I am aware that questions about migration to LDAP are nothing new. I've searched for info for quite a bit now, but the problem I found is that information seems rather fragmented on the topic. So I hope that someone experienced can point me to the right direction.
The current situation:
- Small enterprise, growing in users and desktops
- About 10 Fedora-20 desktops / 3 Fedora-20 servers
- 1 Synology NAS DS1813+
- About 10 users
- All logins are local on the desktops
- Users DO NOT have the same UIDs and GIDs across the network of machines.
Obviously, it becomes more and more attractive to use a centralised user directory such as LDAP.
The problem:
Unfortunately, I was not able to find reliable and complete guides that cover the whole process for a real-life scenario.
- Setting up the server and configuring the clients: OK, from what I read, not the most streamlined process, but even if a bit tricky I believe this is doable.
- Migrating all users, from all machines: here's the "delicate" part. Obviously, I don't want to risk any information loss. Again, I've found some guides about migration and about the MigrationTools, but none of such sources gives me the feeling of a trustworthy guide. Typical scenario: there's a wiki page or something with instructions and a huge pile of comments complaining that the procedure failed at some point. The questions raised are often way more than the answers given. How can this make me feel I can safely start this process?
Some specific questions:
- Is there an up-to-date set of best practices / advised tools that one should certainly consider for such migration process? In particular with attention to real-life scenarios? Which sequence of actions to follow, what to pay attention to, how to minimise the risks of data loss, how to minimise the down-time for users, etc?
- Suppose user 'roberto' is present (with different IDs) on two machines. By migrating /etc/passwd information from both machines to LDAP, are they "merged" during the process? If not, what should be done?
- Can the migration be done in steps, only for one user to start with? Is it advisable?
- Another (perhaps naive?) approach I could think of is: create new LDAP users, then change ownership of all files from old local users to these new users, then remove old local users. Does this make sense at all? Any previous experience?
- How does LDAP relate to ACL? Do they go well together?
- The following desired step is to centralise users' home directories to a shared space on NFS. Any pointer to this following step would also be welcome, especially if linked to the migration to LDAP.