samba - Jul 2012 - Samba 3 to Samba 4 migration

I have a production Samba 3 installation with an LDAP backend. CentOS 5.8, 
OpenLDAP. Works well.

I have a new Samba 4 installation with a different domain name on a new 
CentOS 6.2 system, using Samba4.0.0beta and bind 9.9. This system does not 
have Samba 3 or OpenLDAP installed. This installation passes all of the 
initial kerberos, ldap and dns tests. The name was changed because this 
system is on the same network as the Samba 3 installation (changing the 
network is not an option).

I have a file containing a slapcat output from the Samba 3 domain. I have 
edited this file to change the domain SID to the new domain's value. I 
have also removed all machine entries from this file for testing purposes.

So: how do I import the slapcat data into Samba 4's LDAP server? The 
procedure documented in the Samba 4 HOWTO cannot possibly work in my 
situation (never mind the fact that it refers to "/etc/ldap", which I
have
never heard of). Obviously missing something.

Steve

On Tue, 2012-07-03 at 16:02 -0400, Steve Thompson wrote:
> I have a production Samba 3 installation with an LDAP backend. CentOS 5.8, 
> OpenLDAP. Works well.
> 
> I have a new Samba 4 installation with a different domain name on a new 
> CentOS 6.2 system, using Samba4.0.0beta and bind 9.9. This system does not 
> have Samba 3 or OpenLDAP installed. This installation passes all of the 
> initial kerberos, ldap and dns tests. The name was changed because this 
> system is on the same network as the Samba 3 installation (changing the 
> network is not an option).
> 
> I have a file containing a slapcat output from the Samba 3 domain. I have 
> edited this file to change the domain SID to the new domain's value. I 
> have also removed all machine entries from this file for testing purposes.
> 
> So: how do I import the slapcat data into Samba 4's LDAP server? The 
> procedure documented in the Samba 4 HOWTO cannot possibly work in my 
> situation (never mind the fact that it refers to "/etc/ldap",
which I have
> never heard of). Obviously missing something.
Some of the extra instructions added here are a little distro-specific
it seems. 

You either need to start openldap on the new server, using the copied
data, or you need to point Samba at the old openldap server over TCP. 

I'm sure you can find the location of your OpenLDAP database to slapcat
from and to. 

Either way, it needs full access to a running LDAP directory (as we
perform this migration using the passdb code in the same way that Samba3
used it).

I hope this helps,

Andrew Bartlett
-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org

On Wed, 4 Jul 2012, Andrew Bartlett wrote:
> Either way, it needs full access to a running LDAP directory (as we
> perform this migration using the passdb code in the same way that Samba3
> used it).
Ah, got it. Thanks.

Steve