On to, 16 kesä 2022, rui liang via FreeIPA-users wrote:
I want to migrate the old freeipa LDAP server to a new Freeipa
server.
However, after using this migration scheme, I find that the old keytab
file cannot be logged in. How do I set up the old keytab file to work
properly?
You don't. None of Kerberos content is migratable this way. New
deployment would have different master keys and most likely also
different Kerberos realm.
If you don't plan to change IPA Kebreros realm, using replica approach
is better and should be used instead.
This page explicitly states:
Users and groups can be migrated using the migrate-ds command, just like
with any other LDAP based identity management server. You just need to
make sure that FreeIPA Kerberos related attributes are not migrated as
they need to be generated again by the new FreeIPA server and it's new
Kerberos settings or keys.
echo Secret123 | ipa migrate-ds --bind-dn="cn=Directory Manager"
--user-container=cn=users,cn=accounts --group-container=cn=groups,cn=accounts
--group-objectclass=posixgroup
--user-ignore-attribute={krbPrincipalName,krbextradata,krblastfailedauth,krblastpwdchange,krblastsuccessfulauth,krbloginfailedcount,krbpasswordexpiration,krbticketflags,krbpwdpolicyreference,mepManagedEntry}
--user-ignore-objectclass=mepOriginEntry --with-compat
ldap://migrated.freeipa.server.test
ssh new.migrated.freeipa.server.test
Use the old keytab file
root@migration-ipa-65:/home/liangrui# kinit -kt roy.keytab roy
kinit: Generic preauthentication failure while getting initial credentials
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland