Transfer tokens from privacyidea 3.9.3 to privacyidea 3.12.3

Question
1

I’m new to admining privacyidea. We have a server running 3.9.3 and we are trying to upgarde to version 3.12.3. We tried to go the upgarde route with

pip install --upgrade privacyidea

but abandoned that after it was still working after 24+ hours. Now we have a new server running version 3.12.3 and we would like to be able to transfer the tokens and or data so that all the users don’t have to reinitialize they OTP. All users are using TOTP. Can this be done? The system using mariadb for the database.

2

Hi and welcome, killan_ed.

Yes, this can be done. The TOTP token secrets are stored in the MariaDB database, so users do not need to enroll their tokens again as long as the migration is performed correctly.

Since you already have a new server running 3.12.3, migrating the existing installation is probably the easiest approach. A direct upgrade from privacyIDEA 3.9.3 to 3.12.3 is supported, so the database schema can be upgraded after restoring your backup.

When migrating to the new server, don’t just restore the database. Make sure you also copy your pi.cfg from the old installation. In particular, check the PI_ENCFILE setting and copy the referenced encryption key (enckey) to the new server. This key is required to decrypt the token secrets stored in the database. If a different key is used, the existing tokens will no longer work.

A typical migration looks like this:

  1. Install privacyIDEA 3.12.3 on the new server.

  2. Copy or adapt pi.cfg from the old server to the new one. You can keep the SQLALCHEMY_DATABASE_URI from the new installation if you want to use the newly created MariaDB instance. Otherwise, make sure the database credentials match the old installation (or recreate the pi database user with the appropriate credentials).

  3. Copy the encryption key file referenced by PI_ENCFILE.

  4. Restore the MariaDB database backup.

  5. Run:

    pi-manage db upgrade

  6. Verify that authentication works with a few test users before switching users over to the new server.

As long as the database, pi.cfg, and the encryption key are migrated together, the existing TOTP tokens will continue to work and users won’t need to re-enroll them.