Red Hat SYSTEM 8.0 - MIGRATION GUIDE 7.X TO 8.0 Manual page 69

20. Modify the content of rhcs80-new_DRM_instance.ldif so that the LDIF files contain the
required ACLs and other settings that were created with the new 8.0 instances.
NOTE
When using a text editor to perform the substitution instead of a script, use an editor
that supports file sizes greater than 4 gigabytes, such as vim, because the LDIF files
may be larger than 2 gigabytes and even 4 gigabytes in some deployments.
a. Open the Certificate System 8.0 LDIF directory.
cd /var/lib/dirsrv/slapd-example/ldif
b. Open the new-new_DRM_instance.ldif file, in read-only mode.
view new-new_DRM_instance.ldif
c. Open the rhcs80-new_DRM_instance.ldif file.
vi rhcs80-new_DRM_instance.ldif
d. Delete the entries for o=hostname-db,o=netscapeCertificateServer and
o=netscapeCertificateServer.
e. Add a new entry for the base DN used in the 8.0 database (something like
dc=server.example.com-new_DRM_instance). For example:
dn: dc=server.example.com-new_DRM_instance
objectClass: top
objectClass: domain
dc: server.example.com-new_DRM_instance
f. Change the base DN in every entry in the original file (o=hostname-
db,o=netscapeCertificateServer) to the one used for entries in the
new-new_DRM_instance.ldif file (dc=server.example.com-new_DRM_instance).
There could be thousands of entries affected.
g. Replace cn=aclResources entry in the rhcs80-new_DRM_instance.ldif file with the
cn=aclResources entry from the new-new_DRM_instance.ldif file. For example:
dn: cn=aclResources,dc=server.example.com-new_DRM_instance
resourceACLS: certServer.usrgrp.administration:read,modify:allow (read) group=
"Administrators" || group="Auditors" || group="Certificate Manager Agents" |
| group="Registration Manager Agents" || group="Data Recovery Manager Agents
" || group="Online Certificate Status Manager Agents";allow (modify) group="
Administrators":Administrators, auditors, and agents are allowed to read user
and group configuration but only administrators are allowed to modify
... list of ACLs ...
objectClass: top
objectClass: CertACLS
cn: aclResources
Migrating the LDAP Database
59