Finn Fysj via FreeIPA-users wrote:
mepOriginEntry is how private groups are implemented.
For more information on migrated private groups see https://rcritten.wordpress.com/2018/09/05/migration-and-user-private-groups/
rob
Thank you for answering, Rob.
I've preivously looked at the source you reference to. I might need an explaination to: You just need to make sure that FreeIPA Kerberos related attributes are not migrated as they need to be generated again by the new FreeIPA server and it’s new Kerberos settings or keys.
Why? What can be the challenges we face? This hasn't been any problems with the test servers I've configured.
I also need to understand the use of private groups in FreeIPA. We're planning to solely use FreeIPA as LDAP for LDAP connections only. Where the IPA servers is the only servers a KINIT would make sense. Could we face issues NOT migrating private groups when using FreeIPA as an LDAP server (w/gui)?