COM... [ OK ] PKI-IPA... [ OK ]
SSSD Domain "example.com": local provider is no longer supported and the domain will be ignored. Local provider is no longer supported.
useradd -u 3001 username
groupadd -g 5001 groupname
[domain/example.com] id_provider = files
systemctl restart sssd
SSSD Domain "example.com": option ldap_groups_use_matching_rule_in_chain has no longer any effect Option ldap_groups_use_matching_rule_in_chain was removed and it will be ignored.
SSSD Domain "example.com": option ldap_initgroups_use_matching_rule_in_chain has no longer any effect Option ldap_initgroups_use_matching_rule_in_chain was removed and it will be ignored.
systemctl restart sssd
SSSD Domain "example.com": sudo rules containing wildcards will stop working. Default value of ldap_sudo_include_regexp changed from true to false for performance reason.
[domain/example.com] ldap_sudo_include_regexp = true
systemctl restart sssd
[migrated_idm_user@idmclient ~]USD kinit Password for migrated_idm_user@IDM.EXAMPLE.COM: Password expired. You must change it now. Enter new password: Enter it again:
ldapmodify -x -D 'cn=directory manager' -w password -h ipaserver.example.com -p 389 dn: cn=config changetype: modify replace: nsslapd-sasl-max-buffer-size nsslapd-sasl-max-buffer-size: 4194304 modifying entry "cn=config"
ulimit -u 4096
ipa migrate-ds ldap://ldap.example.com:389
ipa migrate-ds ldap://ldap.example.com:389 --bind-dn=cn=Manager,dc=example,dc=com
ipa migrate-ds --base-dn="ou=people,dc=example,dc=com" ldap://ldap.example.com:389
ipa migrate-ds --user-container=ou=employees --group-container="ou=employee groups" ldap://ldap.example.com:389
ipa migrate-ds --user-objectclass=fullTimeEmployee ldap://ldap.example.com:389
ipa migrate-ds --group-objectclass=groupOfNames --group-objectclass=groupOfUniqueNames ldap://ldap.example.com:389
ipa migrate-ds --exclude-groups="Golfers Group" --exclude-users=idmuser101 --exclude-users=idmuser102 ldap://ldap.example.com:389
ipa migrate-ds --user-objectclass=fullTimeEmployee --exclude-users=jsmith --exclude-users=bjensen --exclude-users=mreynolds ldap://ldap.example.com:389
ipa migrate-ds --user-ignore-attribute=userCertificate --user-ignore-objectclass=strongAuthenticationUser --group-ignore-objectclass=groupOfCertificates ldap://ldap.example.com:389
ipa migrate-ds --schema=RFC2307 ldap://ldap.example.com:389
ipa-compat-manage disable
systemctl restart dirsrv.target
ipa config-mod --enable-migration=TRUE
ipa migrate-ds --your-options ldap://ldap.example.com:389
ipa migrate-ds --your-options --with-compat ldap://ldap.example.com:389
ipa-compat-manage enable
systemctl restart dirsrv.target
ipa config-mod --enable-migration=FALSE
ipa-client-install --enable-dns-update
https://ipaserver.example.com/ipa/migration
ldapsearch -LL -x -D 'cn=Directory Manager' -w secret -b 'cn=users,cn=accounts,dc=example,dc=com' '(&(!(krbprincipalkey= ))(userpassword= ))' uid
ipa user-show --all testing_user dn: uid=testing_user,cn=users,cn=accounts,dc=idm,dc=example,dc=com User login: testing_user First name: testing Last name: user Full name: testing user Display name: testing user Initials: tu Home directory: /home/testing_user GECOS: testing user Login shell: /bin/sh Principal name: testing_user@IDM.EXAMPLE.COM Principal alias: testing_user@IDM.EXAMPLE.COM Email address: testing_user@idm.example.com UID: 1689700012 GID: 1689700012 Account disabled: False Preserved user: False Password: False Member of groups: ipausers Kerberos keys available: False ipauniqueid: 843b1ac8-6e38-11ec-8dfe-5254005aad3e mepmanagedentry: cn=testing_user,cn=groups,cn=accounts,dc=idm,dc=example,dc=com objectclass: top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser, ipaSshGroupOfPubKeys, mepOriginEntry
ipa migrate-ds --ca-cert-file= /tmp/remote.crt --your-other-options ldaps:// ldap.example.com :636
ipa user-show --all testing_user dn: uid=testing_user,cn=users,cn=accounts,dc=idm,dc=example,dc=com User login: testing_user First name: testing Last name: user Full name: testing user Display name: testing user Initials: tu Home directory: /home/testing_user GECOS: testing user Login shell: /bin/sh Principal name: testing_user@IDM.EXAMPLE.COM Principal alias: testing_user@IDM.EXAMPLE.COM Email address: testing_user@idm.example.com UID: 1689700012 GID: 1689700012 Account disabled: False Preserved user: False Password: False Member of groups: ipausers Kerberos keys available: False ipauniqueid: 843b1ac8-6e38-11ec-8dfe-5254005aad3e mepmanagedentry: cn=testing_user,cn=groups,cn=accounts,dc=idm,dc=example,dc=com objectclass: top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser, ipaSshGroupOfPubKeys, mepOriginEntry
ipa-winsync-migrate --realm example.com --server ad.example.com