<div class="gmail_quote">On Mon, Mar 19, 2012 at 1:43 PM, Simo Sorce <<a href="mailto:simo@redhat.com">simo@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class="HOEnZb"><div class="h5">On Sun, 2012-03-18 at 18:33 +0100, Marco Pizzoli wrote: > > > On Sun, Mar 18, 2012 at 5:49 PM, Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>> wrote: > On 03/17/2012 07:36 AM, Marco Pizzoli wrote: > > Hi guys, > > I'm trying to migrate my ldap user base to freeipa. I'm > > using the last Release Candidate. > > > > I already changed "ipa config-mod --enable-migration=TRUE" > > This is what I have: > > > > ipa -v migrate-ds > > --bind-dn="cn=manager,dc=mydc1,dc=<a href="http://mydc2.it" target="_blank">mydc2.it</a>" > > --user-container="ou=people,dc=mydc1,dc=<a href="http://mydc2.it" target="_blank">mydc2.it</a>" > > --user-objectclass=inetOrgPerson > > --group-container="ou=groups,dc=mydc1,dc=<a href="http://mydc2.it" target="_blank">mydc2.it</a>" > > --group-objectclass=posixGroup > > --base-dn="dc=mydc1,dc=<a href="http://mydc2.it" target="_blank">mydc2.it</a>" --with-compat ldap://ldap01 > > ipa: INFO: trying <a href="https://freeipa01.unix.mydomain.it/ipa/xml" target="_blank">https://freeipa01.unix.mydomain.it/ipa/xml</a> > > Password: > > ipa: INFO: Forwarding 'migrate_ds' to server > > u'<a href="http://freeipa01.unix.mydomain.it/ipa/xml" target="_blank">http://freeipa01.unix.mydomain.it/ipa/xml</a>' > > ipa: ERROR: Container for group not found at > > ou=groups,dc=mydc1,dc=<a href="http://mydc2.it" target="_blank">mydc2.it</a> > > > > I looked at my ldap server logs and I found out that the > > search executed has scope=1. Actually both for users and > > groups. This is a problem for me, in having a lot of > > subtrees (ou) in which my users and groups are. Is there a > > way to manage this? > > > > Thanks in advance > > Marco > > > > P.s. As a side note, I suppose there's a typo in the verbose > > message I obtain in my output: > > ipa: INFO: Forwarding 'migrate_ds' to server > > u'<a href="http://freeipa01.unix.mydomain.it/ipa/xml" target="_blank">http://freeipa01.unix.mydomain.it/ipa/xml</a>' > > > Please open tickets for both issues. > > > Done: > <a href="https://fedorahosted.org/freeipa/ticket/2547" target="_blank">https://fedorahosted.org/freeipa/ticket/2547</a> > <a href="https://fedorahosted.org/freeipa/ticket/2546" target="_blank">https://fedorahosted.org/freeipa/ticket/2546</a> > > Do you have a hint on how to manage to do this import in the meantime? > Every manual step is ok for me. </div></div>Maybe you can try performing a new migration for each of the subtrees you have in your source tree, assuming it is a reasonable number, by reconfiguring the migrate-ds bases between each run. </blockquote><div> Yes, I was thinking the same... :-) To be able to script "ipa migrate-ds", I would need a parameter for setting the password on the CLI. I suppose it isn't there by design, right? Thanks again Marco </div></div>