samba - Apr 2015 - Migration of 2 samba3 PDC+OpenLDAP in one new Samba4 AD

Hi Marc,
> Am 08.04.2015 um 17:25 schrieb BRIEC, Pierre:
>> On Site1, the machines accounts are specifics, same for the Users and
>> Groups except 1 group that is common with Site2 (The Teachers).
>> Today, each site is independant,
>>
>> Now, i would like a create a new domain Samba4 AD whith all machines
and
>> users from site1 and site2 together.
>> Then, i would make a replication between the two sites, and add one
RODC
>> server on each site
>
> RODC support isn't completely working yet. You shouldn't use it
atm.
could you please develop on that RODC support? I am very curious to know 
what should be working and what should not.

Actually I've been using RODC with partial success: RODC join, user and 
machine account preload (with corresponding patch), dns update throught 
netlogon service on RWDC, connexion when RWDC is disconnected. It has 
been running in production in our datacenter for webapp authentication 
for months, albeit with some hicups. I has never been completly fine 
from a stability and reproductibility point of view, and I switched it 
back to RWDC earlier this week....

Thanks,

Denis
>
>
>
>
>> How can i proceed? The migration tool from samba3 is working fine on
each
>> site (tested on isolated network)
>> Can someone give me some hints about this. I would be happy if the
>> migration could be transparent for the machines account, as 90% of the
>> Users are deleted in July (i'm IT manager in a school)
>
> AD trust are currently not fully implemented. If they were, then you
> chould do the classicupgrade on both domains, create a trust, move
> everything into one domain and demote the other.
>
> Because you can't do it that way, you could upgrade the domain which
has
> more objects (user, machines, groups) and join the workstations from the
> other site to it and recreate the users. You can write a script to
> export the users on the second site and create them with samba-tool.
>
> What kind of IDmapping are you using on the member servers in the
> domains? If the member servers are pulling the UIDs/GIDs from LDAP and
> the ID ranges don't overlap with the other domain, then you could
really
> recreate the users with a script running over an export. This prevents
> you from loosing ownership on files.
>
> For more details/ideas, you have to give some more information about the
> two backends.
>
>
>
> Regards,
> Marc
>
-- 
Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, b?timent A
12 avenue Jules Verne
44230 Saint S?bastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr

Hello Denis,

Am 09.04.2015 um 15:37 schrieb Denis Cardon:
> could you please develop on that RODC support? I am very curious to know
> what should be working and what should not.
>
> Actually I've been using RODC with partial success: RODC join, user and
> machine account preload (with corresponding patch), dns update throught
> netlogon service on RWDC, connexion when RWDC is disconnected. It has
> been running in production in our datacenter for webapp authentication
> for months, albeit with some hicups. I has never been completly fine
> from a stability and reproductibility point of view, and I switched it
> back to RWDC earlier this week....
Do you need a real AD RODC for that case? Or do your services just need 
to retrieve information via LDAP from AD? In the last case, you can 
setup an openLDAP proxy with read-only access:

https://wiki.samba.org/index.php/Authenticating_other_services_against_AD#openLDAP_proxy_to_AD


Regards,
Marc

Hi Marc,
> Am 09.04.2015 um 15:37 schrieb Denis Cardon:
>> could you please develop on that RODC support? I am very curious to
know
>> what should be working and what should not.
>>
>> Actually I've been using RODC with partial success: RODC join, user
and
>> machine account preload (with corresponding patch), dns update throught
>> netlogon service on RWDC, connexion when RWDC is disconnected. It has
>> been running in production in our datacenter for webapp authentication
>> for months, albeit with some hicups. I has never been completly fine
>> from a stability and reproductibility point of view, and I switched it
>> back to RWDC earlier this week....
>
> Do you need a real AD RODC for that case? Or do your services just need
> to retrieve information via LDAP from AD? In the last case, you can
> setup an openLDAP proxy with read-only access:
>
>
https://wiki.samba.org/index.php/Authenticating_other_services_against_AD#openLDAP_proxy_to_AD
thanks for your answer.

my question was not about setting a ldap proxy, but validating a working 
scenario for an RODC server on the long run. From earlier discussion it 
looks like it should works [1]. I'd like to know from your own 
experience what make you say that it doesn't ?:

 >>> RODC support isn't completely working yet. You shouldn't
use it atm.

Thanks,

Denis

[1] https://lists.samba.org/archive/samba/2015-February/189011.html
>
>
>
> Regards,
> Marc
>
>
-- 
Denis Cardon
Tranquil IT Systems
Les Espaces Jules Verne, b?timent A
12 avenue Jules Verne
44230 Saint S?bastien sur Loire
tel : +33 (0) 2.40.97.57.55
http://www.tranquil-it-systems.fr