Finn Fysj via FreeIPA-users wrote:
What's the use-case for this?
I think this is likely because migration currently doesn't support
user-private groups and a default IPA user doesn't have a memberof their
private groups.
migrate-ds was designed to migrate users who used only LDAP to use IPA.
IPA to IPA migration is possible for users and groups but its full of
pitfalls. This may be another one.
rob
Understood.
When I try to delete the User Groups itself and try a new migration, the user will be
member of these groups again...
I'm experiencing a lot of inconsistency with my server + replica setup:
- I'm not able to ssh into my IPA servers, even tho I have created an allow_all
HBAC. I don't find anything relevant in the logs after settings debug_level = 9, other
than: [ipa_pam_access_handler_done] (0x0020): [RID#16] Unable to fetch HBAC rules [22]:
Invalid argument.
- In the log file I get the service: sshd, but shouldn't the log file also include
testing of HBAC rules? Now it suddenly doens't do this.
- Whenever I create a HBAC rule on my server, it takes a long time for it to be synced
to the replica, however, if something is created on the replica server this is synced
immediately.