managing ldap changes in connections

ManagingLDAPchangesinConnections

WannesRamsRamsit

Aboutme

www.ramsit.com/blog

twitter.com/wannesrams

linkedin.com/in/wannesramswww.ramsit.com

Socialconnections.info

Overview

• Task:Migratefrom1ldaptoanother

• Difficulty:DNforuserschanges

• Migrateasisà Issues

• Solution

Disclaimer

Migratefrom1ldaptoanother

Difficulty:DNforuserschanges

• CustomerLDAPteamdecidedtochangetheuserDNfromTo

Issue#1

• IfusingdefaultasGUIDandnospecialconfig• à Usersdeactivatedà Newusers

Issue#2

• CognosAdministrativeuserisanLDAPuser• Doesnotexistonnewsystem• EvenifyoucreateidenticaluserandhavecustomGUID,youwillhavetoremoveandre-addfromapplicationrolesduetodifferentrealm

Issue#3

• IBMFormsfieldmappingforDisplayname

• OuroldLDAPhadanotherattributenamefortheusersdisplaynamethenthenewone.

• AsIBMFormsdoesnotusetheProfilesDSXservices,youneedtochangetheIBMFormsconfig

Issue#4

• UserswillloseallaccesstoCCMfiles

• Withthedefaultconfiguration(nocustomguid)Filenetwillgeneratenewusers(justliketheTDISyncforprofiles).

Solution:Generalapproach

•ImplementcustomGUID

GUID LoginName

•WealreadyhadacustomGUID(bestpractice)forusers•Addoneforgroupsaswellifyouplanonusinggroupsinconnections!!!•DothisbeforeyouaddCCMtoyourdeployment


• TheIdentifierforUsersandGroupsinConnectionsistheGUID

• AGUIDforanobjectdoesnotchange


•Ifanobjectisdeleted,andrecreatedinLDAP,thatobjectisrecreatedwithaNEWID(GUID)•Needtochoosesomething“other”thanthedefault!(e.g.uid,employeeIDetc).

•CustomGUIDmustfollowfollowingguidelines:

• Mustbeuniqueandstatic• Mustnotexceed256char,forbetterperformancesefixed

length• Mustbeonetoonemappingwiththeobject

http://www-01.ibm.com/support/knowledgecenter/SSYGQH_4.5.0/admin/install/t_specify_dif_guid.dita?lang=en



•MustexistinLDAPSchemaandinWebSphereVirtualMemberManager(VMM)schema• Ifnot,addtheattributetothewimxmlextension.xmltomake

itavailabletoWebSphere•Connectionsmustbetoldabouttheseattributes

• LotusConenctions-config.xml•Mustbespecifiedinmap_dbrepos_from_source.properties

•Mustbeavailableineachobjectclassassignedtoyouruserorgroup


• OnWebSphere level, wimconfig.xmlis theplacetobe


• Weusedanon-standardVMMAttributeforgroupsà wimxmlextension.xml


• CorrespondingLotusConnections-config.xml

• OnConnectionsyoucanoverrideusingLotusConnections-config.xml

• Iprefernottooverride,especiallywhenalsousingIBMForms,IBMCognosandIBMFilenet

Solution:#Issue1

• TheTDISolutiondirectoryprovidedoffersasolutiontomigrateyourusers(evenifnocustomGUID)

• YoucanconfigureamappingfieldthatthesyncprocesscanusetoidentifytheuserintheoldandnewLDAP

• SourceLDAPisstoredintheProfilesDB

Solution:#Issue1

•BeforeMigration

•Changefollowingparameterinprofiles-tdi.properties• Sync_updates_hash_field

•AndmakesureyouenterauniquecrossLDAPvalue

Solution:#Issue1

• Changeallotherneededparametersintheconfigfile(LDAP,baseentry,credentials,…)

• Makethenecassarychangestomap_dbrepos_from_source.properties

• Runthesync_all.dnsscript

Solution:Issue#2

• Youwillneedtobackup allusersintheCognosAdminrole

Solution:Issue#2

• Updateadminuserandpasswordin/apps/ibm/bin/CognosConfig/cognos-setup.properties

Solution:Issue#2

• RunthefollowingcommandwhileCognosisrunning

• AddthenewaccountasadmininWebSphere• UpdatetheJ2Calias• Re-addMetricsAdminsandremoveEveryone

Solution:Issue#2• RemoveandaddusersfromWebSphereroles

Solution:Issue#3

• Check/apps/ibm/data/Forms/extensions/Builder_config.propertiesandverifythatthisisreflectingyournewLDAPà Restart

Solution:Issue#4

• MakesureyouhavecustomGUIDsetupforUsersandGroupsà Itisthatsimple

• Ifyoudonot,youruserswillloseallaccesstolibrariesanddocuments

• Don’tlistentoIBM,theytellyouyouneedaFilenetservicesteam*forthismigration

Solution:Issue#4

• CheckWaltzdebuglogtoseeifFileNetpicksuptheCustomGUID

• Downloadandcopylog4j.xmltoyourserverandplaceitintheApplicationserverlogfolder

• AddthefollowingargumentstoyourJVMconfiguration -Dlog4j.configuration=/apps/ibm/data/WebSphere/profiles/AppSrv01/logs/log4j.xml-DskipTLC=true

Solution:Issue#4

• ScreenshotJVMarguments`…

Solution:Issue#4

•RestartFilenetandcheckwaltz.sonata.trace.log

•CustomUserIdAttributeissettoUID•CustomGroupIdAttributeissettonull.ThiswillchangeaftermigrationtonewLDAP

Solution:Issue#4

• CheckFileNetSID’sforsomeusersbeforemigrationasreference

• 2waystodothis• Database:UT_CLBUSERIDENTITYMAPPING(FNOS)

• Commandline:generateSID.sh

Solution:Issue#4

• Aftermigration,checkagainforthesameusersafteruploadingadocumentwiththatuser.Ifconfigurationisgoodyoushouldseetheuseronlyonce…

Recap:Migrationsteps

• BackupCognosandCCMSecurity• MigrateProfilesusingTDI• MigrateLDAPinWebSphere• MigrateCognos• MigrateForms• MigrateCCM• Clearscheduleronalldb’s

Questions?

Resources

• SpecialthankstoGabrielNkuite,IBMFrance• http://www.slideshare.net/gabturtle/connections-and-directory-integrationURL

• http://www-01.ibm.com/support/knowledgecenter/SSYGQH_4.5.0/admin/install/t_specify_dif_guid.dita?lang=en

http://www.slideshare.net/gabturtle/connections-and-directory-integrationURL





PLATINUM&CHAMPAGNESPONSORS

GOLDSPONSORS

SILVERSPONSORS

BRONZESPONSORS

managing ldap changes in connections

Technology