Managing LDAP changes in Connections
1 like704 views
The document outlines the challenges and solutions involved in migrating from one LDAP system to another, highlighting issues related to user DN changes and group identifiers. It details specific problems encountered, such as user deactivation and loss of access to files, and provides a general approach for implementing a custom GUID for users and groups to maintain access. The summary also lists steps necessary for the migration of various IBM products affected by the LDAP change.
Managing LDAP changes in Connections
- 3. Overview • Task: Migrate from 1 ldap to another • Difficulty: DN for users changes • Migrate as is à Issues • Solution
- 4. Disclaimer
- 7. Issue #1 • If using default as GUID and no special config • à Users deactivated à New users
- 8. Issue #2 • Cognos Administrative user is an LDAP user • Does not exist on new system • Even if you create identical user and have custom GUID, you will have to remove and re- add from application roles due to different realm
- 9. Issue #3 • IBM Forms field mapping for Displayname • Our old LDAP had another attribute name for the users displayname then the new one. • As IBM Forms does not use the Profiles DSX services, you need to change the IBM Forms config
- 11. Solution: General approach • Implement custom GUID GUID LoginName • We already had a custom GUID (best practice) for users • Add one for groups as well if you plan on using groups in connections !!! • Do this before you add CCM to your deployment
- 13. Solution: General approach • If an object is deleted, and recreated in LDAP, that object is recreated with a NEW ID (GUID) • Need to choose something “other” than the default! (e.g. uid, employee ID etc). • Custom GUID must follow following guidelines: • Must be unique and static • Must not exceed 256 char, for better performance se fixed length • Must be one to one mapping with the object http://www-01.ibm.com/support/knowledgecenter/SSYGQH_4.5.0/admin/install/ t_specify_dif_guid.dita?lang=en
- 20. Solution: General approach • We used a non-standard VMM Attribute for groups à wimxmlextension.xml
- 21. Solution: General approach • Corresponding LotusConnections-config.xml • On Connections you can override using LotusConnections-config.xml • I prefer not to override, especially when also using IBM Forms, IBM Cognos and IBM Filenet
- 22. Solution: #Issue 1 • The TDI Solution directory provided offers a solution to migrate your users (even if no custom GUID) • You can configure a mapping field that the sync process can use to identify the user in the old and new LDAP • Source LDAP is stored in the Profiles DB
- 24. Solution: #Issue 1 • Change all other needed parameters in the config file (LDAP, base entry, credentials, …) • Make the necassary changes to map_dbrepos_from_source.properties • Run the sync_all.dns script
- 27. Solution: Issue #2 • Run the following command while Cognos is running • Add the new account as admin in WebSphere • Update the J2C alias • Re-add Metrics Admins and remove Everyone
- 30. Solution: Issue #4 • Make sure you have custom GUID setup for Users and Groups à It is that simple • If you do not, your users will lose all access to libraries and documents • Don’t listen to IBM, they tell you you need a Filenet services team* for this migration
- 31. Solution: Issue #4 • Check Waltz debug log to see if FileNet picks up the Custom GUID • Download and copy log4j.xml to your server and place it in the Application server log folder • Add the following arguments to your JVM configuration -Dlog4j.configuration=/apps/ibm/data/WebSphere/profiles/ AppSrv01/logs/log4j.xml -DskipTLC=true
- 34. Solution: Issue #4 • Check FileNet SID’s for some users before migration as reference • 2 ways to do this • Database: UT_CLBUSERIDENTITYMAPPING (FNOS) • Command line: generateSID.sh
- 36. Recap: Migration steps • Backup Cognos and CCM Security • Migrate Profiles using TDI • Migrate LDAP in WebSphere • Migrate Cognos • Migrate Forms • Migrate CCM • Clearscheduler on all db’s
- 37. Questions?
- 38. Resources • Special thanks to Gabriel Nkuite, IBM France • http://www.slideshare.net/gabturtle/ connections-and-directory-integrationURL • http://www-01.ibm.com/support/ knowledgecenter/SSYGQH_4.5.0/admin/ install/t_specify_dif_guid.dita?lang=en