[Freeipa-users] Re: Trouble with resetting caches

2023-04-10 Thread Rob Crittenden via FreeIPA-users
Kevin Vasko wrote: > Thanks. That is actually one of the other instances I had trouble with a > very similar type of experience. I felt I was constantly resetting > gssproxy, rpc-gssd services but it would never automatically pick up the > keytab. Left for the day and the very next day ran kinit 

[Freeipa-users] Re: Trouble with resetting caches

2023-04-10 Thread Kevin Vasko via FreeIPA-users
Thanks. That is actually one of the other instances I had trouble with a very similar type of experience. I felt I was constantly resetting gssproxy, rpc-gssd services but it would never automatically pick up the keytab. Left for the day and the very next day ran kinit to pick up where I left off

[Freeipa-users] Re: ipa migrate-ds

2023-04-10 Thread Rob Crittenden via FreeIPA-users
HUANG, TONY wrote: > I didn't get any errors regarding user private groups at all, and the > UPGs didn't even get migrated to become regular POSIX UNIX groups > either. They are just not there, so when I login I see a message > complaining that /usr/bin/id cannot find my group name. They may not

[Freeipa-users] Re: ipa migrate-ds

2023-04-10 Thread HUANG, TONY via FreeIPA-users
I didn't get any errors regarding user private groups at all, and the UPGs didn't even get migrated to become regular POSIX UNIX groups either. They are just not there, so when I login I see a message complaining that /usr/bin/id cannot find my group name. I've tried importing the entire

[Freeipa-users] Re: ipa migrate-ds

2023-04-10 Thread Rob Crittenden via FreeIPA-users
HUANG, TONY wrote: > Rob, > > I've tried the command from the website below with the same result. > Furthermore, at the FreeIPA to FreeIPA section it states "The command > doesn't migrate user private groups.", which is very strange, because my > migration becomes more complicated when i have to

[Freeipa-users] Re: ipa migrate-ds

2023-04-10 Thread HUANG, TONY via FreeIPA-users
Rob, I've tried the command from the website below with the same result. Furthermore, at the FreeIPA to FreeIPA section it states "The command doesn't migrate user private groups.", which is very strange, because my migration becomes more complicated when i have to change group ownership and

[Freeipa-users] Re: Trouble with resetting caches

2023-04-10 Thread Rob Crittenden via FreeIPA-users
Kevin Vasko via FreeIPA-users wrote: > Hello, > > Does anyone have any tips for completely refreshing (forcing cleaning) > all kerberos tickets on a client from FreeIPA? > > I assumed "$ kdestroy -A" should do it, but it certainly doesn't > completely clear all caches. > > What I'm having

[Freeipa-users] Re: ipa migrate-ds

2023-04-10 Thread Rob Crittenden via FreeIPA-users
HUANG, TONY wrote: > Hi Rob, > > Thanks for the reply.  > > User Private Group didn't get migrated. When I login I see Group number > being a number.  > > How do I migrate UPG over? I don't see why they didn't migrate in the first place. Using your CLI *only* groups migrated for me, not users,

[Freeipa-users] Trouble with resetting caches

2023-04-10 Thread Kevin Vasko via FreeIPA-users
Hello, Does anyone have any tips for completely refreshing (forcing cleaning) all kerberos tickets on a client from FreeIPA? I assumed "$ kdestroy -A" should do it, but it certainly doesn't completely clear all caches. What I'm having trouble with is some NFS/NAS servers using kerberos. I'll

[Freeipa-users] Re: ipa migrate-ds

2023-04-10 Thread HUANG, TONY via FreeIPA-users
Hi Rob, Thanks for the reply. User Private Group didn't get migrated. When I login I see Group number being a number. How do I migrate UPG over? Thanks very much! Tony On Mon, Apr 10, 2023, 7:34 AM Rob Crittenden wrote: > Tony Super via FreeIPA-users wrote: > > Hello, > > > > I am trying

[Freeipa-users] Re: ipa migrate-ds

2023-04-10 Thread Rob Crittenden via FreeIPA-users
Tony Super via FreeIPA-users wrote: > Hello, > > I am trying to migrate from my an IPA server that has FIPS disabled to an IPA > server that has FIPS enabled. Both the old and the new IPA will have DNS, CA, > and etc. > > I ran: ipa migrate-ds --bind-dn="cn=Directory Manager" >