App Connect

App Connect

Join this online user group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Retrieving SAP adapter passwords for extract migration from IIB v9.0 to ACE v12

    Posted 3 days ago
    Edited by Abu Davis 3 days ago
      |   view attached

    Hei, we are in the process of migrating SAP integration flows from II9 v9.0 to ACE v12.0. As per the documentation here we will first attempt extract migration, but I was wondering where the password to connect to SAP (see screenshot here) is stored and if it will be copied over during the extract migration using mqsibackupbroker and mqsiextractcomponents commands?

    Additionally there was no mqsireportdbparms command available on the IIB v9.0 windows server and was wondering if the mqsisetdbparms is also copied over? Coz it says here "Currently, the mqsiextractcomponents command does not migrate the credentials that are set by using the mqsisetdbparms command in IBM Integration Bus Version 10.0 or Version 9.0. Therefore, you need to set the security identity and other credentials by running the mqsisetdbparms again in IBM App Connect Enterprise Version 11.0" but it doesn't say that in v12 doc

    Migrating an SAP integration flow

    Ibm remove preview
    Migrating an SAP integration flow
    Migrate an SAP integration flow that runs on IBM Integration Bus Version 10.0 or Version 9.0 to IBM App Connect Enterprise Version 11.0.
    View this on Ibm >



    ------------------------------
    Abu Davis
    ------------------------------



  • 2.  RE: Retrieving SAP adapter passwords for extract migration from IIB v9.0 to ACE v12

    Posted 11 hours ago

    Hi,

    The documentation specifically mentions migrations from version 10 to version 12, but not from version 9 to 12. It appears that a migration from v9 would need to go through v11 first. As a result, credentials set with mqsisetdbparms likely won't be migrated, since the mqsiextractcomponents command does not support migrating credentials. 

    That said, it may still be worth trying, as mqsiextractcomponents does in fact support migrating credentials from v10 to v12. (Credit to @Matthias Blomme for testing)

    C:\Program Files\IBM\IIB\10.0.0.26>mqsireportdbparms DUMMYCREDS -n rest::*
BIP8180I: The resource name 'rest::testCredsRest' has userID 'user'.
BIP8071I: Successful command completion.

C:\Program Files\IBM\ACE\12.0.12.5>mqsiextractcomponents --backup-file C:\Matthias\temp\dummycreds\backup.zip --source-integration-node DUMMYCREDS --target-integration-node DUMMYCREDS2
BIP8469I: Version '10.0' backup file supplied.
BIP8471I: Loading configuration for source integration node 'DUMMYCREDS'.
BIP8389W: Property 'sslProtocol' for the node wide httplistener 'HTTPSConnector' is no longer available. The property was configured with value 'TLS', which was not the default.
BIP8470I: Loading configuration for integration server 'IS1'.
BIP8473I: Creating target integration node 'DUMMYCREDS2'.
BIP8071I: Successful command completion.

C:\Program Files\IBM\ACE\12.0.12.5>mqsireportdbparms DUMMYCREDS2 -n rest::*
BIP8180I: The resource name 'rest::testCredsRest' has userID 'user'.
BIP8071I: Successful command completion.

    btw, I'd recommend migrating to v10 first and skipping v11 entirely, as v10 supports in-place migration from v9, which simplifies the process. -> v9 to v10 Migration

    I would also recommend to move to the ACE Vault as this is the way forward and will make your life easier going forward. -> Ace Vault



    ------------------------------
    Francis Cocx
    Integration Engineer
    Rijkevorsel
    ------------------------------

    Original Message


  • 3.  RE: Retrieving SAP adapter passwords for extract migration from IIB v9.0 to ACE v12
    Best Answer

    Posted 10 hours ago

    @Francis Cocx Thank you very much for the answer and also for testing this! So while I was awaiting a reply I did try to migrate from IIB 9.0.0.2 to ACE 12.0.12.15 and it gave the following logs.

