Re: importing an existing base into ldap

[Guillaume Rousse <Guillaume.Rousse@inria.fr>]

Javier Palacios a écrit :
>> No, I do have one already running KDC with existing principals stored in as
>> standard flat base (I did not well understood the interest of LDAP backend
>> when it was set up). I need to import it, rather than for users to retype
>> their password again.
> 
> So my mail was nearly useles ....
> It might be an overweighted solution and maybe not feasible, but have
> you though about setting up a ldap-kdc as a slave, and when it gets
> replicated promote it to master and closing the initial berkeley-kdc?
If finally did it, using a private ldap server. However, for an unknown 
reason, the slave KDC tries to add principal by suffixing DN with 
'-NEW', making the server refuse them:

2008-05-23T15:38:48 hdb_store: ldap_add_s: noe@LILLE.FUTURS.INRIA.FR 
(DN=krb5PrincipalName=noe@LILLE.FUTURS.INRIA.FR,ou=kerberos,dc=futurs,dc=inria,dc=fr-NEW) 
Server is unwilling to perform: no global superior knowledge

Here is my kdc configuration:
[kdc]
database = {
     dbname = ldap:ou=kerberos,dc=futurs,dc=inria,dc=fr
     acl_file = /var/lib/heimdal/kadmind.acl
     mkey_file = /var/lib/heimdal/m-key
}

I also tried hpropd, but it directly creates a file database on the disk.
-- 
Guillaume Rousse
Moyens Informatiques - INRIA Futurs
Tel: 01 69 35 69 62