Finn Fysj via FreeIPA-users wrote:
Finn Fysj via FreeIPA-users wrote:
mepOriginEntry is how private groups are implemented.
For more information on migrated private groups see https://rcritten.wordpress.com/2018/09/05/migration-and-user-private-groups/
rob
Thank you for answering, Rob.
I've preivously looked at the source you reference to. I might need an explaination to: You just need to make sure that FreeIPA Kerberos related attributes are not migrated as they need to be generated again by the new FreeIPA server and it’s new Kerberos settings or keys.
Why? What can be the challenges we face?
If you migrate the Kerberos keys and principals they will be for the original realm and will not work.
LDAP passwords are migrated by allowing password migration in ipa-config. When this mode is enabled, if an LDAP bind occurs and there are no Kerberos keys then they are generated automatically if they don't already exist.
This hasn't been any problems with the test servers I've configured.
Because it sounds like you aren't using Kerberos at all.
I also need to understand the use of private groups in FreeIPA. We're planning to solely use FreeIPA as LDAP for LDAP connections only. Where the IPA servers is the only servers a KINIT would make sense. Could we face issues NOT migrating private groups when using FreeIPA as an LDAP server (w/gui)?
RHEL and Fedora have used private user groups for decades now. The definition being that when a user is created they get a group with the same id and no members.
An IPA user-private group is similar in nature in that it has the same uid/gid. It also lacks the objectclasses to allow members.
A migrated group will retain the same GID but is a regular group.
This is most noticeable when you have a lot of users, so therefore a lot of private groups. Private groups are filtered out by default when looking at the list of groups. That will not happen after migration.
I'm really not sure what your use-case is here. Do you have an existing broken IPA server? I have the impression you are starting out new.
rob