<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> </head> <body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""> This is something I’ve looked at lately and a manual proof of concept I just did (using ideas from <a href="https://www.freeipa.org/page/Howto/Migration#Migrating_from_other_FreeIPA_to_FreeIPA" class=""> https://www.freeipa.org/page/Howto/Migration#Migrating_from_other_FreeIPA_to_FreeIPA</a>) makes it seem theoretically possible (though it looks like, barring the migration of the kerberos master key, all enrolled hosts would need to use ipa-getkeytab to get a replacement keytab from the new server and copy it to /etc/krb5.keytab so that sssd will work properly..the alternative is re-enrollment. All other keytabs in use by other applications would have to be similarly replaced). <div class=""><br class=""> </div> <div class="">Is <a href="https://fedorahosted.org/freeipa/ticket/3656" class="">https://fedorahosted.org/freeipa/ticket/3656</a> something that’s coming sooner or later to a future version of FreeIPA? Has anyone done a manual migration on a moderate-to-large setup?</div> </body> </html>