freeipa

#8626 Migrated users not attribut ipaNThash
Closed: invalid by abbra. Opened by firefighter.

Closed: invalid
Reopen Issue

Hello.
My specs:

cat /etc/system-release
CentOS Linux release 7.8.2003 (Core)
rpm -qa ipa-server
ipa-server-4.6.6-11.el7.centos.x86_64

We migrated users from openLDAP. These users do not have a attribute ipaNThash:

ldapsearch -h ipareplica2.opentech.local -D "cn=Directory Manager" -x -LLL -W -b 'cn=users,cn=accounts,dc=opentech,dc=local' 'uid=mkiselev' ipaNTHash
Enter LDAP Password: 
dn: uid=mkiselev,cn=users,cn=accounts,dc=opentech,dc=local

Changing the user's password doesn't help

If a new user is created in FreeIPA, then the attribute is:

ldapsearch -h ipareplica2.opentech.local -D "cn=Directory Manager" -x -LLL -W -b 'cn=users,cn=accounts,dc=opentech,dc=local' 'uid=test' ipaNTHash
Enter LDAP Password: 
dn: uid=test,cn=users,cn=accounts,dc=opentech,dc=local
ipaNTHash:: xaI3t+nY5wjYQ2thSKJfoQ==

What could be the problem?

Please do not use the issue tracker as a replacement to freeipa-users@ mailing list. Your question is better answered there.

For short:
- migrated users most likely have not ipaNTSecurityIdentifier attribute
- even when they have ipaNTSecurityIdentifier attribute, ipaNTHash value only generated when user changes their password

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.