freeipa

#9958 ipa-migrate doesn't migrate custom kerberos password policies
Closed: fixed by sumenon. Opened by kororland.

Closed: fixed
Reopen Issue

What were you trying to do that didn't work?

ipa-migrate doesn't migrate custom password policies

What is the impact of this issue to you?

have to migrate them manually

Please provide the package NVR for which the bug is seen:

ipa-server-4.12.2-24.el10_1.1.x86_64

How reproducible is this bug?:

always

Steps to reproduce

install ipa server, add a group and create a custom policy:

# ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 -U
# echo Secret123 | kinit admin
# ipa group-add customPolicy
# ipa pwpolicy-add customPolicy --maxlife=4 --minlife=2 --history=2 --priority=3

On the destination server: install ipa server, migrate, check the policies:

# ipa-server-install --domain ipa.test --realm IPA.TEST --setup-dns --forwarder 10.11.5.160 -a Secret123 -p Secret123 -U
# echo Secret123 | kinit admin
# ipa-migrate -D cn=directory\ manager -w Secret123 -n prod-mode src1.ipa.test
# ipa pwpolicy-find
  Group: global_policy
  Max lifetime (days): 90
  Min lifetime (hours): 1
  History size: 0
  Character classes: 0
  Min length: 8
  Max failures: 6
  Failure reset interval: 60
  Lockout duration: 600
  Grace login limit: -1
----------------------------
Number of entries returned 1
----------------------------
# ipa pwpolicy-show customPolicy
ipa: ERROR: customPolicy: password policy not found

Expected results

default global_policy is updated, custom policies migrated

Actual results

default global_policy is updated, custom policies are not migrated (stored as objects in cn=$realm,cn=kerberos,$suffix with ipapwdpolicy objectClass)

PR: https://github.com/freeipa/freeipa/pull/8236

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8236
- Custom field rhbz adjusted to https://redhat.atlassian.net/browse/RHEL-153858

clone of https://redhat.atlassian.net/browse/RHEL-153858

master:

  • 091c0d82ffe28bcd6c26e6afc241f050b3e911a6 ipa-migrate: migrate custom kerberos password policies

ipa-4-12:

  • 3265c1d835055fb62c39d1fb9519f4506dbd16f4 ipa-migrate: migrate custom kerberos password policies

ipa-4-13:

  • 89d2405972534e38d812563f5f93e04d55f19963 ipa-migrate: migrate custom kerberos password policies

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
https://github.com/freeipa/freeipa/pull/8236
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.