Migrating from internal LDAP to external LDAP

Internal LDAP is not supported in Db2 Operator V2. Before uplifting to Db2 Operator V2 from the Legacy operator, migrate from internal to external LDAP.

Internal LDAP is not supported in Db2 Operator V2. If your current Legacy operator deployment has users and user groups using internal LDAP, you must migrate these users and user groups from the internal LDAP pod to an external LDAP server before upgrading to Db2 Operator V2.

The migration process involves exporting users and groups from the internal LDAP and importing them into your external LDAP server. This ensures that user authentication and authorization continue to work properly after the upgrade to Db2 Operator V2.

Export users and groups from internal LDAP

Connect to the internal LDAP pod and export the directory contents:

  1. Find the internal LDAP pod:

    oc get pods

  2. Connect to the pod:

    oc rsh <INTERNAL_LDAP_POD>

  3. Export directory data to an LDIF file:

    slapcat -n 3 > /tmp/internal-ldap.ldif

Review and adapt the LDIF for the target LDAP

Before importing the exported LDIF, review the file and make any modifications required by the target LDAP implementation.

Requirements vary between LDAP servers and may include changes to:

  • Distinguished Names (DNs)
  • Object classes
  • Attributes
  • Group membership definitions
  • Directory hierarchy (OUs, containers, naming contexts)
  • LDAP schema-specific requirements

Consult the documentation for your target LDAP server to determine any required transformations before importing the data.

Import users and groups into the external LDAP server

Import the modified LDIF into the external LDAP server using the tools and procedures recommended by the LDAP vendor.

For example, many LDAP implementations provide an ldapadd utility:

ldapadd -x -H ldap://<ldap-server> -D "<bind-dn>" -W -f internal-ldap.ldif

The commands to import the modified LDIF can be run from within the internal LDAP pod.

Refer to your LDAP vendor's documentation for the appropriate import procedure.