Migrate HBAC, sudo rules, users, groups and all of them to new IPA server

[Bryan Fang]

Hi folks,

As previous thread
https://lists.fedorahosted.org/archives/list/[e-mail]...
mentioned, and now it's 2023, I want to check if we can migrate all FreeIPA resource
from existing server to new server?
actually I can use ipa migrate-ds to migrate users and groups, however still need a way to
migrate other components, please share your ideas about this requirement, thanks a lot!
Best regards
Bryan

[Florence Blanc-Renaud]

Hi,

On Mon, Mar 20, 2023 at 8:00 AM Bryan Fang via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  Hi folks,
>
>  As previous thread
>
> https://lists.fedorahosted.org/archives/list/[e-mail]...
>  mentioned, and now it's 2023, I want to check if we can migrate all FreeIPA
>  resource from existing server to new server?
>  actually I can use ipa migrate-ds to migrate users and groups, however
>  still need a way to migrate other components, please share your ideas about
>  this requirement, thanks a lot!
>  
An RFE is filed for this feature (#3656
<https://pagure.io/freeipa/issue/3656> [RFE] FreeIPA-to-FreeIPA migration)
but it is still in the design phase (
https://freeipa.readthedocs.io/en/latest/designs/ipa_to_ipa_migration.html).
To migrate the other resources (non-user / non-group), you would have to
export the current LDAP tree to a ldif file, edit the ldif and then import
the edited ldif to the new server. See for instance this article [1].

flo

[1] https://access.redhat.com/articles/2949931

Best regards
>  Bryan
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue
>

[Bryan Fang]

Thanks for the quick response, do you have the export command in hand, I cannot find it
after google

[Florence Blanc-Renaud]

Hi,

On Tue, Mar 21, 2023 at 3:20 AM Bryan Fang via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt; wrote:

>  Thanks for the quick response, do you have the export command in
> hand, I
>  cannot find it after google
>  
an example is in the linked article:
# ldapsearch -h localhost -D 'cn=Directory Manager' -w password  -b
"cn=sudo,dc=example,dc=com" > /tmp/sudo_export
# ldapsearch -h localhost -D 'cn=Directory Manager' -w password  -b
"cn=dns,dc=example,dc=com" > /tmp/dns_export
# ldapsearch -h localhost -D 'cn=Directory Manager' -w password  -b
"cn=hbac,dc=example,dc=com" > /tmp/hbac_export

HTH,
flo

>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue
>

[Bryan Fang]

Hi flo,
thank you so much, these command is working as expected!
Best regards
Bryan