freeipa

#9825 Groups and subgroups migrated with ipa migrate-ds are flatten in cn=groups
Closed: invalid by abbra. Opened by woprandi.

Closed: invalid
Reopen Issue

Request for enhancement

Keep structure of groups migrated with ipa migrate-ds

Issue

I have a LDAP server with groups and subgroups. When I migrate them to FreeIPA with ipa migrate-ds --group-container=.... --scope=subtree all groups and subgroups are migrated but flatten in a unique level in cn=groups,cn=accounts,dc=DOMAIN

For example, I have ou=role,dc=DOMAIN as group with leaf cn=role1,ou=role,dc=DOMAIN entry
I also have ou=subrole,ou=role,dc=DOMAIN as subgroup with leafs cn=subrole1,ou=subrole,ou=role,dc=DOMAIN entries

This means I cannot have subgroups with same name

Steps to Reproduce

  1. Have a LDAP server instance (OpenLDAP for me) with groups and subgroups (like my example above)
  2. Run ipa migrate-ds ldap://LDAP --bind-dn=BIND --group-container=ou=role --scope=subtree

Actual behavior

Groups and subgroups are flatten in cn=groups,cn=accounts :
cn=role1,cn=groups, cn=subrole1,cn=groups

Expected behavior

Keep incoming structure in cn=groups

Version/Release/Distribution

FreeIPA 4.12.2

Additional info:

My LDAP server source is OpenLDAP 2.5.13

This is by design. FreeIPA does not have support for OUs and we do not plan adding any.

This was one of the original design decisions for FreeIPA: all objects have a flat storage structure under its own subtree. This applies to every single object type.

For example:

$ ipa env|grep container_|egrep '_user|_group|_host'
  container_group: cn=groups,cn=accounts
  container_host: cn=computers,cn=accounts
  container_hostgroup: cn=hostgroups,cn=accounts
  container_user: cn=users,cn=accounts

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.