Product SiteDocumentation Site

17.3. Scenario 2: Migrating an LDAP Server Directly to FreeIPA


This is a general migration procedure, but it may not work in every environment.
It is strongly recommended that you set up a test LDAP environment and test the migration process before attempting to migrate the real LDAP environment.
  1. Install the FreeIPA server, including any custom LDAP directory schema[4], on a different machine from the existing LDAP directory.
  2. Enable the FreeIPA server to allow migration:
    # ipa config-mod --enable-migration=TRUE
  3. Run the FreeIPA migration script, ipa migrate-ds. At its most basic, this requires only the LDAP URL of the LDAP directory instance to migrate:
    # ipa migrate-ds ldap://
    The ipa migrate-ds command connects to the LDAP directory and binds as the Directory Manager and extracts all entries with the person object class from the ou=People subtree, by default. A different subtree can be specified using the --user-container option.
    This script also exports all entries from the ou=Groups subtree to maintain group memberships. The group can be changed using the --group-container option.
    Once the information is exported, the script adds all required FreeIPA object classes and attributes and coverts DNs in attributes to match the FreeIPA directory tree.
    For example:
    # ipa migrate-ds --user-container=ou=employees,dc=example,dc=com --group-container="ou=employee groups,dc=example,dc=com" ldap://
  4. Update the client configuration to use PAM_LDAP and NSS_LDAP to connect to FreeIPA instead of connecting to an LDAP directory, NIS, or local files.
  5. Optional. Set up SSSD. Using SSSD migrates user passwords without additional user interaction, as described in Section 17.1.2, “Planning Password Migration”.
    1. Install SSSD on every client machine:
      # yum install sssd
    2. Run the ipa-client-install to configure SSSD and related services to use the FreeIPA server for identity and Kerber authentication.
  6. Instruct users to log into FreeIPA using either SSSD client or the migration web page if SSSD is not available on the client. Both methods automatically migrate the user password into FreeIPA.
  7. Optional. Reconfigure non-SSSD clients to use Kerberos authentication (pam_krb5) instead of LDAP authentication (pam_ldap).


    Use PAM_LDAP modules until all of the users have been migrated; then it is possible to use PAM_KRB5.
  8. When the migration of all clients and users is complete, decommission the LDAP directory.

[4] There is limited support for custom user and group schema in FreeIPA.