<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Hi,<br>
</div>
<blockquote
cite="mid:CANRySME3kSOZ+ZMZCPc_Tx0ygJJctnwZKC_bnw_8Qgb=HFGqyA@mail.gmail.com"
type="cite">
<div dir="ltr">Hi all,
<div><br>
</div>
<div>I'm part of the CMU Computer Club and our Kerberos/LDAP
deployment has been a pain point for quite some time. I've
heard that FreeIPA might be a solution worth exploring.</div>
<div><br>
</div>
<div>I would like to try to avoid user visible disruption if
possible, however. This means that we would like to keep our
Kerberos realm name, keep AFS cross-realm authentication
working, etc. UIDs remaining the same would be good; I'd have
to think about <br>
</div>
</div>
</blockquote>
We dont use cross realm. We created a new realm with new name. We
used ipa migrade-ds to migrate users/groups with uids. <br>
<br>
Because we couldnt migrate the user passwords from old to new realm,
we reset the users password in the new IPA realm and let the users
input a new password once. <br>
<blockquote
cite="mid:CANRySME3kSOZ+ZMZCPc_Tx0ygJJctnwZKC_bnw_8Qgb=HFGqyA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>Essentially all of our clients are various flavors of
Debian; mostly Jessie (we have an unfortunate number of older
machines that I hope to upgrade soon).</div>
<div><br>
</div>
<div>Has anyone done something like this before? Anyone have
any ideas what the migration path would look like or whether
this is even possible? <br>
</div>
</div>
</blockquote>
I have the same situation. We have an old MIT Kerberos / OpenLDAP
system which we have to migrate. We use FreeIPA 4.2 on Fedora 23
and the current OpenAFS release and simply said: it works. Our first
milestone was to migrate webplattforms and all behind them (apache
with kerberos auth and data in AFS) first and after them with more
experience with the afs / freeipa combination we want to migrate the
user homes and client desktops.<br>
<br>
<blockquote
cite="mid:CANRySME3kSOZ+ZMZCPc_Tx0ygJJctnwZKC_bnw_8Qgb=HFGqyA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br clear="all">
<div>
<div class="gmail_signature"
data-smartmail="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div>
<div dir="ltr">Thanks,
<div><br>
</div>
<div>Grant Wu</div>
<div><a moz-do-not-send="true"
href="mailto:grantwu@andrew.cmu.edu"
style="color:rgb(17,85,204);font-size:small"
target="_blank">grantwu@andrew.cmu.edu</a><br>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
regards,<br>
Andreas<br>
</body>
</html>