    1. What I did not understand is why does it mention the following credentials (see dataSourcePassword in the log below) in the node.conf.yaml?
    2. Since there was no mqsireportdbparms command on the IIB 9.0.0.2 server, there was no way for me to know if the configurable service (which was missing btw) for SAP had its password stashed in mqsisetdbparms. This IIBTEST server did not have a configurable service but was still able to connect to SAP system. Is there someway to extract the password to connect to SAP adapter from the SAP adapter settings, coz it says ***** in the password when I open it on the ACE toolkit? 
    3. We did consider using the ACE Vault, but then not all the mqsicredentials commands can work on the Integration Node. For example, since "http" is a Integration Server mqsicredentials type the mqsicredentials command will create an ACE Vault in the Integration Server (instead of adding the http type to Integration Node's ACE Vault) which is annoying!?, is there any solution for this?: /var/mqsi/nodes/components/IIBTEST/servers/New/config

    ---

    BIP8468W: Version '9.0' backup file supplied. Extract support for backups from versions of the product that are out of support is limited.
    BIP8471I: Loading configuration for source integration node 'IIBTEST'.
    BIP8664W: The migrated value for the configuration property 'dataSourcePassword' may be a plaintext credential.
    BIP8470I: Loading configuration for integration server 'New'.
    BIP8470I: Loading configuration for integration server 'default'.
    BIP8470I: Loading configuration for integration server 'tmp'.
    BIP8473I: Creating target integration node 'IIBTEST'.
    BIP8071I: Successful command completion.

    ---

    node.conf.yaml on RHEL v10 where ACE v12.0.12.15 was installed:

    ---

    brokerUUID: 'c47c8be2-5504-11f0-9415-ac1f1afa0000'

    dataSourcePassword: 'Redacted'

    dataSourceUserId: 'LocalSystem'

    defaultQueueManager: 'QMGR1'

    ConnectorProviders: 

      SAPConnectorProvider: 

        jarsURL: 'c:\LIB64'

        nativeLibs: 'c:\LIB64'

    RestAdminListener: 

      authorizationMode: 'mq'

      port: 4414

    ---



    ------------------------------
    Abu Davis
    ------------------------------

    Original Message


  • 4.  RE: Retrieving SAP adapter passwords for extract migration from IIB v9.0 to ACE v12

    Posted 9 hours ago
    Edited by Francis Cocx 8 hours ago

    Hi,

    I don't have a lot of experience with the SAP adapter, but from what I understand, the credentials should migrate with the adapter file since they're part of it. That's probably why they show up when loaded into the toolkit. So you shouldn't need to migrate them separately. When we moved from v10 to v12, I don't recall needing to migrate the credentials independently.

    Does no-one have access to the sap system?

    For point 3. an external vault could be a solution to that problem.

    ______________________________________________________

    Edit

    I can confirm we were using the adapter file to store our credentials for that specific config. I would not recommend you do the same. Best way is to store the SAP credential in the vault with exact name of the adapter. They should be picked up automatically during runtime.

    Also, as Matthias pointed out. v9 does support mqsireportdbparms. So you should be able to cross check your credentials.


    ------------------------------
    Francis Cocx
    Integration Engineer
    Rijkevorsel
    ------------------------------

    Original Message


  • 5.  RE: Retrieving SAP adapter passwords for extract migration from IIB v9.0 to ACE v12

    Posted 8 hours ago
    Edited by Matthias Blomme 8 hours ago

    Hi @Abu Davis

    With regards to reportdbparms:
    V9 did support mqsireportdbparms: https://www.ibm.com/docs/en/integration-bus/9.0.0?topic=commands-mqsireportdbparms-command

    Any reason that is not working for you?

    About configurable services in v12
    You won't find Configurable Services anymore in v12, they are called policies now. And they should have been migrated, but they will be migrated to the node level (if memory serves), so you need to pull them down to integration server level after migration. Functionally they are roughly the same although in v12 they offer more flexibility and configurability,

    There are some name changes to be aware of, a couple of them:

    IBM Integration Bus

    App Connect Enterprise

    Broker

    Integration Node

    Execution group

    Integration Server

    Configurable Service

    Policy

    Flow without an application

    Independent Resource

    dataSource...

    The dataSourcePassword and dataSourceUserId are just generated by the ACE migration, you can keep them as-is (we did with previous migrations). Or remove them, shouldn't make a difference (but always keep a backup to be sure ;) )



    ------------------------------
    Regards
    Matthias Blomme
    Integration Specialist
    Integration Designers
    Turnhout
    ------------------------------

    Original Message


Related Content