Jeff B wrote:
I'm trying to test out migration from an Apple Open Directory Server
to FreeIPA (unstable) The command I'm running is:

ipa config-mod --enable-migration=true

ipa -d migrate-ds --user-container='cn=users,dc=xxx,dc=xxxx,dc=com'

It prompts me for a password twice, then gives me a invalid credentials error

ipa: INFO: Created connection context.xmlclient
Enter Password again to verify:
ipa: DEBUG: raw: migrate_ds(u'ldap://', u'********',
ipa: INFO: migrate_ds(u'ldap://', u'********',
binddn=u'cn=directory manager',
userobjectclass=(u'person',), groupobjectclass=(u'groupOfUniqueNames',
u'groupOfNames'), schema=u'RFC2307bis', continue=False,
exclude_groups=None, exclude_users=None)
ipa: INFO: Forwarding 'migrate_ds' to server u''
ipa: DEBUG: NSSConnection init
ipa: DEBUG: connect: port=443
ipa: DEBUG: connect:
ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer
ipa: DEBUG: cert valid True for ",O=XXXX.COM"
ipa: DEBUG: handshake complete, peer =
ipa: DEBUG: Caught fault 2100 from server Insufficient access:  Invalid
ipa: INFO: Destroyed connection context.xmlclient
ipa: ERROR: Insufficient access:  Invalid credentials

I'm able to connect to LDAP using the same password for cn="Directory
Manager" which it appears to be the user it's asking the password for.

Is this user error or a bug?  If user error what am I doing wrong?  Thanks.

Hmm, I'm stumped at this point. Can you look in your Apple DS logs to see if there is a bind error? You can use --binddn to bind as a different user.

I should also note that you don't want to include basedn for the user and group containers, cn=users and cn=groups is enough.


Freeipa-users mailing list

Reply via email to