FreeIPA import hashed passwords or sync with another ldap

Michael Angel P.

1/9/24, 9:56 AM

We want to setup FreeIPA to work with our legacy user management system, we can output an ldif file and alter it into a FreeIPA compatible format and import it. Everything works nicely except for the hashed passwords, our ldif file includes the password pre-hashed, but when I import it with the account it does not work.

The imported users can connect to linux servers that are given permission for with their ssh key, but they cannot use passwords, I even manually altered the password with a SHA512 and tested it but it didn't work.

The admin user has been given the permission to change user passwords but to not expire them as part of the migration process (a dedicated user will be setup latter).

Is there a way to import hashed passwords or migrate them from another ldap into FreeIPA?

Alternatively, can I edit the user record with ldapmodify and add the hashed password?

452

1 + 0

ldap

user-management

ldif

freeipa

Score:1

Server

abbra

1/10/24, 7:47 AM

If you have pre-hashed passwords in the entries but don't have Kerberos keys for these accounts, you should switch FreeIPA into a migration mode. SSSD on IPA clients will then notice this and will use LDAP bind instead of Kerberos to perform user authentication first time it logs in. This will cause to re-generate the password hashes serverside and generate Kerberos keys for the user principal.

For more details see https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/migrating_to_identity_management_on_rhel_8/migrating-from-an-ldap-directory-to-idm_migrating-to-idm-from-external-sources#planning-password-migration-when-migrating-from-ldap-to-idm_migrating-from-an-ldap-directory-to-idm

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: FreeIPA import hashed passwords or sync with another ldap

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.