Q: 10.6.8 to Mavericks Server Upgrade loses Open Directory Users

As a last resort, export the users. Upgrade. Import. Passwords will not be preserved.

Linc Davis advice is spot-on, as usual.

There seem to be dozens of sub-databases in the LDAP database. A problem in any of them seems to derail the entire conversion process. I tried a straight conversion and was also disappointed that there were unresolved issues, and it meant that the conversion failed.

So I did the export route using WorkGroup Manager, and exported four sets:

Users

Groups

Computers

Computer groups

go to the appropriate pane (e.g., Users) and Select All, then choose Export, and give it a name (probably with an embedded date in case you need to do it again later)

Then use 10.9 WorkGroup Manager (available as a separate download) to Import.

When re-imported, everything worked just fine (except the passwords, which cannot be carried forward using this method). I did have to manually enable at least one service, such as File Sharing service in Server [admin], or users showed up as "not allowed" [to log in].

--------

This entire process of getting Server 3 to work is fraught with peril, and everything converges on ONE diagnostic, "Network users can't log in". Which means you blew it, but provides no additional information about WHERE you blew it.

There do not appear to be any magic bullets. It is just a tough slog. Users who reported success after failing the first time reported they returned to fundamental principles and did all the steps over, in order, to attain success.

User experience is going to be very thin on this issue.

Your best bet (when you have an idea like this) is simply to try it and see.

Connection failed to node '/LDAPv3/127.0.0.1'

That's invalid. It should be the IP address of the interface the server listens on. I suggest you restore everything and start over. Make sure the OD master is set up correctly before you attempt to migrate. I never used 10.6 Server so I can't give you specific instructions. There's another forum here for that.

On the Server computer, check this:

Do you have exactly ONE Network Account server listed ONLY by fully-qualified Domain Name (not by IP Address) ?

I am pretty sure you need to use Directory Utility and put in the FQDN, and make sure your search path contains:

LDAPv3/your_domain

In any case, it's like chicken soup when you're sick: "It can't hurt!"

@buckster - I'm running into the same issue here trying to upgrade my v10.6.8 OD Server to 10.9.5 (heck, I'd consider 10.10.2 at this point.) My users' passwords have not made it over in the migration. I have tried both installing Mavericks, then migrating users, and installing Server.app, and cloning the 10.6.8 HD and running Maverics upgrade and the installing Server.app with the same outcome. I tried adding a keychain entry for the OD service as described above. What were the exact steps / order you did things in to get everything (including passwords) to migrate. (Tying to avoid mutant here, lol.) - Thanks

Hey, thanks for the quick reply on this. How gross. Only thing I'm wondering is, I opened up the full FreeRADIUS install on the 10.6.8 OD server, so I could auth my Wi-Fi users to different APs (other than Airports.) Used Jedda's how to as a guide.

I'm running running EAP-TTLS, so that process adds a server-generated cert to the client the first time they authenticate to the RADIUS server. Wondering if that is enough to cover my tracks regarding client-side certificates? I'm only looking at maybe 60 users so its not the end of the world, but still very annoying as I'll have to track every user down (you are all too familiar it seems.)