On to, 16 kesä 2022, rui liang via FreeIPA-users wrote:
> On to, 16 kesä 2022, rui liang via FreeIPA-users wrote:
>
> You don't. None of Kerberos content is migratable this way. New
> deployment would have different master keys and most likely also
> different Kerberos realm.
>
> If you don't plan to change IPA Kebreros realm, using replica approach
> is better and should be used instead.
>
>
> This page explicitly states:
>
> Users and groups can be migrated using the migrate-ds command, just like
> with any other LDAP based identity management server. You just need to
> make sure that FreeIPA Kerberos related attributes are not migrated as
> they need to be generated again by the new FreeIPA server and it's new
> Kerberos settings or keys.
Method 3: Using SSSD (Recommended)
SSSD attempts to perform Kerberos authentication against the IdM
server.
IdM intercepts this bind request. If the user has a Kerberos principal
but no Kerberos hashes, then the IdM identity provider generates the
hashes and stores them in the user entry. If authentication is
successful, SSSD disconnects from IdM and tries Kerberos authentication
again. This time, the request succeeds because the hash exists in the
entry.
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
The description here seems to solve this problem, but is there a
detailed tutorial on how to do it?thank you
It will regenerate Kerberos keys from scratch so your existing keytab
would not be useful. You'd need to retrieve or create a new one.
There is no more detailed tutorial because there is nothing more to it.
It is really like that -- somebody does LDAP bind when migration mode is
enabled and upon verification of the LDAP password Kerberos keys will be
generated automatically. Whether it is done through SSSD login or direct
LDAP bind or through an IPA Web UI migration page, it is irrelevant
because they all boil down to the same LDAP bind operation in the end.
Your previous Kerberos keys aren't possible to reuse.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland