IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  ISAM migration from 7.0 binary version to 9.0 Appliance

    Posted 01/23/20 08:54 AM
    Hi Folks,

    I am doing migration of an ISAM environment from ISAM 7.x in binary version to ISAM 9.06 in appliance version.
    I have a doubt specific to the WebSEAL migration.

    Take an example
    1. My Old WebSEAL was hosted on a Server that is Server1 and WebSEAL hostname name was Default. All the ACL and pop attachment was to the object /WebSEAL/Server1-Default.

    2. My new ISAM 9.06 appliance, is hosted on Server2. As per the process,
    a. I ran a migration perl script and created a zip file of the data exported from perl script.
    b. I created a new WebSEAL called Default on Server2. This created another object in the policy server that is  /WebSEAL/Server2-Default
    c. I imported config zip which was created in step a.  Migration was successful and WebSEAL was up and running after the restart and all junction also got migrated.

    However, all the ACLs, and Pop attachment is not migrated to the new WebSEAL object that is /WebSEAL/Server2-Default. I only see default ACL and no POP attached, however, my expectation was the old ACL and POP should have been attached on this new object. Do I need to apply the ACL and POP again? Or have I missed anything in the process?

    pdadmin sec_master> object show /WebSEAL/Server1-default/TestJunction
    Name:/WebSEAL/Server1-default/TestJunction
    Description:
    Type: 0 (Unknown)
    Is Policy Attachable: Yes
    Extended Attributes:
    Attached ACL: TestACL
    Attached POP: TestPOP
    Attached AuthzRule:

    pdadmin sec_master>object show /WebSEAL/Server2-default/TestJunction
    Name: object show /WebSEAL/Server2-default/TestJunction
    Description:
    Type: 16 (Management Object)
    Is Policy Attachable: Yes
    Extended Attributes:
    Attached ACL: default-webseal
    Attached POP: 
    Attached AuthzRule:

    ------------------------------
    Raj
    ------------------------------


  • 2.  RE: ISAM migration from 7.0 binary version to 9.0 Appliance

    Posted 01/24/20 03:29 AM
    HI

    The objectspace webseal honors based on the server-name stanza entry.

    usually, in an environment, multiple webseal instances shares a single objectspace and that is done by using same server-name value.

    Is that the case in your old environment? if yes , then you can do the same between old and new environment
    you can share the server-name of old webseal with server-name of new webseal which will automatically enforce the acls and pops attached on old objectspace.

    similar to below

    https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.0/com.ibm.isam.doc/wrp_config/task/tsk_replic_frontend_ws_srvr.html

    thanks
    tushar


    ------------------------------
    Tushar
    Tushar
    ------------------------------



Related Content