Migrate LDAP records to FreeIPA and populate POSIX

Michael Angel P.

1/3/24, 4:32 PM

We have a legacy application that we manage the employees, this application connects to an ApacheDS and provides LDAP authentication trough it. Now we want to implement FreeIPA but not as the source of truth but as our new LDAP system, the ipa migrate-ds command won't work as ApacheDS does not have POSIX values.

I have thought about exporting an ldif from ApacheDS, altering the file in order to work with OpenLDAP, then import the users in OpenLDAP generating the POSIX values and then migrate from OpenLDAP to FreeIPA. Or writing a script that adds the POSIX UID/GID, then import it to OpenLDAP, and then to FreeIPA as it cannot directly import the ldif file.

Is there another way to do it? Also when the password is updated on the legacy system it needs to be updated on FreeIPA as well, and do a cross check on each day for deleted users on the ldif and run a query to delete them from OpenLDAP.

The best thing I can think of is a script in the following flow. Legacy System -> ApacheDS -> ldif -> script -> OpenLDAP -> FreeIPA

Is a way to import the users in FreeIPA and make it generate the POSIX there? OR load them with simple LDAP in FreeIPA, and run a query to add the POSIX?

134

1 + 0

ldap

apache-ds

freeipa

Score:0

Server

abbra

1/3/24, 7:56 PM

You can use lifecycle management feature in IPA. Stage users with LDAP modify, then activate them. This would add POSIX information automatically. See https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/managing_idm_users_groups_hosts_and_access_control_rules/using-ldapmodify-to-manage-idm-users-externally_managing-users-groups-hosts for details.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Migrate LDAP records to FreeIPA and populate POSIX

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.