[Freeipa-users] Re: Installing FreeIPA server + replica using Ansible Role FreeIPA

Finn Fysj via FreeIPA-users wrote:

UPGs cannot be migrated at all. There is no risk. Some find it annoying to see a bunch of single-user groups in the interface, that's all.

rob

Thank you, Rob.

I've seen that the UPGs that get migrated have received following attributes:

ipaNTSecurityIdentifier ipantgroupattrs groupofnames nestedgroup ipausergroup

If I really want to keep UPGs I can use ipa group-mod --delattr=...

I'll do some more checking, but you're correct: I don't think we'll have the need for Kerberos unless on the IPA servers themselves, but if it's considered good practice too ignore krb attributes I'll do.

I'll try to do some more testing.