1

I am trying to move our data from FreeIPA 3.3 CentOS 6.5 to FreeIPA 4 on Fedora 21

  1. I tried to create a replica on IPA 4.1.2 with IPA 3.3 but it didn't work

Got this error 

Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds
  [1/22]: creating certificate server user
  [2/22]: configuring certificate server instance
ipa         : CRITICAL failed to configure ca instance Command ''/usr/sbin/pkispawn' '-s' 'CA' '-f' '/tmp/tmp9RduZt'' returned non-zero exit status 1
  [error] RuntimeError: Configuration of CA failed

So I moved on with my second option backup and restore.

  1. I used these two commands

Backup 

db2ldif -Z serverID  -n userRoot -a export.ldif

Restore 

ldif2db -D "directory manager" -n userRoot -i export.ldif

The data was imported but after that I couldn't login with my admin credentials which were created while installation process.

Could anyone help in this ?

Improve this question

2 Answers 2

Reset to default
0

I am not sure what you mean by moving your data.

  • If you want to just upgrade from FreeIPA 3.4 to the latest FreeIPA 4.1.2, you can just do it and update the packages/OS (HOWTO article).
  • If you want to move to different operating system without upgrade old one, you will need to create the replica (HOWTO article).
  • If you want to ditch your current FreeIPA realm and create a new one, the best way is to install a fresh FreeIPA server and then use migrate-ds command to migrate your users. Migrating other entries would be up to you, FreeIPA-FreeIPA migration script is not there, yet.

Just note that you cannot just create a new replica and replace the LDAP DIT. Not only that the data version and FreeIPA version will not match, but you will also break your FreeIPA as the new FreeIPA has different PKI/Kerberos keys and data won't match.

If you are trying to install a replica and you are hitting the error, please collect ipareplica-install.log and all PKI logs and report a bug to FreeIPA/Dogtag Trac or freeipa-users list.

Improve this answer
0
  1. The best way is migrate using newer replica. Which error did you hit?
  2. LDAP data needs update from 3.x to 4.x, you will hit some issues. This will not work.

If you need just migrate users, you can try migrate-ds script.

Improve this answer
1
  • I am getting RuntimeError: Configuration of CA failed
    – Dina Abu-khader
    Jan 26, 2015 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .