<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/08/2014 09:47 AM, Andreas Ladanyi
wrote:<br>
</div>
<blockquote cite="mid:54354073.5020904@kit.edu" type="cite">
<pre wrap="">Hello,
i have the following situation:
OpenLDAP with user entries. No userPassword hashes are available.
MIT Kerberos with principals and password hashes in the KRB DB.
I have migrated the user and group accounts via "ipa migrate-ds ..."
successfully.
Now, is it possible to get out the kerberos user principal password
hashes from the KRB own DB to the appropriate krbPassword..... IPA LDAP
attribute, so the users could login without any extra user action ?
cheers,
Andy
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
This will be a highly manual process.<br>
AFAIR it has been done couple times so please search archives 2-3
years ago. Simo was the person who provided the steps.<br>
<br>
You would need to not only migrate the hashes by extracting the
fields from DB and loading them into LDAP using raw LDAP commands
and ldif but also copy over and set the kerberos master key.<br>
If you are up to it and dig out the instructions we would really
appreciate if you can then put them on a wiki as a solution:
<a class="moz-txt-link-freetext" href="http://www.freeipa.org/page/HowTos">http://www.freeipa.org/page/HowTos</a><br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>