Migration from OpedLDAP to IPA creates a pair of subtrees for both users and 
compat and accounts, use groups as an example:
dn: cn=acdp,cn=groups,cn=compat,dc=sri,dc=utoronto,dc=ca
dn: cn=acdp,cn=groups,cn=accounts,dc=sri,dc=utoronto,dc=ca

IPA web GUI does not show  "memberUid" attribute, although it is migrated 
by adding a user to the group in the web GUI, it reveals that member is added 
to both
compat and accounts, but differently:
accounts: member: uid=qchang,cn=users,cn=accounts,dc=sri,dc=utoronto,dc=ca
compat: memberUid: qchang

It also reveals that GUI does not display anything for "compat" tree, but I can 
ldap tools to show compat entries.

My questions:
1, why do we have two trees created? I vaguely remember that it is mentioned 
    compat is for support of IPA as an NIS proxy?
2, Can the migration script be modified to convert "memberUid" to "member" for
    accounts tree? Or can I modify it manually and load the tree with ldapmod 
    breaking IPA?
3, What does Samba use, compat or accounts? I do have a Samba server setup as
    an IPA client and it works very well, but I don't seem to be able to find a 
    to specify either compat or accounts for user and group look up, I assume 
    client libraries take care of it. In fact there is no entries that are 
related to LDAP
    in my smb.conf, there is only a few lines related to IPA/Kerberos:
        security = user
        passdb backend = smbpasswd

# Kerberos options
        realm = SRI.UTORONTO.CA
        kerberos method = dedicated keytab
        dedicated keytab file = /etc/krb5.keytab

Thanks in advance!

Freeipa-users mailing list

Reply via email to