[CentOS] migrating users to openldap

On Fri, 29 Oct 2010 16:42:41 +0200 (CEST) "Alexander Dalloz"
<ad+lists at uni-x.org> wrote

> <SNIP>
> 
> The PADL script blindly uses {crypt}, although the password encryption
> mechanism may be very different.
> 
> > thanks in advance for any tips you can share that will get this working!
> 
> Alexander
> 

I think Alexander is onto something here.  I just checked my default CentOS 5
installation and /etc/sysconfig/authconfig specifies that the passwords are
hashed using MD5, so there's a good chance yours is too.  We ran into a problem
with this when we migrated users to the Sun directory server (not my choice!). 
The {?} part of the userPassword field value specifies the hash method used, so
if OpenLDAP supports MD5 you may be able to just do a global search-and-replace
of '{crypt}' with '{MD5}'.  

OTOH, if the "*" you showed in the message was literal, you'll probably have to
do some additional work to retrieve the user's password from /etc/shadow and
plug that in instead.  You could just cobble up a script to generate a simple
LDIF file just to change the passwords if you don't want to alter the output of
the PDL scripts.  The format is pretty simple, just look at the ldapmodify man
page for hints.  Just scan through /etc/shadow and look for something with a
pasword <> "!!" and generate the LDIF to change that user's password.

Just my $.02!
--
Jay Leafey - Memphis, TN
jay.leafey at mindless.com