freeipa

#9822 ipa migrate-ds with some operational attributes ?
Closed: invalid by woprandi. Opened by woprandi.

Closed: invalid
Reopen Issue

Request for enhancement

We use Keycloak linked with an OpenLDAP instance to implements SSO to our web applications. It works well.
We are investigating to migrate from OpenLDAP to FreeIPA to gain some features.

Issue

ipa migrate-ds works well but some "operationnal attributes" like entryUUID are not migrated (and I didn't see any option to override this behavior). But Keycloak use this field as user id (it's configurable but it's the default). Synchronization of users after FreeIPA migration will fail.
Are we supposed to remove then re-sync users in Keycloak ?

Steps to Reproduce

  1. OpenLDAP with users sync to a Keycloak instance
  2. Fresh FreeIPA instance
  3. Do a migration with ipa migrate-ds
  4. Update user federation in Keycloak to point to FreeIPA
  5. Do a full sync in Keycloak

Actual behavior

Sync fails

Expected behavior

Migration between OpenLDAP to FreeIPA should be transparent for Keycloak

Version/Release/Distribution

FreeIPA 4.12.2
Keycloak 24.0.4

The tool you are using (ipa migrate-ds) generally does not concern state of data in any other applications than the remote LDAP server and IPA LDAP itself.

ipa migrate-ds picks all normal attributes by specifying '*' as the list of attributes to search. Operational attributes have to be explicitly mentioned. However, operational attribute entryUUID is defined to be immutable by RFC4530 and thus cannot be assigned at will:

From RFC4530 section 2.4: (https://www.rfc-editor.org/rfc/rfc4530#section-2.4)

   Servers SHALL generate and assign a new UUID to each entry upon its
   addition to the directory and provide that UUID as the value of the
   'entryUUID' operational attribute.  An entry's UUID is immutable.

Indeed that does not seem doable. I will ask Keycloak developers instea. Thanks for your answer
Edited by woprandi

Metadata Update from @woprandi:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.