[Freeipa-users] Migrate users with password from one IPA to another

[Rene Trippen]

Hi,

is it possible to transfer the Kerberos Master Key to the new IPA Server?

- rene

On 31.08.2016 10:57, Rene Trippen wrote:
> On 25.08.2016 19:44, Rob Crittenden wrote:
>> Rene Trippen wrote:
>>> Hi,
>>>
>>> I`ve got an IPA with a broken CA infrastructure (don`t know what
>>> happened, but new clients cannot be registered)
>>> It is even not possible to setup a new replica.
>>
>> It may be fairly straightforward to getting the CA back up. How is it
>> broken?
>>
> I don't know how that happened exactly, we had an IPA 3.x Server, then 
> we migrated it to another machine and upgraded to IPA 4.1, later, we 
> upgraded (on the same machine) to IPA 4.2.
> The IPA Server is basically working, but when I want to register a new 
> machine, the registration process fails with following (I think these 
> are the relevant lines) error
>
> 2016-08-30T22:40:25Z DEBUG flushing ldap://ipa.internal.domain:389 
> from SchemaCache
> 2016-08-30T22:40:25Z DEBUG retrieving schema for SchemaCache 
> url=ldap://ipa.internal.domain:389 
> conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x375d5a8>
> 2016-08-30T22:40:26Z DEBUG Adding CA certificates to the IPA NSS 
> database.
> 2016-08-30T22:40:26Z DEBUG Starting external process
> 2016-08-30T22:40:26Z DEBUG args='/usr/bin/certutil' '-d' 
> '/etc/ipa/nssdb' '-A' '-n' 'INTERNAL.DOMAIN IPA CA' '-t' 'CT,C,C'
> 2016-08-30T22:40:26Z DEBUG Process finished, return code=0
> 2016-08-30T22:40:26Z DEBUG stdout=
> 2016-08-30T22:40:26Z DEBUG stderr=
> 2016-08-30T22:40:26Z DEBUG Starting external process
> 2016-08-30T22:40:26Z DEBUG args='/usr/bin/certutil' '-d' 
> '/etc/ipa/nssdb' '-A' '-n' 'INTERNAL.DOMAIN IPA CA' '-t' 'CT,C,C'
> 2016-08-30T22:40:26Z DEBUG Process finished, return code=255
> 2016-08-30T22:40:26Z DEBUG stdout=
> 2016-08-30T22:40:26Z DEBUG stderr=certutil: could not add certificate 
> to token or database: SEC_ERROR_ADDING_CERT: Error adding certificate 
> to database.
>
> 2016-08-30T22:40:26Z ERROR Failed to add INTERNAL.DOMAIN IPA CA to the 
> IPA NSS database.
> 2016-08-30T22:40:26Z ERROR Installation failed. Rolling back changes.
>
>
> The client tries to add 2 certificates, but fails with the second, I 
> think, it is because we have 2 CA certificates (one from the old IPA 
> 3.x server and one from the new 4.x server). My current workaround is 
> to register the client with an ipa3.x client, then I do an upgrade to 
> the 4.x client
>
> I've tried many ways to setup a new CA:
> - tried ipa-cacert-manage renew
> - tried to setup a new replica with new CA, but the setup failed with 
> the same problems described above
> - tried to remove all old certificates refering to the old ipa server 
> (but I think I failed somewhere)
>
> My thoughts are, the CA is in a bad condition, and I spent much time 
> in trying to fix it, with no success. And, my fears are, if I find 
> some crude, not documented workaround for the CA problem, the problem 
> maybe pops up at the next update. So, setting up a fresh IPA and 
> migrating everything (except the clients), was my hope to get an IPA 
> running without all the CA problems. Migrating the clients is not the 
> problem, that can be done by script (spacewalk or ansible), but 
> migrating the users is not that easy, because the users cannot be 
> scripted :)
>
>
>>> So, I wanted to setup a new IPA Server with new CA, and I want to move
>>> all users with their passwords to the new IPA instance.
>>> I`ve tried with 'ipa migrate-ds'
>>>
>>> ipa migrate-ds --continue --bind-dn="cn=Directory Manager"
>>> --user-container=cn=users,cn=accounts
>>> --group-container=cn=groups,cn=accounts --group-objectclass=posixgroup
>>> --group-overwrite-gid --with-compat ldap://<ldapserver>
>>>
>>> The output is OK
>>> =======
>>> Passwords have been migrated in pre-hashed format.
>>> IPA is unable to generate Kerberos keys unless provided
>>> with clear text passwords. All migrated users need to
>>> login at https://your.domain/ipa/migration/ before they
>>> can use their Kerberos accounts.
>>> ========
>>>
>>> But  the ipa/migration website is not working for me.
>>> Anyway, is there a way to export the users with passwords? I think I
>>> have to export some kerberos specific stuff from the old IPA?
>>
>> The log file /var/log/httpd/error_log may have details on what isn't
>> working.
>
> Sorry, that was not clearly described:
>
> The site is basically working, but when I enter the password, nothing 
> happens in the backend (I cannot login with my user on the ipa login 
> site).
>
> - rene
>
>>
>> The way to export users with passwords is the method you've already
>> tried. To not have to change a password at all would require the same
>> Kerberos master key and these are generated randomly at install time.
>>
>> rob
>>
>