So we might be in uncharted waters:-)
I think we will clone our Primary IPA server VM to a new VM, then test
with that VM to bind and reinit and see what happens. Hopefully, it
will continue to associate the accounts with the existing. Either way,
I will post back the results to this thread.
On Wed, Jul 14, 2021 at 10:53 AM Mark Reynolds <mreynolds(a)redhat.com> wrote:
>
>
> On 7/14/21 11:27 AM, Rob Crittenden wrote:
> > Jim Kilborn via FreeIPA-users wrote:
> >> We have migrated our AD users to a new domain (ie
example.com ->
examplenew.com)
> >> and I now need to change our IPA AD sync replication to use the new
> >> domain. I can remove the old replication agreement and create the new
> >> one, but my question is what happens to the users accounts. The AD
> >> usernames didnt change during the migration, but the SID will be
> >> different due to it being a new account in a new domain. Will IPA just
> >> associated that username with the one already in IPA, or will it try
> >> to create another account with a different UID/GID in ipa?
> > I'm honestly not sure what will happen. I suspect it will associate the
> > user with the existing on in IPA, but otherwise not change anything.
> >
> > So it won't see the new SID, for example.
> >
> > But I really don't know. This is not something that we on the IPA team
> > tested at all.
> >
> > cc'ing a 389 developer to see what they think.
>
> From a replication perspective, if the data source changed in such a
> fashion, then a reinit would be required with the new agreement.
> Replication would not detect a "difference" in an entry, it only
> replicates changes from the replication changelog. So if you did not
> reinit then I suspect replication would not even work, or if it did, you
> would be in an inconsistent state.
>
> HTH,
>
> Mark
>
> >
> > rob
> >
> --
> Directory Server Development Team
>