[36486] in Kerberos
Re: Migrating to new Kerb server - How to move all principals and
daemon@ATHENA.MIT.EDU (Rick van Rein)
Thu Sep 18 02:11:52 2014
Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\))
From: Rick van Rein <rick@openfortress.nl>
In-Reply-To: <AE3FEB1BD25D22479E9F293EBBF869B92BCA9DF5@exg-mb10a.clinlan.local>
Date: Thu, 18 Sep 2014 08:11:30 +0200
Message-Id: <0D17DBB0-BC10-43A3-8527-041407D79D88@openfortress.nl>
To: "Vignesh, Vanna G." <vignesh@musc.edu>
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="windows-1252"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hello Vanna,
If your backend store is LDAP, I would expect it to be portable. You can actually try that by having multiple KDCs use the same LDAP, because the KDC has readonly access. You could temporarily shut down the write actions during the transition (kadmin, kpasswd) but even there I doubt it would be problematic, as LDAP makes atomic object updates and Kerberos contains its data in single objects.
For other backends I don’t know — maybe a transition to LDAP first, but I don’t know if that’s documented anywhere.
Does this help?
Cheers,
-Rick
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
