<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 03/19/2012 06:54 PM, Marco Pizzoli wrote: <blockquote cite="mid:CAMrrtwsYvrCyKWP2A5hJ0nh-m_1vgUEzy6fJ1eW2ENrrD-nQ+A@mail.gmail.com" type="cite"> <div class="gmail_quote">On Mon, Mar 19, 2012 at 8:31 PM, Rob Crittenden <<a moz-do-not-send="true" href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> Marco Pizzoli wrote: <blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"> <div class="im"> On Mon, Mar 19, 2012 at 2:42 PM, Rob Crittenden <<a moz-do-not-send="true" href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a> </div> <div class="im"> <mailto:<a moz-do-not-send="true" href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>> wrote: Dmitri Pal wrote: On 03/17/2012 07:36 AM, Marco Pizzoli wrote: Hi guys, I'm trying to migrate my ldap user base to freeipa. I'm using the last Release Candidate. I already changed "ipa config-mod --enable-migration=TRUE" This is what I have: ipa -v migrate-ds </div> --bind-dn="cn=manager,dc=__mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">mydc2.it</a> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>>" --user-container="ou=people,__dc=mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">mydc2.it</a> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>>" --user-objectclass=__inetOrgPerson --group-container="ou=groups,__dc=mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">mydc2.it</a> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>>" --group-objectclass=posixGroup --base-dn="dc=mydc1,dc=mydc2.__it <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>> <div class="im"> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>>" --with-compat <a class="moz-txt-link-freetext" href="ldap://ldap01">ldap://ldap01</a> ipa: INFO: trying </div> <a moz-do-not-send="true" href="https://freeipa01.unix." target="_blank">https://freeipa01.unix.</a>__<a moz-do-not-send="true" href="http://mydomain.it/ipa/xml" target="_blank">mydomain.it/ipa/xml</a> <div class="im"> <<a moz-do-not-send="true" href="https://freeipa01.unix.mydomain.it/ipa/xml" target="_blank">https://freeipa01.unix.mydomain.it/ipa/xml</a>> Password: ipa: INFO: Forwarding 'migrate_ds' to server </div> u'<a moz-do-not-send="true" href="http://freeipa01.unix." target="_blank">http://freeipa01.unix.</a>__<a moz-do-not-send="true" href="http://mydomain.it/ipa/xml" target="_blank">mydomain.it/ipa/xml</a> <div class="im"> <<a moz-do-not-send="true" href="http://freeipa01.unix.mydomain.it/ipa/xml" target="_blank">http://freeipa01.unix.mydomain.it/ipa/xml</a>>' ipa: ERROR: Container for group not found at ou=groups,dc=mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">mydc2.it</a> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>> <<a moz-do-not-send="true" href="http://mydc2.it" target="_blank">http://mydc2.it</a>> I looked at my ldap server logs and I found out that the search executed has scope=1. Actually both for users and groups. This is a problem for me, in having a lot of subtrees (ou) in which my users and groups are. Is there a way to manage this? Thanks in advance Marco P.s. As a side note, I suppose there's a typo in the verbose message I obtain in my output: ipa: INFO: Forwarding 'migrate_ds' to server </div> *u*'<a moz-do-not-send="true" href="http://freeipa01.unix." target="_blank">http://freeipa01.unix.</a>__<a moz-do-not-send="true" href="http://mydomain.it/ipa/xml" target="_blank">mydomain.it/ipa/xml</a> <div> <div class="h5"> <<a moz-do-not-send="true" href="http://freeipa01.unix.mydomain.it/ipa/xml" target="_blank">http://freeipa01.unix.mydomain.it/ipa/xml</a>>' Please open tickets for both issues. Well, I don't think either is a bug. If you have users/groups in multiple places you'll need to migrate them individually for now. It is safe to run migrate-ds multiple times, existing users are not migrated. I just re-executed by specifing a nested ou for my groups. This is what I got: ipa: INFO: trying <a moz-do-not-send="true" href="https://freeipa01.unix.csebo.it/ipa/xml" target="_blank">https://freeipa01.unix.csebo.it/ipa/xml</a> ipa: INFO: Forwarding 'migrate_ds' to server u'<a moz-do-not-send="true" href="http://freeipa01.unix.csebo.it/ipa/xml" target="_blank">http://freeipa01.unix.csebo.it/ipa/xml</a>' ----------- migrate-ds: ----------- Migrated: Failed user: fw03075_no: Type or value exists: [other users listed] Failed group: pdbac32: Type or value exists: [other groups listed] ---------- Passwords have been migrated in pre-hashed format. IPA is unable to generate Kerberos keys unless provided with clear text passwords. All migrated users need to login at <a moz-do-not-send="true" href="https://your.domain/ipa/migration/" target="_blank">https://your.domain/ipa/migration/</a> before they can use their Kerberos accounts. I don't understand what it's trying to telling me. On my FreeIPA ldap server I don't see any imported user. What's my fault here? The u is a python-ism for unicode. This is not a bug. Please, could you give a little more detail on this? It's only a hint on what that data represents in a Python variable? Thanks again Marco </div> </div> </blockquote> Type or value exists occurs when one tries to add an attribute value to an entry that already exists. I suspect that the underlying problem is different between users and groups. For groups it is likely adding a duplicate member. For users I'm not really sure. It could be one of the POSIX attributes. What does a failed entry look like? rob </blockquote> </div> The user entry: ------------------------ dn: uid=fw03075_NO,ou=People,dc=mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it">mydc2.it</a> description: fw03075 cn: fw03075 uidNumber: 11013 gidNumber: 503 homeDirectory: /home/fw03075 loginShell: /bin/sh gecos: fw03075 shadowLastChange: 13059 shadowMax: 99999 shadowWarning: 7 objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount objectClass: top objectClass: xxxPeopleAttributes sn: SN_NON_IMPOSTATO givenName: GIVENNAME_NON_IMPOSTATO xxxUfficio: UFFICIO_NON_IMPOSTATO xxxTipoUtente: tecnico uid: fw03075_NO userPassword: secret group entry: ------------------- dn: cn=pdbac32,ou=pdbac32,ou=prod,ou=db2,ou=databases,ou=Groups,dc=mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it">mydc2.it</a> gidNumber: 10015 member: uid=NESSUNO,ou=People,dc=mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it">mydc2.it</a> member: uid=aaa415,ou=People,dc=mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it">mydc2.it</a> member: uid=bbb446,ou=People,dc=mydc1,dc=<a moz-do-not-send="true" href="http://mydc2.it">mydc2.it</a> memberUid: NESSUNO memberUid: aaa415 memberUid: bbb446 xxxAmbiente: prod xxxDB2GruppiPrivilegi: instance_owner description: Mydescription xxxTipoGruppo: db objectClass: top objectClass: posixGroup objectClass: groupOfNames objectClass: xxxGroupsAttributes objectClass: xxxDB2GroupsAttributes cn: pdbac32 Thanks again Marco <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> Do you by any chance have a group with name "fw03075_NO" and user with name "pdbac32"? May be you are hitting a collision on manged group managed? <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>