I'm using LDAP used (mostly) as a backend for user authentication (pam, samba, web,...).
Now I'm trying to migrate the LDAP-database to a new root-dn.
old root-dn:
dc=local
new root-dn:
dc=example,dc=com
The process is simple enough,e.g.
dump to ldif
change the root-dn (e.g. with sed) in the ldif file
drop old database
import ldif
Now, I would like to ensure, that the numerous clients don't experience excessive downtime (due to the changed root-dn), since (afaict) all clients have the root-DN hardcoded in the configurations.
I'm worried because when I switch the root-dn, I have to manually update each client, so the last client updated will have a prolonged downtime (well, not downtime, but users won't be able to authenticate...)
So I was thinking about exposing my tree under both the old and new root-dn until the configuration on all clients has been migrated, eventually using a proxy
.
Is my approach correct (e.g. best practice)? Are there (better) alternatives?