Provide a tool to migrate from IPA to IPA.
Currently IPA can migrate users and groups from a generic LDAP server, but if you already have an IPA deployment there is currently no mechanism to migrate IPA-specific data such as SUDO rules, HBAC, automount, hosts, services, etc (these last two may not be possible as re-enrollment of the client is required).
Unless we can preserve the kerberos keys and certs and migrate them to the new system. Thsi would generally mean that we carry over all the master keys and certs too.
Simo had worked out a way to preserve the Kerberos master key long ago. I'm not sure if it is still applicable today.
My thought was that you end up with a new Kerberos master key and a new CA, which means that all migrated principals need new keytabs, and certificates are excluded from the migration.
Related discussion: http://www.redhat.com/archives/freeipa-users/2014-January/msg00243.html
From Pter Spacek:
May be that we could provide a tool for FreeIPA domain rename, so you can create replica, disconnect the replica and then rename the FreeIPA domain to something else (renaming would include master-key regeneration etc.).
This solves two problems at once:
Related ticket solving migration from Kerberos realm: #4285.
There is an existing thesis topic proposal for this RFE: https://thesis-managementsystem.rhcloud.com/topic/show/215/freeipa-to-freeipa-migration
Ticket has been cloned to Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1301664
Metadata Update from @rcritten: - Issue assigned to someone - Issue set to the milestone: Future Releases
Metadata Update from @mkosek: - Custom field affects_doc reset - Custom field design adjusted to https://www.freeipa.org/page/V4/FreeIPA_to_FreeIPA_Migration - Custom field tester adjusted to wanted - Issue close_status updated to: None
Additional user stories:
As an IPA administrator I want to migrate IPA from dev/staging environment to production environment.
As an IPA administrator I want to migrate from one operating system to another. I.e. Fedora/CentOS to RHEL.
Metadata Update from @pvoborni: - Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1465917 (was: https://bugzilla.redhat.com/show_bug.cgi?id=1301664)
Issue linked to bug 1465917
master:
ipa-4-11:
Metadata Update from @abbra: - Custom field changelog adjusted to FreeIPA 4.12 adds a new specialized tool to migrate IPA-specific data between FreeIPA deployments. This allows to migrate between development/staging and production environments, as well as create new environment based on old setup. More information about supported features and semantics can be found at https://freeipa.readthedocs.io/en/latest/designs/ipa_to_ipa_migration.html
Metadata Update from @abbra: - Custom field design adjusted to https://freeipa.readthedocs.io/en/latest/designs/ipa_to_ipa_migration.html (was: https://www.freeipa.org/page/V4/FreeIPA_to_FreeIPA_Migration)
ipa-4-12:
Metadata Update from @frenaud: - Issue close_status updated to: fixed - Issue status updated to: Closed (was: Open)
