Martin Kosek wrote:
On 06/01/2015 02:19 AM, Sina Owolabi wrote:

I am still stumbling along with this, I have had my IPA domain
destroyed and currently only a CA-less replica is left running the
The existing CA-less replica is on RHEL6.6 with ipa-3.0.0.
I am trying to setup a fresh CA-master and I have exported the data in
the replica into ldif and bak folders in
/var/lib/dirsrv/slapd-MYDOM-COM/{ldif,bak} directories.
I have copied these files and folders to the fresh install, which is
running RHEL7.1.
If I can complete an install, I plan to destroy the existing replica
and install from scratch 2 new ones just to be safe.

Please can someone direct me in properly editing the ldif file or the
bak archivedir to make it useful for the new CA master? I have already
deleted the existing replication agreements between the CA-less
replica and the lost CA master (the new fresh install is the same
Importing data is successful, but then IPA refuses to run afterwords
with different error messages.

Thanks for any light shown my way.

Let me reiterate to see if I understood your scenario correctly:

- you had CA-powered FreeIPA infrastructure, with just one FreeIPA
server with CA service running
- the single FreeIPA+CA server was lost (I would suggest having more of
those in the future or using backup (snapshot or ipa-backup))
- you now want to install a brand new FreeIPA server and add data from
the old FreeIPA installation.

This is quite tricky, you can just add data from old FreeIPA server to
the new server - the new FreeIPA server will have different Kerberos
master key, different CA key. All this and derived data would be
invalid. If you backed up the FreeIPA+CA master, I assume the PKI could
be recreated, but it does not seem as the case.

In that case, I am afraid you would need to start a new infrastructure
and migrate old data, I put short description on how to migrate one
FreeIPA to other FreeIPA on the wiki:

I guess it depends on what data you want/need to preserve from the original IPA installation and calculate which is more time consuming: crafting an LDIF to import or re-adding the data manually.

If you want to import from an LDIF, in general you need to:
- exclude any IPA master information (hosts, services, cn=masters,etc).
- exclude the admin user
- exclude any krbPrincipalKey values
- exclude any userCertificate values

You'll need to enable migration mode so your users can generate their Kerberos principal keys.

Also consider the UID range. If you installed the new master using the same range you'll probably want to modify the DNA range to mask out the already-assigned values.

If you used the same fqdn and REALM the import is easier.

You'll also need to re-enroll every client machine and browsers will need to re-import the CA cert. Expect conflicts.

I probably forgot some things too. It is not a super simple process though, and requires some understanding of IPA and its data.

So like I said, possible, but it can be problematic and expect several iterations of:

- import ldif
- test
- uninstall / reinstall
- goto import


Manage your subscription for the Freeipa-users mailing list:
Go to for more info on the project

Reply via email to