Migrating existing portable homes to new server

Question

aside from moving the homedir data from the old server to the new, there seem to be at least a few issues with migrating existing portable home accounts to a new server:
1. some of users' account details, like GeneratedUID, authentication authority, kerberos principals, OriginalNFSHomeDirectory, are different, while others (name, shortname, UID, GID, etc.) remain the same.
2. home directory (OriginalNFSHomeDirectory, etc.) point to the old server.
3. there's data on local machines that we don't sync back to the server, so we can't just blow away the existing local accounts and start fresh.
the quickest way to migrate these users to the new server (with all the same shortnames and UIDs, etc.) seems to be to remove the local cached accounts (leaving the home folders) and have them recreate new PHDs on login, syncing things back down to the original home folder. i'm guess this won't involve much syncing, it's all the same data, essentially.
the other way i can see resolving this is to replace the account attributes for each client to match what they should be when pointed to the new server. this would involve scripting the process for reliability and not moving any data or deleting accounts, but it will take more testing on my part.
what do you think? can you think of better ways to accomplish this task?
summary: what's the best way to move existing portable home accounts bound to "Server A" to "Server B," while maintaining data and portable homes pointed to the new server and storage?
thanks.

Answer 1

that createmobileaccount syntax was wrong. i guess you don't need the -t option and can instead specify the whole path to the user's home. it seems to work well enough, creating a portable home with no default sync settings -- basically manual. for my needs that's fine. the sync settings are managed via mcx anyway.
here's an updated version of the standalone script. i realized just now the script assumes the diradmin usernames and passwords are the same between servers. if that's not the case, you can hard code it or add a couple of variables. since they're just taken in order on stdin, add them in order. i should also add a function to interactively ask for the passwords with stty -echo to avoid having the passes logged in command history or allowing the script to curl the pass from another file on a web server or something. for now, this seems to work for my purposes. edit as you see fit.
#!/bin/bash
# nate@tsp, 3/4/10: initial version
# 3/5/10: added prettier heredoc usage statement, variables, further tested
# todo: add function to add user to local admin group, as needed. this shouldn't be required in most environments.
# todo: convert some of these one-liners to functions for better modular use; make it "smarter"
# todo: convert the whole thing to ruby for practice
# automates the process of unbinding from the old OD server, binding to the new, removing the existing local user, adding it back, and other bits
# there are no "smarts" in this script, so use carefully
# variables
diradminpass=$1
account=$2
password=$3
oldserver=$4
newserver=$5
mkdadmin=$6 # not used in this version
# if no parameters are passed, display usage, exit
if [ ! -n "$5" ] ; then
cat<<endofnote
usage: you must include at least 5 arguments (6th isn't used right now)
run with `basename $0`
1. [directory admin password]
2. [shortname of account to change]
3. [account password, which should be the default 'xxxxxxxx' on the new server]
4. [name of old server]
5. [name of new server]
6. [yes or no to make this account a local admin - optional and not used now]
ex: `basename $0` diradminpass jbrown password oldserver newserver yes
endofnote
exit 1
fi
# if you're running this as root or with sudo, proceed; otherwise, quit it!
if [ $(whoami) = "root" ]; then
echo "you're root. let's proceed..."
# delete the user in question from the local directory store
echo "deleting local account: $account"
dscl . -delete /users/$account
# remove the old od config
echo "removing the old OD bind..."
dsconfigldap -v -r $oldserver -c $HOSTNAME -u diradmin -p $diradminpass
# remove the old server from the search and contacts paths
echo "removing the old search paths..."
dscl /Search -delete / CSPSearchPath /LDAPv3/$oldserver
dscl /Search/Contacts -delete / CSPSearchPath /LDAPv3/$oldserver
# add the new one
echo "adding the new OD bind..."
dsconfigldap -v -f -a $newserver -n $newserver -c $HOSTNAME -u diradmin -p $diradminpass
# create and add the new ldap node to the search policy
echo "adding the new search paths..."
dscl -q localhost -create /Search SearchPolicy dsAttrTypeStandard:CSPSearchPath
dscl -q localhost -merge /Search CSPSearchPath /LDAPv3/$newserver
# create and add the new ldap node for contacts lookups
dscl -q localhost -create /Contact SearchPolicy dsAttrTypeStandard:CSPSearchPath
dscl -q localhost -merge /Contact CSPSearchPath /LDAPv3/$newserver
# give directoryservice a kick to point it to the new server
echo "killing directoryservice and waiting for 20 seconds..."
killall DirectoryService
# rest a bit to ensure everything settled down
sleep 20
# optional: lookup the $account you deleted as the first step to ensure it exists in the new directory
echo "this id lookup should return details because it exists in the new OD:"
id odtestor
echo "this id lookup should fail because it doesn't exist in the old OD:"
id odtestor
# check the search path to ensure it looks like you need
echo "verify the new OD server is in the search path:"
dscl /Search -read / CSPSearchPath
# optional: create a mobile account on the local machine with various options set.
echo "creating a portable home for the user..."
/System/Library/CoreServices/ManagedClient.app/Contents/Resources/createmobileaccount -n $account -v -p $password -h /Users/$account -S -u afp://$newserver/homes/$account
killall DirectoryService
cat<<endofnote
you should be ready to login with this account now.
if you have trouble, revert the process by re-running with the old and new server names
(and diradmin passwords, if they're different) reversed.
endofnote
else
echo "you're not root or an admin. please re-run the script as an admin or via sudo."
exit
fi
exit 0