<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Mon, Mar 9, 2015 at 2:45 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Mon, 09 Mar 2015, Ben Slusky wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Greetings FreeIPA users, I'm setting up FreeIPA service in our production environment to replace several different authentication methods for various systems. I'm trying to migrate the first wave of users now My plan was to copy their passwords from an old LDAP directory (one of the aforementioned several authentication methods) and then send them to the migration page to finish the job. </blockquote> Even in migration mode, you can only set pre-hashed passwords when creating the records, not when modifying them. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> bslusky@ipa1.aws:~$ head techteam-passwords.ldif dn: uid=user1001,cn=users,cn=accounts,dc=smartling,dc=int changeType: modify replace: userPassword userPassword:: e1NTSE[...] - dn: uid=user1002,cn=users,cn=accounts,dc=smartling,dc=int changeType: modify replace: userPassword userPassword:: e1NIQX[...] Unfortunately it isn't working: bslusky@ipa1.aws:~$ ldapmodify -x -D cn=directory\ manager -W -f techteam-passwords.ldif Enter LDAP Password: modifying entry "uid=user1001,cn=users,cn=accounts,dc=smartling,dc=int" ldap_modify: Operations error (1) I found some possible causes of this error, and fixed them: bslusky@ipa1.aws:~$ ipa config-show |grep migration Enable migration mode: TRUE bslusky@ipa1.aws:~$ ldapsearch -x -D cn=directory\ manager -W -b cn=config |grep allow-hashed Enter LDAP Password: nsslapd-allow-hashed-passwords: on Still no soap. Any suggestions? </blockquote> Works as designed. We only allow unhashed passwords in migration mode when entry is added, not modified. -- / Alexander Bokovoy </blockquote><div> </div><div>Alexander: Thanks for clarifying that. </div><div>To anyone dealing with this or a similar problem who might find this in a web search: </div><div style="margin-left:40px">ipa user-add user0001 --first=User --last=0001 --setattr=userPassword='{SHA}...' </div><div>works like a charm (if migration mode is enabled). </div></div> -- <div class="gmail_signature"><div dir="ltr"><div></div>Ben Slusky Smartling, Inc. Senior Operations Engineer <a href="mailto:bslusky@smartling.com" style="font-family:arial;font-size:small;color:rgb(17,65,112)" target="_blank">bslusky@smartling.com</a> | <a href="http://www.smartling.com/" style="font-family:arial;font-size:small;color:rgb(17,65,112)" target="_blank">smartling.com</a><a value="+18667076278"> </a></div></div> </div></div>