[SSSD-users] migrating from NIS to AD+kerberos

Jakub Hrozek jhrozek at redhat.com
Wed Feb 13 13:32:30 UTC 2013


On Wed, Feb 13, 2013 at 11:28:17AM +0000, Longina Przybyszewska wrote:
> 		
> 
> As a continuation of sssd evaluatin we  plan migration  from NIS  to Active Directory+Kerberos.
> 
> Now again the question - what is the best approach and practice to migrate users ?
> 
> AD administrators enabled SFU, and we got extended schema with POSIX attributes.
> I guess there might be some free or commercial tools for extracting data from NIS and loading into AD -ldap objects.
> 
> Our Linux users are dispersed in separated NIS domains, and all have  AD account beside the entry in NIS.
>  Home directories are  NFS-mounted   with autofs  from Linux storage server but some users access  MSWin storage with smbclient.
> 
> Can you share experiences on assigning POSTFIX attributes in SSSD context,  best practice etc..? 

                                    I assume you meant POSIX
                                    attributes.

> We would not like activate NIS services on AD server for migration.
> 
> Longina

Hi,

I don't know any tools to migrate users from NIS to AD myself, maybe
others on this list do.

In general starting with SSSD 1.9 you don't need to enable SFU and
populate the POSIX attributes at all, you can just use the SSSD
ID-mapping feature to map AD SIDs to UNIX IDs automatically. I'm not
sure if that's a good idea in your particular case, because most
probably the mapped attributes would be different than those you have
manually created in NIS. Just saying.


More information about the sssd-users mailing list