Migrating to Identity Management on RHEL 9 Red Hat Enterprise Linux 9 Upgrading a RHEL 8 IdM environment to RHEL 9 and migrating external LDAP solutions to IdM Red Hat Customer Content Services

Commands:
ipa config-show | grep "CA renewal" IPA CA renewal master: rhel8.example.com
dnf update ipa- *
ntpstat synchronised to NTP server ( ntp.example.com ) at stratum 3 time correct to within 42 ms polling server every 1024 s
dnf update ipa- *
ipa server-role-find --status enabled --server rhel8.example.com ---------------------- 3 server roles matched ---------------------- Server name: rhel8.example.com Role name: CA server Role status: enabled Server name: rhel8.example.com Role name: DNS server Role status: enabled [... output truncated ...]
ipa dnsserver-show rhel8.example.com ----------------------------- 1 DNS server matched ----------------------------- Server name: rhel8.example.com SOA mname: rhel8.example.com. Forwarders: 192.0.2.20 Forward policy: only -------------------------------------------------- Number of entries returned 1 --------------------------------------------------
ipa-replica-install --setup-ca --ip-address 192.0.2.1 --setup-dns --forwarder 192.0.2.20 --ntp-server ntp.example.com
ipactl status Directory Service: RUNNING [... output truncated ...] ipa: INFO: The ipactl command was successful
kinit admin ipa server-role-find --status enabled --server rhel9.example.com ---------------------- 2 server roles matched ---------------------- Server name: rhel9.example.com Role name: CA server Role status: enabled Server name: rhel9.example.com Role name: DNS server Role status: enabled
ipa-csreplica-manage list --verbose rhel9.example.com Directory Manager password: rhel8.example.com last init status: None last init ended: 1970-01-01 00:00:00+00:00 last update status: Error (0) Replica acquired successfully: Incremental update succeeded last update ended: 2019-02-13 13:55:13+00:00
id aduser@ad.domain
chronyc tracking Reference ID : CB00710F ( ntp.example.com ) Stratum : 3 Ref time (UTC) : Wed Feb 16 09:49:17 2022 [... output truncated ...]
ipa config-mod --ca-renewal-master-server rhel9.example.com IPA masters: rhel8.example.com, rhel9.example.com IPA CA servers: rhel8.example.com, rhel9.example.com IPA CA renewal master: rhel9.example.com
[user@rhel9 ~]USD ipactl restart
ca.certStatusUpdateInterval=0
[user@rhel8 ~]USD ipactl restart
ipa-crlgen-manage status CRL generation: enabled Last CRL update: 2021-10-31 12:00:00 Last CRL Number: 6 The ipa-crlgen-manage command was successful
ipa-crlgen-manage disable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd CRL generation disabled on the local host. Please make sure to configure CRL generation on another master with ipa-crlgen-manage enable. The ipa-crlgen-manage command was successful
ipa-crlgen-manage status
ipa-crlgen-manage enable Stopping pki-tomcatd Editing /var/lib/pki/pki-tomcat/conf/ca/CS.cfg Starting pki-tomcatd Editing /etc/httpd/conf.d/ipa-pki-proxy.conf Restarting httpd Forcing CRL update CRL generation enabled on the local host. Please make sure to have only a single CRL generation master. The ipa-crlgen-manage command was successful
ipa-crlgen-manage status CRL generation: enabled Last CRL update: 2021-10-31 12:10:00 Last CRL Number: 7 The ipa-crlgen-manage command was successful
ipa user-add random_user First name: random Last name: user
ipa user-find random_user -------------- 1 user matched -------------- User login: random_user First name: random Last name: user
ipa user-add another_random_user First name: another Last name: random_user
ipa idrange-find ---------------- 3 ranges matched ---------------- Range name: EXAMPLE.COM_id_range First Posix ID of the range: 196600000 Number of IDs in the range: 200000 First RID of the corresponding RID range: 1000 First RID of the secondary RID range: 100000000 Range type: local domain range
ipa-replica-manage dnarange-show rhel8.example.com: 196600026-196799999 rhel9.example.com: No range set
ipa-replica-manage dnarange-set rhel8.example.com 196600026-196699999
ipa-replica-manage dnarange-set rhel9.example.com 196700000-196799999
ipactl stop Stopping CA Service Stopping pki-ca: [ OK ] Stopping HTTP Service Stopping httpd: [ OK ] Stopping MEMCACHE Service Stopping ipa_memcached: [ OK ] Stopping DNS Service Stopping named: [ OK ] Stopping KPASSWD Service Stopping Kerberos 5 Admin Server: [ OK ] Stopping KDC Service Stopping Kerberos 5 KDC: [ OK ] Stopping Directory Service Shutting down dirsrv: EXAMPLE-COM... [ OK ] PKI-IPA... [ OK ]
ntpstat synchronised to NTP server ( ntp.example.com ) at stratum 3 time correct to within 42 ms polling server every 1024 s
dnf update ipa- *
[migrated_idm_user@idmclient ~]USD kinit Password for migrated_idm_user@IDM.EXAMPLE.COM: Password expired. You must change it now. Enter new password: Enter it again:
ldapmodify -x -D 'cn=directory manager' -w password -h ipaserver.example.com -p 389 dn: cn=config changetype: modify replace: nsslapd-sasl-max-buffer-size nsslapd-sasl-max-buffer-size: 4194304 modifying entry "cn=config"
ulimit -u 4096
ipa migrate-ds ldap://ldap.example.com:389
ipa migrate-ds ldap://ldap.example.com:389 --bind-dn=cn=Manager,dc=example,dc=com
ipa migrate-ds --base-dn="ou=people,dc=example,dc=com" ldap://ldap.example.com:389
ipa migrate-ds --user-container=ou=employees --group-container="ou=employee groups" ldap://ldap.example.com:389
ipa migrate-ds --user-objectclass=fullTimeEmployee ldap://ldap.example.com:389
ipa migrate-ds --group-objectclass=groupOfNames --group-objectclass=groupOfUniqueNames ldap://ldap.example.com:389
ipa migrate-ds --exclude-groups="Golfers Group" --exclude-users=idmuser101 --exclude-users=idmuser102 ldap://ldap.example.com:389
ipa migrate-ds --user-objectclass=fullTimeEmployee --exclude-users=jsmith --exclude-users=bjensen --exclude-users=mreynolds ldap://ldap.example.com:389
ipa migrate-ds --user-ignore-attribute=userCertificate --user-ignore-objectclass=strongAuthenticationUser --group-ignore-objectclass=groupOfCertificates ldap://ldap.example.com:389
ipa migrate-ds --schema=RFC2307 ldap://ldap.example.com:389
ipa-compat-manage disable
systemctl restart dirsrv.target
ipa config-mod --enable-migration=TRUE
ipa migrate-ds --your-options ldap://ldap.example.com:389
ipa migrate-ds --your-options --with-compat ldap://ldap.example.com:389
ipa-compat-manage enable
systemctl restart dirsrv.target
ipa config-mod --enable-migration=FALSE
ipa-client-install --enable-dns-update
https://ipaserver.example.com/ipa/migration
ldapsearch -LL -x -D 'cn=Directory Manager' -w secret -b 'cn=users,cn=accounts,dc=example,dc=com' '(&(!(krbprincipalkey= ))(userpassword= ))' uid
ipa user-show --all testing_user dn: uid=testing_user,cn=users,cn=accounts,dc=idm,dc=example,dc=com User login: testing_user First name: testing Last name: user Full name: testing user Display name: testing user Initials: tu Home directory: /home/testing_user GECOS: testing user Login shell: /bin/sh Principal name: testing_user@IDM.EXAMPLE.COM Principal alias: testing_user@IDM.EXAMPLE.COM Email address: testing_user@idm.example.com UID: 1689700012 GID: 1689700012 Account disabled: False Preserved user: False Password: False Member of groups: ipausers Kerberos keys available: False ipauniqueid: 843b1ac8-6e38-11ec-8dfe-5254005aad3e mepmanagedentry: cn=testing_user,cn=groups,cn=accounts,dc=idm,dc=example,dc=com objectclass: top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser, ipaSshGroupOfPubKeys, mepOriginEntry
ipa migrate-ds --ca-cert-file= /tmp/remote.crt --your-other-options ldaps:// ldap.example.com :636
ipa user-show --all testing_user dn: uid=testing_user,cn=users,cn=accounts,dc=idm,dc=example,dc=com User login: testing_user First name: testing Last name: user Full name: testing user Display name: testing user Initials: tu Home directory: /home/testing_user GECOS: testing user Login shell: /bin/sh Principal name: testing_user@IDM.EXAMPLE.COM Principal alias: testing_user@IDM.EXAMPLE.COM Email address: testing_user@idm.example.com UID: 1689700012 GID: 1689700012 Account disabled: False Preserved user: False Password: False Member of groups: ipausers Kerberos keys available: False ipauniqueid: 843b1ac8-6e38-11ec-8dfe-5254005aad3e mepmanagedentry: cn=testing_user,cn=groups,cn=accounts,dc=idm,dc=example,dc=com objectclass: top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser, ipaSshGroupOfPubKeys, mepOriginEntry